linux-kernel - [tip:efi/core] x86/mm/pat: Fix boot crash when 1GB pages are not supported by the CPU

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:	Wed, 16 Mar 2016 01:03:37 -0700
From:	tip-bot for Matt Fleming <tipbot@...or.com>
To:	linux-tip-commits@...r.kernel.org
Cc:	hertzog@...ian.org, scott.ashcroft@...k21.com, bp@...en8.de,
	maarten.lankhorst@...ux.intel.com, ard.biesheuvel@...aro.org,
	ben@...adent.org.uk, rogershimizu@...il.com,
	matt@...eblueprint.co.uk, dvlasenk@...hat.com, brgerst@...il.com,
	bp@...e.de, peterz@...radead.org, luto@...capital.net,
	hpa@...or.com, torvalds@...ux-foundation.org, mingo@...nel.org,
	tglx@...utronix.de, mjg59@...f.ucam.org,
	linux-kernel@...r.kernel.org
Subject: [tip:efi/core] x86/mm/pat: Fix boot crash when 1GB pages are not
 supported by the CPU

Commit-ID:  d367cef0a7f0c6ee86e997c0cb455b21b3c6b9ba
Gitweb:     http://git.kernel.org/tip/d367cef0a7f0c6ee86e997c0cb455b21b3c6b9ba
Author:     Matt Fleming <matt@...eblueprint.co.uk>
AuthorDate: Mon, 14 Mar 2016 10:33:01 +0000
Committer:  Ingo Molnar <mingo@...nel.org>
CommitDate: Wed, 16 Mar 2016 09:00:49 +0100

x86/mm/pat: Fix boot crash when 1GB pages are not supported by the CPU

Scott reports that with the new separate EFI page tables he's seeing
the following error on boot, caused by setting reserved bits in the
page table structures (fault code is PF_RSVD | PF_PROT),

  swapper/0: Corrupted page table at address 17b102020
  PGD 17b0e5063 PUD 1400000e3
  Bad pagetable: 0009 [#1] SMP

On first inspection the PUD is using a 1GB page size (_PAGE_PSE) and
looks fine but that's only true if support for 1GB PUD pages
("pdpe1gb") is present in the CPU.

Scott's Intel Celeron N2820 does not have that feature and so the
_PAGE_PSE bit is reserved. Fix this issue by making the 1GB mapping
code in conditional on "cpu_has_gbpages".

This issue didn't come up in the past because the required mapping for
the faulting address (0x17b102020) will already have been setup by the
kernel in early boot before we got to efi_map_regions(), but we no
longer use the standard kernel page tables during EFI calls.

Reported-by: Scott Ashcroft <scott.ashcroft@...k21.com>
Tested-by: Scott Ashcroft <scott.ashcroft@...k21.com>
Signed-off-by: Matt Fleming <matt@...eblueprint.co.uk>
Acked-by: Borislav Petkov <bp@...e.de>
Cc: Andy Lutomirski <luto@...capital.net>
Cc: Ard Biesheuvel <ard.biesheuvel@...aro.org>
Cc: Ben Hutchings <ben@...adent.org.uk>
Cc: Borislav Petkov <bp@...en8.de>
Cc: Brian Gerst <brgerst@...il.com>
Cc: Denys Vlasenko <dvlasenk@...hat.com>
Cc: H. Peter Anvin <hpa@...or.com>
Cc: Linus Torvalds <torvalds@...ux-foundation.org>
Cc: Maarten Lankhorst <maarten.lankhorst@...ux.intel.com>
Cc: Matthew Garrett <mjg59@...f.ucam.org>
Cc: Peter Zijlstra <peterz@...radead.org>
Cc: Raphael Hertzog <hertzog@...ian.org>
Cc: Roger Shimizu <rogershimizu@...il.com>
Cc: Thomas Gleixner <tglx@...utronix.de>
Cc: linux-efi@...r.kernel.org
Link: http://lkml.kernel.org/r/1457951581-27353-2-git-send-email-matt@codeblueprint.co.uk
Signed-off-by: Ingo Molnar <mingo@...nel.org>
---
 arch/x86/mm/pageattr.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/x86/mm/pageattr.c b/arch/x86/mm/pageattr.c
index 14c38ae..fcf8e29 100644
--- a/arch/x86/mm/pageattr.c
+++ b/arch/x86/mm/pageattr.c
@@ -1055,7 +1055,7 @@ static int populate_pud(struct cpa_data *cpa, unsigned long start, pgd_t *pgd,
 	/*
 	 * Map everything starting from the Gb boundary, possibly with 1G pages
 	 */
-	while (end - start >= PUD_SIZE) {
+	while (cpu_has_gbpages && end - start >= PUD_SIZE) {
 		set_pud(pud, __pud(cpa->pfn << PAGE_SHIFT | _PAGE_PSE |
 				   massage_pgprot(pud_pgprot)));