linux-kernel - Re: ce56a86e2a ("x86/mm: Limit mmap() of /dev/mem to valid physical addresses"): kernel BUG at arch/x86/mm/physaddr.c:79!

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Fri, 27 Oct 2017 10:25:36 +0200
From:   Ingo Molnar <mingo@...nel.org>
To:     Linus Torvalds <torvalds@...ux-foundation.org>
Cc:     Craig Bergstrom <craigb@...gle.com>,
        Sander Eikelenboom <linux@...elenboom.it>,
        Boris Ostrovsky <boris.ostrovsky@...cle.com>,
        Fengguang Wu <fengguang.wu@...el.com>, wfg@...ux.intel.com,
        Linux Kernel Mailing List <linux-kernel@...r.kernel.org>,
        LKP <lkp@...org>
Subject: Re: ce56a86e2a ("x86/mm: Limit mmap() of /dev/mem to valid physical
 addresses"): kernel BUG at arch/x86/mm/physaddr.c:79!


* Linus Torvalds <torvalds@...ux-foundation.org> wrote:

> On Thu, Oct 26, 2017 at 9:02 PM, Ingo Molnar <mingo@...nel.org> wrote:
> >
> > Well, 'mem=2048M' shouldn't really limit device memory, it's supposed to limit
> > (trim) 'RAM' and not much else.
> 
> Agreed. You should very much be able to map in IO memory or whatever
> above the 2G address even if the high_memory itself might be limited
> to 2GB.
> 
> So I think that commit ce56a86e2ade ("x86/mm: Limit mmap() of /dev/mem
> to valid physical addresses") is wrong, in that "high_memory" is very
> much the wrong thing to test.
> 
> The memory mapping limit might validly be something like
> 
>    1ull << boot_cpu_data.x86_phys_bits
> 
> or similar, but for now I suspect that the right thing to do is to
> revert. I'm not convinced that our "x86_phys_bits" value is guaranteed
> to be always right, since I think we mainlyjust use it for showing
> things, rather than have lots of code that depends on it.
> 
> Ingo?

Yeah, I think a more robust condition would be something like:

int valid_phys_addr_range(phys_addr_t addr, size_t count)
{
	return !((addr + count) >> MAX_PHYSMEM_BITS);
}

... as we already rely on MAX_PHYSMEM_BITS in a number of other critical places.

(Totally untested though.)

Thanks,

	Ingo