From: Pavel Tatashin <pasha.tatashin@soleen.com>
To: pasha.tatashin@soleen.com, jmorris@namei.org, sashal@kernel.org,
ebiederm@xmission.com, kexec@lists.infradead.org,
linux-kernel@vger.kernel.org, corbet@lwn.net,
catalin.marinas@arm.com, will@kernel.org,
linux-arm-kernel@lists.infradead.org, marc.zyngier@arm.com,
james.morse@arm.com, vladimir.murzin@arm.com,
matthias.bgg@gmail.com, bhsharma@redhat.com, linux-mm@kvack.org,
mark.rutland@arm.com
Subject: [PATCH v3 05/17] arm64, hibernate: check pgd table allocation
Date: Wed, 21 Aug 2019 14:31:52 -0400 [thread overview]
Message-ID: <20190821183204.23576-6-pasha.tatashin@soleen.com> (raw)
In-Reply-To: <20190821183204.23576-1-pasha.tatashin@soleen.com>
There is a bug in create_safe_exec_page(), when page table is allocated
it is not checked that table is allocated successfully:
But it is dereferenced in: pgd_none(READ_ONCE(*pgdp)).
Another issue, is that phys_to_ttbr() uses an offset in page table instead
of pgd directly.
So, allocate page table, check that allocation was successful, and use it
directly to set ttbr0_el1.
Signed-off-by: Pavel Tatashin <pasha.tatashin@soleen.com>
---
arch/arm64/kernel/hibernate.c | 9 +++++++--
1 file changed, 7 insertions(+), 2 deletions(-)
diff --git a/arch/arm64/kernel/hibernate.c b/arch/arm64/kernel/hibernate.c
index ee34a06d8a35..750ecc7f2cbe 100644
--- a/arch/arm64/kernel/hibernate.c
+++ b/arch/arm64/kernel/hibernate.c
@@ -199,6 +199,7 @@ static int create_safe_exec_page(void *src_start, size_t length,
phys_addr_t *phys_dst_addr)
{
void *page = (void *)get_safe_page(GFP_ATOMIC);
+ pgd_t *trans_pgd;
pgd_t *pgdp;
pud_t *pudp;
pmd_t *pmdp;
@@ -210,7 +211,11 @@ static int create_safe_exec_page(void *src_start, size_t length,
memcpy(page, src_start, length);
__flush_icache_range((unsigned long)page, (unsigned long)page + length);
- pgdp = pgd_offset_raw((void *)get_safe_page(GFP_ATOMIC), dst_addr);
+ trans_pgd = (void *)get_safe_page(GFP_ATOMIC);
+ if (!trans_pgd)
+ return -ENOMEM;
+
+ pgdp = pgd_offset_raw(trans_pgd, dst_addr);
if (pgd_none(READ_ONCE(*pgdp))) {
pudp = (void *)get_safe_page(GFP_ATOMIC);
if (!pudp)
@@ -251,7 +256,7 @@ static int create_safe_exec_page(void *src_start, size_t length,
*/
cpu_set_reserved_ttbr0();
local_flush_tlb_all();
- write_sysreg(phys_to_ttbr(virt_to_phys(pgdp)), ttbr0_el1);
+ write_sysreg(phys_to_ttbr(virt_to_phys(trans_pgd)), ttbr0_el1);
isb();
*phys_dst_addr = virt_to_phys(page);
--
2.23.0
next prev parent reply other threads:[~2019-08-21 18:32 UTC|newest]
Thread overview: 44+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-08-21 18:31 [PATCH v3 00/17] arm64: MMU enabled kexec relocation Pavel Tatashin
2019-08-21 18:31 ` [PATCH v3 01/17] kexec: quiet down kexec reboot Pavel Tatashin
2019-09-06 15:17 ` James Morse
2019-09-06 15:35 ` Pavel Tatashin
2019-08-21 18:31 ` [PATCH v3 02/17] arm64, hibernate: use get_safe_page directly Pavel Tatashin
2019-09-06 15:17 ` James Morse
2019-09-06 15:39 ` Pavel Tatashin
2019-08-21 18:31 ` [PATCH v3 03/17] arm64, hibernate: remove gotos in create_safe_exec_page Pavel Tatashin
2019-09-06 15:17 ` James Morse
2019-09-06 15:41 ` Pavel Tatashin
2019-08-21 18:31 ` [PATCH v3 04/17] arm64, hibernate: rename dst to page " Pavel Tatashin
2019-09-06 15:17 ` James Morse
2019-09-06 15:41 ` Pavel Tatashin
2019-08-21 18:31 ` Pavel Tatashin [this message]
2019-09-06 15:17 ` [PATCH v3 05/17] arm64, hibernate: check pgd table allocation James Morse
2019-09-06 15:44 ` Pavel Tatashin
2019-08-21 18:31 ` [PATCH v3 06/17] arm64, hibernate: add trans_pgd public functions Pavel Tatashin
2019-09-06 15:18 ` James Morse
2019-09-06 16:00 ` Pavel Tatashin
2019-10-11 18:16 ` James Morse
2019-08-21 18:31 ` [PATCH v3 07/17] arm64, hibernate: move page handling function to new trans_pgd.c Pavel Tatashin
2019-09-06 15:18 ` James Morse
2019-09-06 17:41 ` Pavel Tatashin
2019-08-21 18:31 ` [PATCH v3 08/17] arm64, trans_pgd: make trans_pgd_map_page generic Pavel Tatashin
2019-09-06 15:20 ` James Morse
2019-09-06 18:58 ` Pavel Tatashin
2019-10-11 18:15 ` James Morse
2019-08-21 18:31 ` [PATCH v3 09/17] arm64, trans_pgd: add trans_pgd_create_empty Pavel Tatashin
2019-09-06 15:20 ` James Morse
2019-09-06 19:00 ` Pavel Tatashin
2019-08-21 18:31 ` [PATCH v3 10/17] arm64, trans_pgd: adjust trans_pgd_create_copy interface Pavel Tatashin
2019-09-06 15:20 ` James Morse
2019-09-06 19:03 ` Pavel Tatashin
2019-08-21 18:31 ` [PATCH v3 11/17] arm64, trans_pgd: add PUD_SECT_RDONLY Pavel Tatashin
2019-09-06 15:21 ` James Morse
2019-09-06 19:04 ` Pavel Tatashin
2019-08-21 18:31 ` [PATCH v3 12/17] arm64, trans_pgd: complete generalization of trans_pgds Pavel Tatashin
2019-09-06 15:23 ` James Morse
2019-09-06 19:06 ` Pavel Tatashin
2019-08-21 18:32 ` [PATCH v3 13/17] kexec: add machine_kexec_post_load() Pavel Tatashin
2019-08-21 18:32 ` [PATCH v3 14/17] arm64, kexec: move relocation function setup and clean up Pavel Tatashin
2019-08-21 18:32 ` [PATCH v3 15/17] arm64, kexec: add expandable argument to relocation function Pavel Tatashin
2019-08-21 18:32 ` [PATCH v3 16/17] arm64, kexec: configure trans_pgd page table for kexec Pavel Tatashin
2019-08-21 18:32 ` [PATCH v3 17/17] arm64, kexec: enable MMU during kexec relocation Pavel Tatashin
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20190821183204.23576-6-pasha.tatashin@soleen.com \
--to=pasha.tatashin@soleen.com \
--cc=bhsharma@redhat.com \
--cc=catalin.marinas@arm.com \
--cc=corbet@lwn.net \
--cc=ebiederm@xmission.com \
--cc=james.morse@arm.com \
--cc=jmorris@namei.org \
--cc=kexec@lists.infradead.org \
--cc=linux-arm-kernel@lists.infradead.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-mm@kvack.org \
--cc=marc.zyngier@arm.com \
--cc=mark.rutland@arm.com \
--cc=matthias.bgg@gmail.com \
--cc=sashal@kernel.org \
--cc=vladimir.murzin@arm.com \
--cc=will@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).