linux-kernel - [PATCH -mm] fix buggy MTRR address checks

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:	Tue, 3 Oct 2006 14:55:53 +0200
From:	Andreas Mohr <andi@...x01.fht-esslingen.de>
To:	Andrew Morton <akpm@...l.org>
Cc:	rgooch@...f.csiro.au, Jan Beulich <jbeulich@...ell.com>,
	Kurt Garloff <garloff@...e.de>, linux-kernel@...r.kernel.org
Subject: [PATCH -mm] fix buggy MTRR address checks

Fix checks that failed to realize that values are 4-kB-unit-sized
(note the format strings in this same diff context which *do* realize the
unit size, via appended "000"!).
Also fix an incorrect below-1MB area check (as gathered from Jan Beulich's
unapplied patch at
http://www.ussg.iu.edu/hypermail/linux/kernel/0411.1/1378.html )
Update mtrr_add_page() docu to make 4-kB-sized calculation more obvious.



Given several further items mentioned in Jan's patch mail, all in all
MTRR code seems surprisingly buggy, for a surprisingly long period of time
(many years). Further work/investigation would be useful.

Note that my patch is pretty much UNTESTED, since I can only verify that
it successfully boots my machine, but I cannot test against actual buggy
hardware which would require these (formerly broken) checks.
Long -mm simmering would make sense, especially since these now-working
checks might turn out to have adverse effects on unaffected hardware.

Signed-off-by: Andreas Mohr <andi@...as.de>


diff -urN linux-2.6.18-mm3.orig/arch/i386/kernel/cpu/mtrr/generic.c linux-2.6.18-mm3/arch/i386/kernel/cpu/mtrr/generic.c
--- linux-2.6.18-mm3.orig/arch/i386/kernel/cpu/mtrr/generic.c	2006-10-11 11:59:45.000000000 +0200
+++ linux-2.6.18-mm3/arch/i386/kernel/cpu/mtrr/generic.c	2006-10-11 12:04:37.000000000 +0200
@@ -366,7 +366,7 @@
 			printk(KERN_WARNING "mtrr: base(0x%lx000) is not 4 MiB aligned\n", base);
 			return -EINVAL;
 		}
-		if (!(base + size < 0x70000000 || base > 0x7003FFFF) &&
+		if (!(base + size < 0x70000 || base > 0x7003F) &&
 		    (type == MTRR_TYPE_WRCOMB
 		     || type == MTRR_TYPE_WRBACK)) {
 			printk(KERN_WARNING "mtrr: writable mtrr between 0x70000000 and 0x7003FFFF may hang the CPU.\n");
@@ -374,7 +374,7 @@
 		}
 	}
 
-	if (base + size < 0x100) {
+	if (base < 0x100) {
 		printk(KERN_WARNING "mtrr: cannot set region below 1 MiB (0x%lx000,0x%lx000)\n",
 		       base, size);
 		return -EINVAL;
diff -urN linux-2.6.18-mm3.orig/arch/i386/kernel/cpu/mtrr/main.c linux-2.6.18-mm3/arch/i386/kernel/cpu/mtrr/main.c
--- linux-2.6.18-mm3.orig/arch/i386/kernel/cpu/mtrr/main.c	2006-08-18 20:03:00.000000000 +0200
+++ linux-2.6.18-mm3/arch/i386/kernel/cpu/mtrr/main.c	2006-10-11 12:04:37.000000000 +0200
@@ -263,8 +263,8 @@
 
 /**
  *	mtrr_add_page - Add a memory type region
- *	@base: Physical base address of region in pages (4 KB)
- *	@size: Physical size of region in pages (4 KB)
+ *	@base: Physical base address of region in pages (in units of 4 kB!)
+ *	@size: Physical size of region in pages (4 kB)
  *	@type: Type of MTRR desired
  *	@increment: If this is true do usage counting on the region
  *
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/