| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <41ab11ba9fa03940d129f478109d048b197d9a59.camel@intel.com>
Date: Thu, 13 Sep 2018 01:21:16 +0000
From: "Yang, Bin" <bin.yang@...el.com>
To: "keescook@...omium.org" <keescook@...omium.org>
CC: "ccross@...roid.com" <ccross@...roid.com>,
"Luck, Tony" <tony.luck@...el.com>,
"linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
"anton@...msg.org" <anton@...msg.org>
Subject: Re: [PATCH] pstore: fix incorrect persistent ram buffer mapping
On Wed, 2018-09-12 at 10:44 -0700, Kees Cook wrote:
> On Tue, Sep 11, 2018 at 8:36 PM, Bin Yang <bin.yang@...el.com> wrote:
> > persistent_ram_vmap() returns the page start vaddr.
> > persistent_ram_iomap() supports non-page-aligned mapping.
>
> Oh, yes, good catch. This should probably be explicitly mentioned in
> comments for these functions.
>
> > persistent_ram_buffer_map() always adds offset-in-page to the vaddr
> > returned from these two functions, which causes incorrect mapping of
> > non-page-aligned persistent ram buffer.
>
> How did you find this problem, and/or how was the problem manifesting?
By default, ftrace_size is 4096 and max_ftrace_cnt is nr_cpu_ids. The
zone_sz in ramoops_init_przs() is 4096/nr_cpu_ids which might not be
page aligned. If the offset-in-page > 2048, the vaddr will be in next
page. If the next page is not mapped, it will cause kernel panic.
I just wanted to enable this driver on my board and did not change the
default value of ftrace_size. It resulted kernel panic as below:
[ 0.074231] BUG: unable to handle kernel paging request at
ffffa19e0081b000
[ 0.074498] IP: persistent_ram_new+0x1f8/0x39f
[ 0.074651] PGD 272eb7067 P4D 272eb7067 PUD 272eb8067 PMD 2721da067
PTE 0
[ 0.074886] Oops: 0000 [#1] PREEMPT SMP NOPTI
[ 0.075000] Modules linked in:
[ 0.075000] CPU: 0 PID: 1 Comm: swapper/0 Tainted:
G U 4.14.67-94.pk414-sos #4
[ 0.075000] task: ffff96ae32f76040 task.stack: ffff96ae32f78000
[ 0.075000] RIP: 0010:persistent_ram_new+0x1f8/0x39f
[ 0.075000] RSP: 0000:ffff96ae32f7bc00 EFLAGS: 00010246
[ 0.075000] RAX: ffffa19e0081a800 RBX: 0000000000040e43 RCX:
ffffffffb38a7380
[ 0.075000] RDX: 0000000080000001 RSI: 0000000000000100 RDI:
00000000ffffffff
[ 0.075000] RBP: ffff96ae32f7bc40 R08: ffff96ae32e7b0b0 R09:
0000000000000000
[ 0.075000] R10: 0000000000000000 R11: ffff96ae321dd900 R12:
00000000000003f4
[ 0.075000] R13: ffff96ae321ddf00 R14: ffffa19e0081b000 R15:
0000000000000000
[ 0.075000] FS: 0000000000000000(0000) GS:ffff96ae3fc00000(0000)
knlGS:0000000000000000
[ 0.075000] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 0.075000] CR2: ffffa19e0081b000 CR3: 0000000038814000 CR4:
00000000003406f0
[ 0.075000] Call Trace:
[ 0.075000] ramoops_init_przs.part.10.constprop.15+0x105/0x260
[ 0.075000] ramoops_probe+0x232/0x3a0
[ 0.075000] platform_drv_probe+0x3e/0xa0
[ 0.075000] driver_probe_device+0x2cd/0x400
[ 0.075000] __driver_attach+0xe4/0x110
[ 0.075000] ? driver_probe_device+0x400/0x400
[ 0.075000] bus_for_each_dev+0x70/0xa0
[ 0.075000] driver_attach+0x1e/0x20
[ 0.075000] bus_add_driver+0x159/0x230
[ 0.075000] ? do_early_param+0x95/0x95
[ 0.075000] driver_register+0x70/0xc0
[ 0.075000] ? init_pstore_fs+0x4d/0x4d
[ 0.075000] __platform_driver_register+0x36/0x40
[ 0.075000] ramoops_init+0x12f/0x131
[ 0.075000] do_one_initcall+0x4d/0x12c
[ 0.075000] ? do_early_param+0x95/0x95
[ 0.075000] kernel_init_freeable+0x19b/0x222
[ 0.075000] ? rest_init+0xbb/0xbb
[ 0.075000] kernel_init+0xe/0xfc
[ 0.075000] ret_from_fork+0x3a/0x50
[ 0.075000] Code: 4c 89 f2 49 c7 45 60 00 00 00 00 49 8d 7d 58 e8 af
f6 ff ff 85 c0 89 c3 0f 8f 96 02 00 00 0f 85 ab 02 00 00 4d 8b 75 18 8b
5d cc <41> 8b 16 81 f3 44 42 47 43 39 d3 0f
[ 0.075000] RIP: persistent_ram_new+0x1f8/0x39f RSP:
ffff96ae32f7bc00
[ 0.075000] CR2: ffffa19e0081b000
[ 0.075000] ---[ end trace a92ad58b000ab3fe ]---
[ 0.075000] Kernel panic - not syncing: Fatal exception
[ 0.075000] reboot: panic mode set: p,w
[ 0.075000] Rebooting in 10 seconds..
>
> > Signed-off-by: Bin Yang <bin.yang@...el.com>
> > ---
> > fs/pstore/ram_core.c | 6 +++---
> > 1 file changed, 3 insertions(+), 3 deletions(-)
> >
> > diff --git a/fs/pstore/ram_core.c b/fs/pstore/ram_core.c
> > index 951a14e..7c05fdd 100644
> > --- a/fs/pstore/ram_core.c
> > +++ b/fs/pstore/ram_core.c
> > @@ -429,7 +429,7 @@ static void *persistent_ram_vmap(phys_addr_t start, size_t size,
> > vaddr = vmap(pages, page_count, VM_MAP, prot);
> > kfree(pages);
> >
> > - return vaddr;
> > + return vaddr + offset_in_page(start);
> > }
> >
> > static void *persistent_ram_iomap(phys_addr_t start, size_t size,
> > @@ -468,7 +468,7 @@ static int persistent_ram_buffer_map(phys_addr_t start, phys_addr_t size,
> > return -ENOMEM;
> > }
> >
> > - prz->buffer = prz->vaddr + offset_in_page(start);
> > + prz->buffer = prz->vaddr;
> > prz->buffer_size = size - sizeof(struct persistent_ram_buffer);
> >
> > return 0;
> > @@ -515,7 +515,7 @@ void persistent_ram_free(struct persistent_ram_zone *prz)
> >
> > if (prz->vaddr) {
> > if (pfn_valid(prz->paddr >> PAGE_SHIFT)) {
> > - vunmap(prz->vaddr);
> > + vunmap(prz->vaddr - offset_in_page(prz->paddr));
> > } else {
> > iounmap(prz->vaddr);
> > release_mem_region(prz->paddr, prz->size);
> > --
> > 2.7.4
> >
>
> Regardless, yes, this patch looks correct. Thanks! I'll add it to my tree.
thanks
>
> -Kees
>
Powered by blists - more mailing lists