linux-kernel - [PATCH] x86/mm/pat: Fix BUG_ON in mmap

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:	Fri,  1 Apr 2016 16:19:45 -0600
From:	Toshi Kani <toshi.kani@....com>
To:	mingo@...nel.org, bp@...e.de, hpa@...or.com, tglx@...utronix.de
Cc:	ying.huang@...ux.intel.com, x86@...nel.org,
	linux-kernel@...r.kernel.org, Toshi Kani <toshi.kani@....com>
Subject: [PATCH] x86/mm/pat: Fix BUG_ON in mmap_mem on QEMU/i386

The following BUG_ON error was reported on QEMU/i386:

  kernel BUG at arch/x86/mm/physaddr.c:79!
  Call Trace:
  phys_mem_access_prot_allowed
  mmap_mem
  ? mmap_region
  mmap_region
  do_mmap
  vm_mmap_pgoff
  SyS_mmap_pgoff
  do_int80_syscall_32
  entry_INT80_32

after commit edfe63ec97ed ("x86/mtrr: Fix Xorg crashes in Qemu
sessions").

PAT is now set to disabled state when MTRRs are disabled.  This
led the __pa(high_memory) check in phys_mem_access_prot_allowed()
to resurrect on x86/32.

When the system does not have much memory, 'high_memory' points to
the maximum memory address + 1, which is empty.  When
CONFIG_DEBUG_VIRTUAL is also set, __pa() calls __phys_addr(), which
in turn calls slow_virt_to_phys() for high_memory.  Because
high_memory does not point to a valid memory address, this address
is not mapped.  Hence, BUG_ON.

Use __pa_nodebug() as the code does not expect a valid virtual
mapping for high_memory.

Reported-by: kernel test robot <ying.huang@...ux.intel.com>
Link: https://lkml.org/lkml/2016/4/1/608
Signed-off-by: Toshi Kani <toshi.kani@....com>
Thomas Gleixner <tglx@...utronix.de>
Ingo Molnar <mingo@...nel.org>
H. Peter Anvin <hpa@...or.com>
Borislav Petkov <bp@...e.de>
---
This patch is based on -tip.
---
 arch/x86/mm/pat.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/x86/mm/pat.c b/arch/x86/mm/pat.c
index c4c3ddc..26b7202 100644
--- a/arch/x86/mm/pat.c
+++ b/arch/x86/mm/pat.c
@@ -792,7 +792,7 @@ int phys_mem_access_prot_allowed(struct file *file, unsigned long pfn,
 	      boot_cpu_has(X86_FEATURE_K6_MTRR) ||
 	      boot_cpu_has(X86_FEATURE_CYRIX_ARR) ||
 	      boot_cpu_has(X86_FEATURE_CENTAUR_MCR)) &&
-	    (pfn << PAGE_SHIFT) >= __pa(high_memory)) {
+	    (pfn << PAGE_SHIFT) >= __pa_nodebug(high_memory)) {
 		pcm = _PAGE_CACHE_MODE_UC;
 	}
 #endif