* [PATCH v2] arch : arm : add a criteria for pfn_valid
@ 2019-08-19 1:36 Zhaoyang Huang
2019-08-19 1:45 ` Zhaoyang Huang
2019-08-19 4:55 ` [PATCH v2] " Mike Rapoport
0 siblings, 2 replies; 5+ messages in thread
From: Zhaoyang Huang @ 2019-08-19 1:36 UTC (permalink / raw)
To: Andrew Morton, Zhaoyang Huang, Russell King, Mike Rapoport,
Rob Herring, Florian Fainelli, Geert Uytterhoeven, Doug Berger,
linux-mm, linux-kernel
From: Zhaoyang Huang <zhaoyang.huang@unisoc.com>
pfn_valid can be wrong when parsing a invalid pfn whose phys address
exceeds BITS_PER_LONG as the MSB will be trimed when shifted.
Signed-off-by: Zhaoyang Huang <zhaoyang.huang@unisoc.com>
---
arch/arm/mm/init.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/arch/arm/mm/init.c b/arch/arm/mm/init.c
index c2daabb..cc769fa 100644
--- a/arch/arm/mm/init.c
+++ b/arch/arm/mm/init.c
@@ -177,6 +177,11 @@ static void __init zone_sizes_init(unsigned long min, unsigned long max_low,
#ifdef CONFIG_HAVE_ARCH_PFN_VALID
int pfn_valid(unsigned long pfn)
{
+ phys_addr_t addr = __pfn_to_phys(pfn);
+
+ if (__phys_to_pfn(addr) != pfn)
+ return 0;
+
return memblock_is_map_memory(__pfn_to_phys(pfn));
}
EXPORT_SYMBOL(pfn_valid);
--
1.9.1
^ permalink raw reply related [flat|nested] 5+ messages in thread* [PATCH v2] arch : arm : add a criteria for pfn_valid
2019-08-19 1:36 [PATCH v2] arch : arm : add a criteria for pfn_valid Zhaoyang Huang
@ 2019-08-19 1:45 ` Zhaoyang Huang
2019-08-19 5:50 ` [PATCH v3] " Zhaoyang Huang
2019-08-19 4:55 ` [PATCH v2] " Mike Rapoport
1 sibling, 1 reply; 5+ messages in thread
From: Zhaoyang Huang @ 2019-08-19 1:45 UTC (permalink / raw)
To: Andrew Morton, Zhaoyang Huang, Russell King, Mike Rapoport,
Rob Herring, Florian Fainelli, Geert Uytterhoeven, Doug Berger,
linux-mm, linux-kernel
From: Zhaoyang Huang <zhaoyang.huang@unisoc.com>
pfn_valid can be wrong when parsing a invalid pfn whose phys address
exceeds BITS_PER_LONG as the MSB will be trimed when shifted.
Signed-off-by: Zhaoyang Huang <zhaoyang.huang@unisoc.com>
---
v2: use __pfn_to_phys/__phys_to_pfn instead of max_pfn as the criteria
---
arch/arm/mm/init.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/arch/arm/mm/init.c b/arch/arm/mm/init.c
index c2daabb..cc769fa 100644
--- a/arch/arm/mm/init.c
+++ b/arch/arm/mm/init.c
@@ -177,6 +177,11 @@ static void __init zone_sizes_init(unsigned long min, unsigned long max_low,
#ifdef CONFIG_HAVE_ARCH_PFN_VALID
int pfn_valid(unsigned long pfn)
{
+ phys_addr_t addr = __pfn_to_phys(pfn);
+
+ if (__phys_to_pfn(addr) != pfn)
+ return 0;
+
return memblock_is_map_memory(__pfn_to_phys(pfn));
}
EXPORT_SYMBOL(pfn_valid);
--
1.9.1
^ permalink raw reply related [flat|nested] 5+ messages in thread* [PATCH v3] arch : arm : add a criteria for pfn_valid
2019-08-19 1:45 ` Zhaoyang Huang
@ 2019-08-19 5:50 ` Zhaoyang Huang
2019-08-20 12:45 ` [Resend PATCH " Zhaoyang Huang
0 siblings, 1 reply; 5+ messages in thread
From: Zhaoyang Huang @ 2019-08-19 5:50 UTC (permalink / raw)
To: Andrew Morton, Zhaoyang Huang, Russell King, Mike Rapoport,
Rob Herring, Florian Fainelli, Geert Uytterhoeven, Doug Berger,
linux-mm, linux-kernel
From: Zhaoyang Huang <zhaoyang.huang@unisoc.com>
pfn_valid can be wrong when parsing a invalid pfn whose phys address
exceeds BITS_PER_LONG as the MSB will be trimed when shifted.
The issue originally arise from bellowing call stack, which corresponding to
an access of the /proc/kpageflags from userspace with a invalid pfn parameter
and leads to kernel panic.
[46886.723249] c7 [<c031ff98>] (stable_page_flags) from [<c03203f8>]
[46886.723264] c7 [<c0320368>] (kpageflags_read) from [<c0312030>]
[46886.723280] c7 [<c0311fb0>] (proc_reg_read) from [<c02a6e6c>]
[46886.723290] c7 [<c02a6e24>] (__vfs_read) from [<c02a7018>]
[46886.723301] c7 [<c02a6f74>] (vfs_read) from [<c02a778c>]
[46886.723315] c7 [<c02a770c>] (SyS_pread64) from [<c0108620>]
(ret_fast_syscall+0x0/0x28)
Signed-off-by: Zhaoyang Huang <zhaoyang.huang@unisoc.com>
---
v2: use __pfn_to_phys/__phys_to_pfn instead of max_pfn as the criteria
v3: update commit message to describe the defection's context
---
arch/arm/mm/init.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/arch/arm/mm/init.c b/arch/arm/mm/init.c
index c2daabb..cc769fa 100644
--- a/arch/arm/mm/init.c
+++ b/arch/arm/mm/init.c
@@ -177,6 +177,11 @@ static void __init zone_sizes_init(unsigned long min, unsigned long max_low,
#ifdef CONFIG_HAVE_ARCH_PFN_VALID
int pfn_valid(unsigned long pfn)
{
+ phys_addr_t addr = __pfn_to_phys(pfn);
+
+ if (__phys_to_pfn(addr) != pfn)
+ return 0;
+
return memblock_is_map_memory(__pfn_to_phys(pfn));
}
EXPORT_SYMBOL(pfn_valid);
--
1.9.1
^ permalink raw reply related [flat|nested] 5+ messages in thread* [Resend PATCH v3] arch : arm : add a criteria for pfn_valid
2019-08-19 5:50 ` [PATCH v3] " Zhaoyang Huang
@ 2019-08-20 12:45 ` Zhaoyang Huang
0 siblings, 0 replies; 5+ messages in thread
From: Zhaoyang Huang @ 2019-08-20 12:45 UTC (permalink / raw)
To: Andrew Morton, Zhaoyang Huang, Russell King, Mike Rapoport,
Rob Herring, Florian Fainelli, Geert Uytterhoeven, Doug Berger,
LKML, chunyan.zhang
From: Zhaoyang Huang <zhaoyang.huang@unisoc.com>
pfn_valid can be wrong when parsing a invalid pfn whose phys address
exceeds BITS_PER_LONG as the MSB will be trimed when shifted.
The issue originally arise from bellowing call stack, which corresponding to
an access of the /proc/kpageflags from userspace with a invalid pfn parameter
and leads to kernel panic.
[46886.723249] c7 [<c031ff98>] (stable_page_flags) from [<c03203f8>]
[46886.723264] c7 [<c0320368>] (kpageflags_read) from [<c0312030>]
[46886.723280] c7 [<c0311fb0>] (proc_reg_read) from [<c02a6e6c>]
[46886.723290] c7 [<c02a6e24>] (__vfs_read) from [<c02a7018>]
[46886.723301] c7 [<c02a6f74>] (vfs_read) from [<c02a778c>]
[46886.723315] c7 [<c02a770c>] (SyS_pread64) from [<c0108620>]
(ret_fast_syscall+0x0/0x28)
Signed-off-by: Zhaoyang Huang <zhaoyang.huang@unisoc.com>
Reviewed-by: Mike Rapoport <rppt@linux.ibm.com>
---
v2: use __pfn_to_phys/__phys_to_pfn instead of max_pfn as the criteria
v3: update commit message to describe the defection's context
add Mike Rapoport as reviewer
---
arch/arm/mm/init.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/arch/arm/mm/init.c b/arch/arm/mm/init.c
index c2daabb..cc769fa 100644
--- a/arch/arm/mm/init.c
+++ b/arch/arm/mm/init.c
@@ -177,6 +177,11 @@ static void __init zone_sizes_init(unsigned long
min, unsigned long max_low,
#ifdef CONFIG_HAVE_ARCH_PFN_VALID
int pfn_valid(unsigned long pfn)
{
+ phys_addr_t addr = __pfn_to_phys(pfn);
+
+ if (__phys_to_pfn(addr) != pfn)
+ return 0;
+
return memblock_is_map_memory(__pfn_to_phys(pfn));
}
EXPORT_SYMBOL(pfn_valid);
--
1.9.1
^ permalink raw reply related [flat|nested] 5+ messages in thread
* Re: [PATCH v2] arch : arm : add a criteria for pfn_valid
2019-08-19 1:36 [PATCH v2] arch : arm : add a criteria for pfn_valid Zhaoyang Huang
2019-08-19 1:45 ` Zhaoyang Huang
@ 2019-08-19 4:55 ` Mike Rapoport
1 sibling, 0 replies; 5+ messages in thread
From: Mike Rapoport @ 2019-08-19 4:55 UTC (permalink / raw)
To: Zhaoyang Huang
Cc: Andrew Morton, Zhaoyang Huang, Russell King, Rob Herring,
Florian Fainelli, Geert Uytterhoeven, Doug Berger, linux-mm,
linux-kernel
On Mon, Aug 19, 2019 at 09:36:09AM +0800, Zhaoyang Huang wrote:
> From: Zhaoyang Huang <zhaoyang.huang@unisoc.com>
>
> pfn_valid can be wrong when parsing a invalid pfn whose phys address
> exceeds BITS_PER_LONG as the MSB will be trimed when shifted.
I'd appreciate to see in the changelog that this could be triggered from
userspace via /proc/kpageflags
Otherwise:
Reviewed-by: Mike Rapoport <rppt@linux.ibm.com>
> Signed-off-by: Zhaoyang Huang <zhaoyang.huang@unisoc.com>
> ---
> arch/arm/mm/init.c | 5 +++++
> 1 file changed, 5 insertions(+)
>
> diff --git a/arch/arm/mm/init.c b/arch/arm/mm/init.c
> index c2daabb..cc769fa 100644
> --- a/arch/arm/mm/init.c
> +++ b/arch/arm/mm/init.c
> @@ -177,6 +177,11 @@ static void __init zone_sizes_init(unsigned long min, unsigned long max_low,
> #ifdef CONFIG_HAVE_ARCH_PFN_VALID
> int pfn_valid(unsigned long pfn)
> {
> + phys_addr_t addr = __pfn_to_phys(pfn);
> +
> + if (__phys_to_pfn(addr) != pfn)
> + return 0;
> +
> return memblock_is_map_memory(__pfn_to_phys(pfn));
> }
> EXPORT_SYMBOL(pfn_valid);
> --
> 1.9.1
>
--
Sincerely yours,
Mike.
^ permalink raw reply [flat|nested] 5+ messages in thread
end of thread, other threads:[~2019-08-20 12:45 UTC | newest]
Thread overview: 5+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2019-08-19 1:36 [PATCH v2] arch : arm : add a criteria for pfn_valid Zhaoyang Huang
2019-08-19 1:45 ` Zhaoyang Huang
2019-08-19 5:50 ` [PATCH v3] " Zhaoyang Huang
2019-08-20 12:45 ` [Resend PATCH " Zhaoyang Huang
2019-08-19 4:55 ` [PATCH v2] " Mike Rapoport
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).