linux-kernel - Re: BUG() at boot in __phys_addr with DEBUG

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Wed, 12 Nov 2014 07:20:53 -0800
From:	Dave Hansen <dave.hansen@...el.com>
To:	Borislav Petkov <bp@...e.de>
CC:	Matt Fleming <matt.fleming@...el.com>,
	the arch/x86 maintainers <x86@...nel.org>,
	LKML <linux-kernel@...r.kernel.org>
Subject: Re: BUG() at boot in __phys_addr with DEBUG_VIRTUAL

On 11/12/2014 07:11 AM, Borislav Petkov wrote:
>> > [    1.161406] __phys_addr() x: 0x000078009d3c6000
>> > [    1.166567] __phys_addr() origx: 0x000000009d3c6000
>> > [    1.171832] __phys_addr() y: 0x000000011d3c6000
>> > [    1.176999] __phys_addr() __START_KERNEL_map: 0xffffffff80000000
>> > [    1.183841] __phys_addr() PAGE_OFFSET: 0xffff880000000000
>> > [    1.189993] __phys_addr() x valid: 0
>> > 
>> > So it looks like the root cause is a physical address getting pass in in
>> > the first place instead of a virtual.
> I'd say that's on purpose as we're mapping kernel text 1:1 in the EFI
> page table.

__pa and friends do their calculations *against* PAGE_OFFSET to do the
virt<->phys translation.  If that's not what a caller wants, then
they're calling the wrong function.

The path that we're actually hitting this from is:

> __split_large_page(struct cpa_data *cpa, pte_t *kpte, unsigned long
...
>         if (pfn_range_is_mapped(PFN_DOWN(__pa(address)),
>                                 PFN_DOWN(__pa(address)) + 1))
>                 split_page_count(level);

So perhaps efi_map_region() is handing an address from the EFI identity
map down in here.  __pa() gets called on it, but that fails since __pa()
only works on the *KERNEL* identity map.

I think we might actually need to walk the page tables in there.  Even
the pfn_range_is_mapped() code looks to be dealing with the kernel
identity map.
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/