* [PATCH] x86/mm: Do not reference phys addr beyond kernel
@ 2016-06-15 19:05 Kees Cook
2016-07-07 22:14 ` Kees Cook
2016-07-10 18:16 ` [tip:x86/boot] " tip-bot for Thomas Garnier
0 siblings, 2 replies; 3+ messages in thread
From: Kees Cook @ 2016-06-15 19:05 UTC (permalink / raw)
To: Ingo Molnar
Cc: linux-kernel, Thomas Garnier, x86, Borislav Petkov, Matt Fleming,
Toshi Kani, Sai Praneeth, Dexuan Cui, Christian Borntraeger,
Chris Wilson
From: Thomas Garnier <thgarnie@google.com>
The new physical address randomized KASLR implementation can cause the
kernel to be aligned close to the end of physical memory. In this case,
_brk_end aligned to PMD will go beyond what is expected safe and hit
the assert in __phys_addr_symbol():
VIRTUAL_BUG_ON(y >= KERNEL_IMAGE_SIZE);
Instead, perform an inclusive range check to avoid incorrectly triggering
the assert:
kernel BUG at arch/x86/mm/physaddr.c:38!
invalid opcode: 0000 [#1] SMP
...
RIP: 0010:[<ffffffffbe055721>] __phys_addr_symbol+0x41/0x50
...
Call Trace:
[<ffffffffbe052eb9>] cpa_process_alias+0xa9/0x210
[<ffffffffbe109011>] ? do_raw_spin_unlock+0xc1/0x100
[<ffffffffbe051eef>] __change_page_attr_set_clr+0x8cf/0xbd0
[<ffffffffbe201a4d>] ? vm_unmap_aliases+0x7d/0x210
[<ffffffffbe05237c>] change_page_attr_set_clr+0x18c/0x4e0
[<ffffffffbe0534ec>] set_memory_4k+0x2c/0x40
[<ffffffffbefb08b3>] check_bugs+0x28/0x2a
[<ffffffffbefa4f52>] start_kernel+0x49d/0x4b9
[<ffffffffbefa4120>] ? early_idt_handler_array+0x120/0x120
[<ffffffffbefa4423>] x86_64_start_reservations+0x29/0x2b
[<ffffffffbefa4568>] x86_64_start_kernel+0x143/0x152
Signed-off-by: Thomas Garnier <thgarnie@google.com>
Signed-off-by: Kees Cook <keescook@chromium.org>
---
Needed before the KASLR improvement series can be finished.
---
arch/x86/mm/pageattr.c | 12 ++++++++++--
1 file changed, 10 insertions(+), 2 deletions(-)
diff --git a/arch/x86/mm/pageattr.c b/arch/x86/mm/pageattr.c
index 7a1f7bbf4105..379b5111ac6b 100644
--- a/arch/x86/mm/pageattr.c
+++ b/arch/x86/mm/pageattr.c
@@ -101,7 +101,8 @@ static inline unsigned long highmap_start_pfn(void)
static inline unsigned long highmap_end_pfn(void)
{
- return __pa_symbol(roundup(_brk_end, PMD_SIZE)) >> PAGE_SHIFT;
+ /* Do not reference physical address outside the kernel. */
+ return __pa_symbol(roundup(_brk_end, PMD_SIZE) - 1) >> PAGE_SHIFT;
}
#endif
@@ -112,6 +113,12 @@ within(unsigned long addr, unsigned long start, unsigned long end)
return addr >= start && addr < end;
}
+static inline int
+within_inclusive(unsigned long addr, unsigned long start, unsigned long end)
+{
+ return addr >= start && addr <= end;
+}
+
/*
* Flushing functions
*/
@@ -1316,7 +1323,8 @@ static int cpa_process_alias(struct cpa_data *cpa)
* to touch the high mapped kernel as well:
*/
if (!within(vaddr, (unsigned long)_text, _brk_end) &&
- within(cpa->pfn, highmap_start_pfn(), highmap_end_pfn())) {
+ within_inclusive(cpa->pfn, highmap_start_pfn(),
+ highmap_end_pfn())) {
unsigned long temp_cpa_vaddr = (cpa->pfn << PAGE_SHIFT) +
__START_KERNEL_map - phys_base;
alias_cpa = *cpa;
--
2.7.4
--
Kees Cook
Chrome OS & Brillo Security
^ permalink raw reply related [flat|nested] 3+ messages in thread* Re: [PATCH] x86/mm: Do not reference phys addr beyond kernel
2016-06-15 19:05 [PATCH] x86/mm: Do not reference phys addr beyond kernel Kees Cook
@ 2016-07-07 22:14 ` Kees Cook
2016-07-10 18:16 ` [tip:x86/boot] " tip-bot for Thomas Garnier
1 sibling, 0 replies; 3+ messages in thread
From: Kees Cook @ 2016-07-07 22:14 UTC (permalink / raw)
To: Ingo Molnar
Cc: LKML, Thomas Garnier, x86, Borislav Petkov, Matt Fleming,
Toshi Kani, Sai Praneeth, Dexuan Cui, Christian Borntraeger,
Chris Wilson
On Wed, Jun 15, 2016 at 3:05 PM, Kees Cook <keescook@chromium.org> wrote:
> From: Thomas Garnier <thgarnie@google.com>
>
> The new physical address randomized KASLR implementation can cause the
> kernel to be aligned close to the end of physical memory. In this case,
> _brk_end aligned to PMD will go beyond what is expected safe and hit
> the assert in __phys_addr_symbol():
>
> VIRTUAL_BUG_ON(y >= KERNEL_IMAGE_SIZE);
>
> Instead, perform an inclusive range check to avoid incorrectly triggering
> the assert:
>
> kernel BUG at arch/x86/mm/physaddr.c:38!
> invalid opcode: 0000 [#1] SMP
> ...
> RIP: 0010:[<ffffffffbe055721>] __phys_addr_symbol+0x41/0x50
> ...
> Call Trace:
> [<ffffffffbe052eb9>] cpa_process_alias+0xa9/0x210
> [<ffffffffbe109011>] ? do_raw_spin_unlock+0xc1/0x100
> [<ffffffffbe051eef>] __change_page_attr_set_clr+0x8cf/0xbd0
> [<ffffffffbe201a4d>] ? vm_unmap_aliases+0x7d/0x210
> [<ffffffffbe05237c>] change_page_attr_set_clr+0x18c/0x4e0
> [<ffffffffbe0534ec>] set_memory_4k+0x2c/0x40
> [<ffffffffbefb08b3>] check_bugs+0x28/0x2a
> [<ffffffffbefa4f52>] start_kernel+0x49d/0x4b9
> [<ffffffffbefa4120>] ? early_idt_handler_array+0x120/0x120
> [<ffffffffbefa4423>] x86_64_start_reservations+0x29/0x2b
> [<ffffffffbefa4568>] x86_64_start_kernel+0x143/0x152
>
> Signed-off-by: Thomas Garnier <thgarnie@google.com>
> Signed-off-by: Kees Cook <keescook@chromium.org>
> ---
> Needed before the KASLR improvement series can be finished.
Just checking on where this patch stands -- it's a needed bug fix for
the KASLR improvements that are already in -tip.
-Kees
> ---
> arch/x86/mm/pageattr.c | 12 ++++++++++--
> 1 file changed, 10 insertions(+), 2 deletions(-)
>
> diff --git a/arch/x86/mm/pageattr.c b/arch/x86/mm/pageattr.c
> index 7a1f7bbf4105..379b5111ac6b 100644
> --- a/arch/x86/mm/pageattr.c
> +++ b/arch/x86/mm/pageattr.c
> @@ -101,7 +101,8 @@ static inline unsigned long highmap_start_pfn(void)
>
> static inline unsigned long highmap_end_pfn(void)
> {
> - return __pa_symbol(roundup(_brk_end, PMD_SIZE)) >> PAGE_SHIFT;
> + /* Do not reference physical address outside the kernel. */
> + return __pa_symbol(roundup(_brk_end, PMD_SIZE) - 1) >> PAGE_SHIFT;
> }
>
> #endif
> @@ -112,6 +113,12 @@ within(unsigned long addr, unsigned long start, unsigned long end)
> return addr >= start && addr < end;
> }
>
> +static inline int
> +within_inclusive(unsigned long addr, unsigned long start, unsigned long end)
> +{
> + return addr >= start && addr <= end;
> +}
> +
> /*
> * Flushing functions
> */
> @@ -1316,7 +1323,8 @@ static int cpa_process_alias(struct cpa_data *cpa)
> * to touch the high mapped kernel as well:
> */
> if (!within(vaddr, (unsigned long)_text, _brk_end) &&
> - within(cpa->pfn, highmap_start_pfn(), highmap_end_pfn())) {
> + within_inclusive(cpa->pfn, highmap_start_pfn(),
> + highmap_end_pfn())) {
> unsigned long temp_cpa_vaddr = (cpa->pfn << PAGE_SHIFT) +
> __START_KERNEL_map - phys_base;
> alias_cpa = *cpa;
> --
> 2.7.4
>
>
> --
> Kees Cook
> Chrome OS & Brillo Security
--
Kees Cook
Chrome OS & Brillo Security
^ permalink raw reply [flat|nested] 3+ messages in thread* [tip:x86/boot] x86/mm: Do not reference phys addr beyond kernel
2016-06-15 19:05 [PATCH] x86/mm: Do not reference phys addr beyond kernel Kees Cook
2016-07-07 22:14 ` Kees Cook
@ 2016-07-10 18:16 ` tip-bot for Thomas Garnier
1 sibling, 0 replies; 3+ messages in thread
From: tip-bot for Thomas Garnier @ 2016-07-10 18:16 UTC (permalink / raw)
To: linux-tip-commits
Cc: mingo, peterz, hpa, tglx, decui, sai.praneeth.prakhya, luto,
borntraeger, bp, linux-kernel, matt, chris, thgarnie, bp,
keescook, dvlasenk, brgerst, torvalds, jpoimboe, toshi.kani
Commit-ID: 4ff5308744f5858e4e49e56a0445e2f8b73e47e0
Gitweb: http://git.kernel.org/tip/4ff5308744f5858e4e49e56a0445e2f8b73e47e0
Author: Thomas Garnier <thgarnie@google.com>
AuthorDate: Wed, 15 Jun 2016 12:05:45 -0700
Committer: Ingo Molnar <mingo@kernel.org>
CommitDate: Sun, 10 Jul 2016 17:21:37 +0200
x86/mm: Do not reference phys addr beyond kernel
The new physical address randomized KASLR implementation can cause the
kernel to be aligned close to the end of physical memory. In this case,
_brk_end aligned to PMD will go beyond what is expected safe and hit
the assert in __phys_addr_symbol():
VIRTUAL_BUG_ON(y >= KERNEL_IMAGE_SIZE);
Instead, perform an inclusive range check to avoid incorrectly triggering
the assert:
kernel BUG at arch/x86/mm/physaddr.c:38!
invalid opcode: 0000 [#1] SMP
...
RIP: 0010:[<ffffffffbe055721>] __phys_addr_symbol+0x41/0x50
...
Call Trace:
[<ffffffffbe052eb9>] cpa_process_alias+0xa9/0x210
[<ffffffffbe109011>] ? do_raw_spin_unlock+0xc1/0x100
[<ffffffffbe051eef>] __change_page_attr_set_clr+0x8cf/0xbd0
[<ffffffffbe201a4d>] ? vm_unmap_aliases+0x7d/0x210
[<ffffffffbe05237c>] change_page_attr_set_clr+0x18c/0x4e0
[<ffffffffbe0534ec>] set_memory_4k+0x2c/0x40
[<ffffffffbefb08b3>] check_bugs+0x28/0x2a
[<ffffffffbefa4f52>] start_kernel+0x49d/0x4b9
[<ffffffffbefa4120>] ? early_idt_handler_array+0x120/0x120
[<ffffffffbefa4423>] x86_64_start_reservations+0x29/0x2b
[<ffffffffbefa4568>] x86_64_start_kernel+0x143/0x152
Signed-off-by: Thomas Garnier <thgarnie@google.com>
Signed-off-by: Kees Cook <keescook@chromium.org>
Cc: Andy Lutomirski <luto@kernel.org>
Cc: Borislav Petkov <bp@alien8.de>
Cc: Borislav Petkov <bp@suse.de>
Cc: Brian Gerst <brgerst@gmail.com>
Cc: Chris Wilson <chris@chris-wilson.co.uk>
Cc: Christian Borntraeger <borntraeger@de.ibm.com>
Cc: Denys Vlasenko <dvlasenk@redhat.com>
Cc: Dexuan Cui <decui@microsoft.com>
Cc: H. Peter Anvin <hpa@zytor.com>
Cc: Josh Poimboeuf <jpoimboe@redhat.com>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Matt Fleming <matt@codeblueprint.co.uk>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Sai Praneeth <sai.praneeth.prakhya@intel.com>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Toshi Kani <toshi.kani@hpe.com>
Link: http://lkml.kernel.org/r/20160615190545.GA26071@www.outflux.net
Signed-off-by: Ingo Molnar <mingo@kernel.org>
---
arch/x86/mm/pageattr.c | 12 ++++++++++--
1 file changed, 10 insertions(+), 2 deletions(-)
diff --git a/arch/x86/mm/pageattr.c b/arch/x86/mm/pageattr.c
index 7a1f7bb..379b511 100644
--- a/arch/x86/mm/pageattr.c
+++ b/arch/x86/mm/pageattr.c
@@ -101,7 +101,8 @@ static inline unsigned long highmap_start_pfn(void)
static inline unsigned long highmap_end_pfn(void)
{
- return __pa_symbol(roundup(_brk_end, PMD_SIZE)) >> PAGE_SHIFT;
+ /* Do not reference physical address outside the kernel. */
+ return __pa_symbol(roundup(_brk_end, PMD_SIZE) - 1) >> PAGE_SHIFT;
}
#endif
@@ -112,6 +113,12 @@ within(unsigned long addr, unsigned long start, unsigned long end)
return addr >= start && addr < end;
}
+static inline int
+within_inclusive(unsigned long addr, unsigned long start, unsigned long end)
+{
+ return addr >= start && addr <= end;
+}
+
/*
* Flushing functions
*/
@@ -1316,7 +1323,8 @@ static int cpa_process_alias(struct cpa_data *cpa)
* to touch the high mapped kernel as well:
*/
if (!within(vaddr, (unsigned long)_text, _brk_end) &&
- within(cpa->pfn, highmap_start_pfn(), highmap_end_pfn())) {
+ within_inclusive(cpa->pfn, highmap_start_pfn(),
+ highmap_end_pfn())) {
unsigned long temp_cpa_vaddr = (cpa->pfn << PAGE_SHIFT) +
__START_KERNEL_map - phys_base;
alias_cpa = *cpa;
^ permalink raw reply related [flat|nested] 3+ messages in thread
end of thread, other threads:[~2016-07-10 18:18 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2016-06-15 19:05 [PATCH] x86/mm: Do not reference phys addr beyond kernel Kees Cook
2016-07-07 22:14 ` Kees Cook
2016-07-10 18:16 ` [tip:x86/boot] " tip-bot for Thomas Garnier
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).