From: Guenter Roeck <linux@roeck-us.net>
To: Maurizio Lombardi <mlombard@redhat.com>
Cc: rppt@kernel.org, bp@alien8.de, tglx@linutronix.de,
x86@kernel.org, pjones@redhat.com, konrad@kernel.org,
george.kennedy@oracle.com, rafael@kernel.org,
linux-kernel@vger.kernel.org
Subject: Re: [PATCH V3] iscsi_ibft: fix crash due to KASLR physical memory remapping
Date: Wed, 1 Sep 2021 09:47:22 -0700 [thread overview]
Message-ID: <20210901164722.GA2100627@roeck-us.net> (raw)
In-Reply-To: <20210729135250.32212-1-mlombard@redhat.com>
On Thu, Jul 29, 2021 at 03:52:50PM +0200, Maurizio Lombardi wrote:
> Starting with commit a799c2bd29d1
> ("x86/setup: Consolidate early memory reservations")
> memory reservations have been moved earlier during the boot process,
> before the execution of the Kernel Address Space Layout Randomization code.
>
> setup_arch() calls the iscsi_ibft's find_ibft_region() function
> to find and reserve the memory dedicated to the iBFT and this function
> also saves a virtual pointer to the iBFT table for later use.
>
> The problem is that if KALSR is active, the physical memory gets
> remapped somewhere else in the virtual address space and the pointer is
> no longer valid, this will cause a kernel panic when the iscsi driver tries
> to dereference it.
>
> [ 37.764225] iBFT detected.
> [ 37.778877] BUG: unable to handle page fault for address: ffff888000099fd8
> [ 37.816542] #PF: supervisor read access in kernel mode
> [ 37.844304] #PF: error_code(0x0000) - not-present page
> [ 37.872857] PGD 0 P4D 0
> [ 37.886985] Oops: 0000 [#1] SMP PTI
> [ 37.904809] CPU: 46 PID: 1073 Comm: modprobe Tainted: G X --------- --- 5.13.0-0.rc2.19.el9.x86_64 #1
> [ 37.956525] Hardware name: HP ProLiant DL580 G7, BIOS P65 10/01/2013
> [ 37.987170] RIP: 0010:ibft_init+0x3e/0xd42 [iscsi_ibft]
> [ 38.012976] Code: 04 25 28 00 00 00 48 89 44 24 08 31 c0 48 83 3d e1 cc 7e d7 00 74 28 48 c7 c7 21 81 1b c0 e8 b3 10 81 d5 48 8b 05 cc cc 7e d7 <0f> b6 70 08 48 63 50 04 40 80 fe 01 75 5e 31 f6 48 01 c2 eb 6e 83
> [ 38.106835] RSP: 0018:ffffb7d288fc3db0 EFLAGS: 00010246
> [ 38.131341] RAX: ffff888000099fd0 RBX: 0000000000000000 RCX: 0000000000000000
> [ 38.167110] RDX: 0000000000000000 RSI: ffff9ba7efb97c80 RDI: ffff9ba7efb97c80
> [ 38.200777] RBP: ffffffffc01c82be R08: 0000000000000000 R09: ffffb7d288fc3bf0
> [ 38.237188] R10: ffffb7d288fc3be8 R11: ffffffff96de70a8 R12: ffff9ba4059d6400
> [ 38.270940] R13: 000055689f1ac050 R14: 000055689df18962 R15: ffffb7d288fc3e78
> [ 38.307167] FS: 00007f9546720b80(0000) GS:ffff9ba7efb80000(0000) knlGS:0000000000000000
> [ 38.351204] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> [ 38.381034] CR2: ffff888000099fd8 CR3: 000000044175e004 CR4: 00000000000206e0
> [ 38.419938] Call Trace:
> [ 38.432679] ? ibft_create_kobject+0x1d2/0x1d2 [iscsi_ibft]
> [ 38.462584] do_one_initcall+0x44/0x1d0
> [ 38.480856] ? kmem_cache_alloc_trace+0x119/0x220
> [ 38.505554] do_init_module+0x5c/0x270
> [ 38.526578] __do_sys_init_module+0x12e/0x1b0
> [ 38.548699] do_syscall_64+0x40/0x80
> [ 38.565679] entry_SYSCALL_64_after_hwframe+0x44/0xae
>
> Fix this bug by saving the address of the physical location
> of the ibft; later the driver will use isa_bus_to_virt() to get
> the correct virtual address.
> Simplify the code by renaming find_ibft_region()
> to reserve_ibft_region() and remove all the wrappers.
>
> v2: fix a comment in linux/iscsi_ibft.h
> v3: fix the commit message
>
> Signed-off-by: Maurizio Lombardi <mlombard@redhat.com>
In addition to the x86 build failures, arm64:allmodconfig fails to build as
well.
Building arm64:allmodconfig ... failed
--------------
Error log:
drivers/firmware/iscsi_ibft.c: In function 'ibft_init':
drivers/firmware/iscsi_ibft.c:868:29: error: implicit declaration of function 'isa_bus_to_virt' [-Werror=implicit-function-declaration]
868 | ibft_addr = isa_bus_to_virt(ibft_phys_addr);
| ^~~~~~~~~~~~~~~
ISCSI_IBFT now depends on ISA thanks to this patch.
If that is intentional, it should be declared in Kconfig.
Guenter
prev parent reply other threads:[~2021-09-01 16:47 UTC|newest]
Thread overview: 10+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-07-29 13:52 [PATCH V3] iscsi_ibft: fix crash due to KASLR physical memory remapping Maurizio Lombardi
2021-07-29 17:03 ` Konrad Rzeszutek Wilk
2021-07-29 19:20 ` Maurizio Lombardi
2021-07-29 19:31 ` Mike Rapoport
2021-08-01 2:44 ` Konrad Rzeszutek Wilk
2021-08-10 17:00 ` Christoph Hellwig
2021-08-10 17:55 ` Konrad Rzeszutek Wilk
2021-08-11 6:57 ` Christoph Hellwig
2021-08-11 7:20 ` Mike Rapoport
2021-09-01 16:47 ` Guenter Roeck [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20210901164722.GA2100627@roeck-us.net \
--to=linux@roeck-us.net \
--cc=bp@alien8.de \
--cc=george.kennedy@oracle.com \
--cc=konrad@kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=mlombard@redhat.com \
--cc=pjones@redhat.com \
--cc=rafael@kernel.org \
--cc=rppt@kernel.org \
--cc=tglx@linutronix.de \
--cc=x86@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).