mm-commits.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
From: Andrew Morton <akpm@linux-foundation.org>
To: catalin.marinas@arm.com, david@redhat.com, decui@microsoft.com,
	hch@lst.de, jeyu@kernel.org, mm-commits@vger.kernel.org,
	peterz@infradead.org, vkuznets@redhat.com, wei.liu@kernel.org,
	will@kernel.org
Subject: [merged] x86-hyperv-allocate-the-hypercall-page-with-only-read-and-execute-bits.patch removed from -mm tree
Date: Fri, 26 Jun 2020 20:34:05 -0700	[thread overview]
Message-ID: <20200627033405.ip0ZZiNE9%akpm@linux-foundation.org> (raw)
In-Reply-To: <20200625202807.b630829d6fa55388148bee7d@linux-foundation.org>


The patch titled
     Subject: x86/hyperv: allocate the hypercall page with only read and execute bits
has been removed from the -mm tree.  Its filename was
     x86-hyperv-allocate-the-hypercall-page-with-only-read-and-execute-bits.patch

This patch was dropped because it was merged into mainline or a subsystem tree

------------------------------------------------------
From: Christoph Hellwig <hch@lst.de>
Subject: x86/hyperv: allocate the hypercall page with only read and execute bits

Patch series "fix a hyperv W^X violation and remove vmalloc_exec"

Dexuan reported a W^X violation due to the fact that the hyper hypercall
page due switching it to be allocated using vmalloc_exec.  The problem is
that PAGE_KERNEL_EXEC as used by vmalloc_exec actually sets writable
permissions in the pte.  This series fixes the issue by switching to the
low-level __vmalloc_node_range interface that allows specifing more
detailed permissions instead.  It then also open codes the other two
callers and removes the somewhat confusing vmalloc_exec interface.

Peter noted that the hyper hypercall page allocation also has another long
standing issue in that it shouldn't use the full vmalloc but just the
module space.  This issue is so far theoretical as the allocation is done
early in the boot process.  I plan to fix it with another bigger series
for 5.9.


This patch (of 3):

Avoid a W^X violation cause by the fact that PAGE_KERNEL_EXEC includes the
writable bit.

For this resurrect the removed PAGE_KERNEL_RX definitіon, but as
PAGE_KERNEL_ROX to match arm64 and powerpc.

Link: http://lkml.kernel.org/r/20200618064307.32739-2-hch@lst.de
Fixes: 78bb17f76edc ("x86/hyperv: use vmalloc_exec for the hypercall page")
Signed-off-by: Christoph Hellwig <hch@lst.de>
Reported-by: Dexuan Cui <decui@microsoft.com>
Tested-by: Vitaly Kuznetsov <vkuznets@redhat.com>
Acked-by: Wei Liu <wei.liu@kernel.org>
Acked-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Cc: Catalin Marinas <catalin.marinas@arm.com>
Cc: Will Deacon <will@kernel.org>
Cc: Jessica Yu <jeyu@kernel.org>
Cc: David Hildenbrand <david@redhat.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
---

 arch/x86/hyperv/hv_init.c            |    4 +++-
 arch/x86/include/asm/pgtable_types.h |    2 ++
 2 files changed, 5 insertions(+), 1 deletion(-)

--- a/arch/x86/hyperv/hv_init.c~x86-hyperv-allocate-the-hypercall-page-with-only-read-and-execute-bits
+++ a/arch/x86/hyperv/hv_init.c
@@ -375,7 +375,9 @@ void __init hyperv_init(void)
 	guest_id = generate_guest_id(0, LINUX_VERSION_CODE, 0);
 	wrmsrl(HV_X64_MSR_GUEST_OS_ID, guest_id);
 
-	hv_hypercall_pg = vmalloc_exec(PAGE_SIZE);
+	hv_hypercall_pg = __vmalloc_node_range(PAGE_SIZE, 1, VMALLOC_START,
+			VMALLOC_END, GFP_KERNEL, PAGE_KERNEL_ROX,
+			VM_FLUSH_RESET_PERMS, NUMA_NO_NODE, __func__);
 	if (hv_hypercall_pg == NULL) {
 		wrmsrl(HV_X64_MSR_GUEST_OS_ID, 0);
 		goto remove_cpuhp_state;
--- a/arch/x86/include/asm/pgtable_types.h~x86-hyperv-allocate-the-hypercall-page-with-only-read-and-execute-bits
+++ a/arch/x86/include/asm/pgtable_types.h
@@ -194,6 +194,7 @@ enum page_cache_mode {
 #define _PAGE_TABLE_NOENC	 (__PP|__RW|_USR|___A|   0|___D|   0|   0)
 #define _PAGE_TABLE		 (__PP|__RW|_USR|___A|   0|___D|   0|   0| _ENC)
 #define __PAGE_KERNEL_RO	 (__PP|   0|   0|___A|__NX|___D|   0|___G)
+#define __PAGE_KERNEL_ROX	 (__PP|   0|   0|___A|   0|___D|   0|___G)
 #define __PAGE_KERNEL_NOCACHE	 (__PP|__RW|   0|___A|__NX|___D|   0|___G| __NC)
 #define __PAGE_KERNEL_VVAR	 (__PP|   0|_USR|___A|__NX|___D|   0|___G)
 #define __PAGE_KERNEL_LARGE	 (__PP|__RW|   0|___A|__NX|___D|_PSE|___G)
@@ -219,6 +220,7 @@ enum page_cache_mode {
 #define PAGE_KERNEL_RO		__pgprot_mask(__PAGE_KERNEL_RO         | _ENC)
 #define PAGE_KERNEL_EXEC	__pgprot_mask(__PAGE_KERNEL_EXEC       | _ENC)
 #define PAGE_KERNEL_EXEC_NOENC	__pgprot_mask(__PAGE_KERNEL_EXEC       |    0)
+#define PAGE_KERNEL_ROX		__pgprot_mask(__PAGE_KERNEL_ROX        | _ENC)
 #define PAGE_KERNEL_NOCACHE	__pgprot_mask(__PAGE_KERNEL_NOCACHE    | _ENC)
 #define PAGE_KERNEL_LARGE	__pgprot_mask(__PAGE_KERNEL_LARGE      | _ENC)
 #define PAGE_KERNEL_LARGE_EXEC	__pgprot_mask(__PAGE_KERNEL_LARGE_EXEC | _ENC)
_

Patches currently in -mm which might be from hch@lst.de are

  parent reply	other threads:[~2020-06-27  3:34 UTC|newest]

Thread overview: 66+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2020-06-26  3:28 incoming Andrew Morton
2020-06-26  3:29 ` [patch 01/32] openrisc: fix boot oops when DEBUG_VM is enabled Andrew Morton
2020-06-26  3:29 ` [patch 02/32] mm: do_swap_page(): fix up the error code Andrew Morton
2020-06-26  3:29 ` [patch 03/32] mm, compaction: make capture control handling safe wrt interrupts Andrew Morton
2020-06-26  3:29 ` [patch 04/32] kexec: do not verify the signature without the lockdown or mandatory signature Andrew Morton
2020-06-26  3:29 ` [patch 05/32] ocfs2: avoid inode removal while nfsd is accessing it Andrew Morton
2020-06-26  3:29 ` [patch 06/32] ocfs2: load global_inode_alloc Andrew Morton
2020-06-26  3:29 ` [patch 07/32] ocfs2: fix panic on nfs server over ocfs2 Andrew Morton
2020-06-26  3:29 ` [patch 08/32] ocfs2: fix value of OCFS2_INVALID_SLOT Andrew Morton
2020-06-26  3:29 ` [patch 09/32] lib: fix test_hmm.c reference after free Andrew Morton
2020-06-26  3:29 ` [patch 10/32] linux/bits.h: fix unsigned less than zero warnings Andrew Morton
2020-06-26  3:29 ` [patch 11/32] mm, slab: fix sign conversion problem in memcg_uncharge_slab() Andrew Morton
2020-06-26  3:29 ` [patch 12/32] mm/slab: use memzero_explicit() in kzfree() Andrew Morton
2020-06-26  3:29 ` [patch 13/32] slub: cure list_slab_objects() from double fix Andrew Morton
2020-06-26  3:29 ` [patch 14/32] mm: fix swap cache node allocation mask Andrew Morton
2020-06-26  3:30 ` [patch 15/32] mm/memory.c: properly pte_offset_map_lock/unlock in vm_insert_pages() Andrew Morton
2020-06-26  3:30 ` [patch 16/32] mm/debug_vm_pgtable: fix build failure with powerpc 8xx Andrew Morton
2020-06-26  3:30 ` [patch 17/32] make asm-generic/cacheflush.h more standalone Andrew Morton
2020-06-26  3:30 ` [patch 18/32] media: omap3isp: remove cacheflush.h Andrew Morton
2020-06-26  3:30 ` [patch 19/32] mm/vmalloc.c: fix a warning while make xmldocs Andrew Morton
2020-06-26  3:30 ` [patch 20/32] mm: memcontrol: handle div0 crash race condition in memory.low Andrew Morton
2020-06-26  3:30 ` [patch 21/32] mm/memcontrol.c: add missed css_put() Andrew Morton
2020-06-26  3:30 ` [patch 22/32] mm/memcontrol.c: prevent missed memory.low load tears Andrew Morton
2020-06-26  3:30 ` [patch 23/32] docs: mm/gup: minor documentation update Andrew Morton
2020-06-26  3:30 ` [patch 24/32] doc: THP CoW fault no longer allocate THP Andrew Morton
2020-06-26  3:30 ` [patch 25/32] mm: workingset: age nonresident information alongside anonymous pages Andrew Morton
2020-06-26  3:30 ` [patch 26/32] mm/swap: fix for "mm: workingset: age nonresident information alongside anonymous pages" Andrew Morton
2020-06-26  3:30 ` [patch 27/32] mm/memory: fix IO cost for anonymous page Andrew Morton
2020-06-26  3:30 ` [patch 28/32] x86/hyperv: allocate the hypercall page with only read and execute bits Andrew Morton
2020-06-26  3:30 ` [patch 29/32] arm64: use PAGE_KERNEL_ROX directly in alloc_insn_page Andrew Morton
2020-06-26  3:30 ` [patch 30/32] mm: remove vmalloc_exec Andrew Morton
2020-06-26  3:30 ` [patch 31/32] mm/memory_hotplug.c: fix false softlockup during pfn range removal Andrew Morton
2020-06-26  3:30 ` [patch 32/32] MAINTAINERS: update info for sparse Andrew Morton
2020-06-27  3:32 ` + linux-next-git-rejects.patch added to -mm tree Andrew Morton
2020-06-27  3:32 ` [merged] dma-remap-align-the-size-in-dma_common__remap.patch removed from " Andrew Morton
2020-06-27  3:32 ` [merged] openrisc-fix-boot-oops-when-debug_vm-is-enabled.patch " Andrew Morton
2020-06-27  3:33 ` [merged] mm-do_swap_page-fix-up-the-error-code-instantiation.patch " Andrew Morton
2020-06-27  3:33 ` [merged] mm-compaction-make-capture-control-handling-safe-wrt-interrupts.patch " Andrew Morton
2020-06-27  3:33 ` [merged] kexec-do-not-verify-the-signature-without-the-lockdown-or-mandatory-signature.patch " Andrew Morton
2020-06-27  3:33 ` [merged] ocfs2-avoid-inode-removed-while-nfsd-access-it.patch " Andrew Morton
2020-06-27  3:33 ` [merged] ocfs2-load-global_inode_alloc.patch " Andrew Morton
2020-06-27  3:33 ` [merged] ocfs2-fix-panic-on-nfs-server-over-ocfs2.patch " Andrew Morton
2020-06-27  3:33 ` [merged] ocfs2-fix-value-of-ocfs2_invalid_slot.patch " Andrew Morton
2020-06-27  3:33 ` [merged] lib-fix-test_hmmc-reference-after-free.patch " Andrew Morton
2020-06-27  3:33 ` [merged] mm-slab-fix-sign-conversion-problem-in-memcg_uncharge_slab.patch " Andrew Morton
2020-06-27  3:33 ` [merged] mm-slab-use-memzero_explicit-in-kzfree.patch " Andrew Morton
2020-06-27  3:33 ` [merged] slub-cure-list_slab_objects-from-double-fix.patch " Andrew Morton
2020-06-27  3:33 ` [merged] mm-fix-swap-cache-node-allocation-mask.patch " Andrew Morton
2020-06-27  3:33 ` [merged] mm-memoryc-properly-pte_offset_map_lock-unlock-in-vm_insert_pages.patch " Andrew Morton
2020-06-27  3:33 ` [merged] mm-debug_vm_pgtable-fix-build-failure-with-powerpc-8xx.patch " Andrew Morton
2020-06-27  3:33 ` [merged] make-asm-generic-cacheflushh-more-standalone.patch " Andrew Morton
2020-06-27  3:33 ` [merged] media-omap3isp-remove-cacheflushh.patch " Andrew Morton
2020-06-27  3:33 ` [merged] mm-fix-a-warning-while-make-xmldocs.patch " Andrew Morton
2020-06-27  3:33 ` [merged] mm-memcontrol-handle-div0-crash-race-condition-in-memorylow.patch " Andrew Morton
2020-06-27  3:33 ` [merged] mm-memcontrol-fix-do-not-put-the-css-reference.patch " Andrew Morton
2020-06-27  3:33 ` [merged] mm-memcg-prevent-missed-memorylow-load-tears.patch " Andrew Morton
2020-06-27  3:33 ` [merged] docs-mm-gup-minor-documentation-update.patch " Andrew Morton
2020-06-27  3:33 ` [merged] doc-thp-cow-fault-no-longer-allocate-thp.patch " Andrew Morton
2020-06-27  3:33 ` [merged] mm-workingset-age-nonresident-information-alongside-anonymous-pages.patch " Andrew Morton
2020-06-27  3:34 ` [merged] mm-swap-fix-for-mm-workingset-age-nonresident-information-alongside-anonymous-pages.patch " Andrew Morton
2020-06-27  3:34 ` [merged] mm-memory-fix-io-cost-for-anonymous-page.patch " Andrew Morton
2020-06-27  3:34 ` Andrew Morton [this message]
2020-06-27  3:34 ` [merged] arm64-use-page_kernel_rox-directly-in-alloc_insn_page.patch " Andrew Morton
2020-06-27  3:34 ` [merged] mm-remove-vmalloc_exec.patch " Andrew Morton
2020-06-27  3:34 ` [merged] mm-fix-false-softlockup-during-pfn-range-removal.patch " Andrew Morton
2020-06-27  3:34 ` [merged] maintainers-update-info-for-sparse.patch " Andrew Morton

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20200627033405.ip0ZZiNE9%akpm@linux-foundation.org \
    --to=akpm@linux-foundation.org \
    --cc=catalin.marinas@arm.com \
    --cc=david@redhat.com \
    --cc=decui@microsoft.com \
    --cc=hch@lst.de \
    --cc=jeyu@kernel.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=mm-commits@vger.kernel.org \
    --cc=peterz@infradead.org \
    --cc=vkuznets@redhat.com \
    --cc=wei.liu@kernel.org \
    --cc=will@kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).