linux-kernel - Re: [PATCH] pstore: fix incorrect persistent ram buffer mapping

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <CAGXu5jJigfeAgzoHRR-sny651kcB5fQEGF_X5n+Wi02EfwP9iA@mail.gmail.com>
Date:   Wed, 12 Sep 2018 21:25:05 -0700
From:   Kees Cook <keescook@...omium.org>
To:     "Yang, Bin" <bin.yang@...el.com>
Cc:     "ccross@...roid.com" <ccross@...roid.com>,
        "Luck, Tony" <tony.luck@...el.com>,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
        "anton@...msg.org" <anton@...msg.org>
Subject: Re: [PATCH] pstore: fix incorrect persistent ram buffer mapping

On Wed, Sep 12, 2018 at 6:21 PM, Yang, Bin <bin.yang@...el.com> wrote:
> On Wed, 2018-09-12 at 10:44 -0700, Kees Cook wrote:
>> On Tue, Sep 11, 2018 at 8:36 PM, Bin Yang <bin.yang@...el.com> wrote:
>> > persistent_ram_vmap() returns the page start vaddr.
>> > persistent_ram_iomap() supports non-page-aligned mapping.
>>
>> Oh, yes, good catch. This should probably be explicitly mentioned in
>> comments for these functions.
>>
>> > persistent_ram_buffer_map() always adds offset-in-page to the vaddr
>> > returned from these two functions, which causes incorrect mapping of
>> > non-page-aligned persistent ram buffer.
>>
>> How did you find this problem, and/or how was the problem manifesting?
>
> By default, ftrace_size is 4096 and max_ftrace_cnt is nr_cpu_ids. The
> zone_sz in ramoops_init_przs() is 4096/nr_cpu_ids which might not be
> page aligned. If the offset-in-page > 2048, the vaddr will be in next
> page. If the next page is not mapped, it will cause kernel panic.
>
> I just wanted to enable this driver on my board and did not change the
> default value of ftrace_size. It resulted kernel panic as below:
>
>
> [    0.074231] BUG: unable to handle kernel paging request at
> ffffa19e0081b000

Perfect, thanks! I've updated your commit log to include these details
now. Should be in linux-next shortly.

-Kees

-- 
Kees Cook
Pixel Security