linux-hardening - Re: [PATCH v2] arm64: mm: Fix CFI failure due to kpti_ng_pgd

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <c13af2e9-a0ac-4e1d-be8e-4612ae8d9c0f@redhat.com>
Date: Fri, 29 Aug 2025 21:13:04 +0200
From: David Hildenbrand <david@...hat.com>
To: Kees Cook <kees@...nel.org>, Kevin Brodsky <kevin.brodsky@....com>
Cc: Ard Biesheuvel <ardb@...nel.org>, Ryan Roberts <ryan.roberts@....com>,
 Mark Rutland <mark.rutland@....com>,
 Catalin Marinas <catalin.marinas@....com>, Will Deacon <will@...nel.org>,
 Anshuman Khandual <anshuman.khandual@....com>,
 Oliver Upton <oliver.upton@...ux.dev>, Yue Haibing <yuehaibing@...wei.com>,
 Marc Zyngier <maz@...nel.org>, Mark Brown <broonie@...nel.org>,
 Andrew Morton <akpm@...ux-foundation.org>,
 linux-arm-kernel@...ts.infradead.org, Joey Gouly <joey.gouly@....com>,
 Shameer Kolothum <shameerali.kolothum.thodi@...wei.com>,
 Yeoreum Yun <yeoreum.yun@....com>, James Morse <james.morse@....com>,
 Hardevsinh Palaniya <hardevsinh.palaniya@...iconsignals.io>,
 Zhenhua Huang <quic_zhenhuah@...cinc.com>,
 Lorenzo Stoakes <lorenzo.stoakes@...cle.com>, Dev Jain <dev.jain@....com>,
 Yicong Yang <yangyicong@...ilicon.com>, linux-kernel@...r.kernel.org,
 linux-hardening@...r.kernel.org
Subject: Re: [PATCH v2] arm64: mm: Fix CFI failure due to kpti_ng_pgd_alloc
 function signature

On 29.08.25 21:07, Kees Cook wrote:
> Seen during KPTI initialization:
> 
>    CFI failure at create_kpti_ng_temp_pgd+0x124/0xce8 (target: kpti_ng_pgd_alloc+0x0/0x14; expected type: 0xd61b88b6)
> 
> The call site is alloc_init_pud() at arch/arm64/mm/mmu.c:
> 
>    pud_phys = pgtable_alloc(TABLE_PUD);
> 
> alloc_init_pud() has the prototype:
> 
>    static void alloc_init_pud(p4d_t *p4dp, unsigned long addr, unsigned long end,
>                               phys_addr_t phys, pgprot_t prot,
>                               phys_addr_t (*pgtable_alloc)(enum pgtable_type),
>                               int flags)
> 
> where the pgtable_alloc() prototype is declared.
> 
> The target (kpti_ng_pgd_alloc) is used in arch/arm64/kernel/cpufeature.c:
> 
>    create_kpti_ng_temp_pgd(kpti_ng_temp_pgd, __pa(alloc), KPTI_NG_TEMP_VA,
>                            PAGE_SIZE, PAGE_KERNEL, kpti_ng_pgd_alloc, 0);
> 
> which is an alias for __create_pgd_mapping_locked() with prototype:
> 
>    extern __alias(__create_pgd_mapping_locked)
>    void create_kpti_ng_temp_pgd(pgd_t *pgdir, phys_addr_t phys,
>                                 unsigned long virt,
>                                 phys_addr_t size, pgprot_t prot,
>                                 phys_addr_t (*pgtable_alloc)(enum pgtable_type),
>                                 int flags);
> 
> __create_pgd_mapping_locked() passes the function pointer down:
> 
>    __create_pgd_mapping_locked() -> alloc_init_p4d() -> alloc_init_pud()
> 
> But the target function (kpti_ng_pgd_alloc) has the wrong signature:
> 
>    static phys_addr_t __init kpti_ng_pgd_alloc(int shift);
> 
> The "int" should be "enum pgtable_type".
> 
> To make "enum pgtable_type" available to cpufeature.c, move
> enum pgtable_type definition from arch/arm64/mm/mmu.c to
> arch/arm64/include/asm/mmu.h.
> 
> Adjust kpti_ng_pgd_alloc to use "enum pgtable_type" instead of "int".
> The function behavior remains identical (parameter is unused).
> 
> Fixes: c64f46ee1377 ("arm64: mm: use enum to identify pgtable level instead of *_SHIFT")
> Signed-off-by: Kees Cook <kees@...nel.org>
> ---
>   v2: Fixed the Fixes line. ;)
>   v1: https://lore.kernel.org/lkml/20250829154913.work.943-kees@kernel.org/
> Cc: Kevin Brodsky <kevin.brodsky@....com>
> Cc: Ard Biesheuvel <ardb@...nel.org>
> Cc: Ryan Roberts <ryan.roberts@....com>
> Cc: Mark Rutland <mark.rutland@....com>
> Cc: Catalin Marinas <catalin.marinas@....com>
> Cc: Will Deacon <will@...nel.org>
> Cc: Anshuman Khandual <anshuman.khandual@....com>
> Cc: Oliver Upton <oliver.upton@...ux.dev>
> Cc: Yue Haibing <yuehaibing@...wei.com>
> Cc: Marc Zyngier <maz@...nel.org>
> Cc: Mark Brown <broonie@...nel.org>
> Cc: Andrew Morton <akpm@...ux-foundation.org>
> Cc: <linux-arm-kernel@...ts.infradead.org>
> ---
>   arch/arm64/include/asm/mmu.h   | 7 +++++++
>   arch/arm64/kernel/cpufeature.c | 5 +++--
>   arch/arm64/mm/mmu.c            | 7 -------
>   3 files changed, 10 insertions(+), 9 deletions(-)
> 
> diff --git a/arch/arm64/include/asm/mmu.h b/arch/arm64/include/asm/mmu.h
> index 6e8aa8e72601..49f1a810df16 100644
> --- a/arch/arm64/include/asm/mmu.h
> +++ b/arch/arm64/include/asm/mmu.h
> @@ -17,6 +17,13 @@
>   #include <linux/refcount.h>
>   #include <asm/cpufeature.h>
>   
> +enum pgtable_type {
> +	TABLE_PTE,
> +	TABLE_PMD,
> +	TABLE_PUD,
> +	TABLE_P4D,
> +};

Just noting that we now have "enum pgtable_level" in 
include/linux/pgtable.h that could at some point possibly be used here 
instead (not in this fix).

-- 
Cheers

David / dhildenb