linux-kernel - Re: [tip:x86/urgent] x86/mm: Avoid VLA in pgd

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20181008202209.GA6597@zn.tnic>
Date:   Mon, 8 Oct 2018 22:22:09 +0200
From:   Borislav Petkov <bp@...en8.de>
To:     Arnd Bergmann <arnd@...db.de>
Cc:     linux-tip-commits@...r.kernel.org, luto@...nel.org,
        linux-kernel@...r.kernel.org, torvalds@...ux-foundation.org,
        akpm@...ux-foundation.org, tglx@...utronix.de,
        dave.hansen@...ux.intel.com, keescook@...omium.org,
        jroedel@...e.de, peterz@...radead.org, mingo@...nel.org,
        arnd@...db.de, toshi.kani@....com, hpa@...or.com
Subject: Re: [tip:x86/urgent] x86/mm: Avoid VLA in pgd_alloc()

On Fri, Oct 05, 2018 at 09:24:53AM -0700, tip-bot for Arnd Bergmann wrote:
> Commit-ID:  1be3f247c2882a82279cbcf43717581ea943b692
> Gitweb:     https://git.kernel.org/tip/1be3f247c2882a82279cbcf43717581ea943b692
> Author:     Arnd Bergmann <arnd@...db.de>
> AuthorDate: Fri, 5 Oct 2018 18:13:16 +0200
> Committer:  Ingo Molnar <mingo@...nel.org>
> CommitDate: Fri, 5 Oct 2018 18:16:55 +0200
> 
> x86/mm: Avoid VLA in pgd_alloc()
> 
> Turning on -Wvla found a new VLA usage:
> 
>   arch/x86/mm/pgtable.c: In function 'pgd_alloc':
>   include/linux/build_bug.h:29:45: error: ISO C90 forbids variable length array 'u_pmds' [-Werror=vla]
>   arch/x86/mm/pgtable.c:190:34: note: in expansion of macro 'static_cpu_has'
>    #define PREALLOCATED_USER_PMDS  (static_cpu_has(X86_FEATURE_PTI) ? \
>                                     ^~~~~~~~~~~~~~
>   arch/x86/mm/pgtable.c:431:16: note: in expansion of macro 'PREALLOCATED_USER_PMDS'
>     pmd_t *u_pmds[PREALLOCATED_USER_PMDS];
>                 ^~~~~~~~~~~~~~~~~~~~~~
> 
> Use the actual size of the array that is used for X86_FEATURE_PTI
> instead of the variable size.
> 
> Signed-off-by: Arnd Bergmann <arnd@...db.de>
> Cc: Andrew Morton <akpm@...ux-foundation.org>
> Cc: Andy Lutomirski <luto@...nel.org>
> Cc: Borislav Petkov <bp@...en8.de>
> Cc: Dave Hansen <dave.hansen@...ux.intel.com>
> Cc: Joerg Roedel <jroedel@...e.de>
> Cc: Kees Cook <keescook@...omium.org>
> Cc: Linus Torvalds <torvalds@...ux-foundation.org>
> Cc: Peter Zijlstra <peterz@...radead.org>
> Cc: Thomas Gleixner <tglx@...utronix.de>
> Cc: Toshi Kani <toshi.kani@....com>
> Fixes: 68664695ae57 ("Makefile: Globally enable VLA warning")
> Fixes: f59dbe9ca670 ("x86/pgtable/pae: Use separate kernel PMDs for user page-table")
> Link: http://lkml.kernel.org/r/20181005161333.765973-1-arnd@arndb.de
> Signed-off-by: Ingo Molnar <mingo@...nel.org>
> ---
>  arch/x86/mm/pgtable.c | 6 ++++--
>  1 file changed, 4 insertions(+), 2 deletions(-)
> 
> diff --git a/arch/x86/mm/pgtable.c b/arch/x86/mm/pgtable.c
> index 089e78c4effd..386b43e3e0ac 100644
> --- a/arch/x86/mm/pgtable.c
> +++ b/arch/x86/mm/pgtable.c
> @@ -189,6 +189,7 @@ static void pgd_dtor(pgd_t *pgd)
>   */
>  #define PREALLOCATED_USER_PMDS	 (static_cpu_has(X86_FEATURE_PTI) ? \
>  					KERNEL_PGD_PTRS : 0)
> +#define MAX_PREALLOCATED_USER_PMDS KERNEL_PGD_PTRS
>  
>  void pud_populate(struct mm_struct *mm, pud_t *pudp, pmd_t *pmd)
>  {
> @@ -211,6 +212,7 @@ void pud_populate(struct mm_struct *mm, pud_t *pudp, pmd_t *pmd)
>  /* No need to prepopulate any pagetable entries in non-PAE modes. */
>  #define PREALLOCATED_PMDS	0
>  #define PREALLOCATED_USER_PMDS	 0
> +#define MAX_PREALLOCATED_USER_PMDS 0
>  #endif	/* CONFIG_X86_PAE */
>  
>  static void free_pmds(struct mm_struct *mm, pmd_t *pmds[], int count)
> @@ -428,8 +430,8 @@ static inline void _pgd_free(pgd_t *pgd)
>  pgd_t *pgd_alloc(struct mm_struct *mm)
>  {
>  	pgd_t *pgd;
> -	pmd_t *u_pmds[PREALLOCATED_USER_PMDS];
> -	pmd_t *pmds[PREALLOCATED_PMDS];
> +	pmd_t *u_pmds[MAX_PREALLOCATED_USER_PMDS];
> +	pmd_t *pmds[MAX_PREALLOCATED_USER_PMDS];
>  
>  	pgd = _pgd_alloc();

For whatever reason - probably because it forced
MAX_PREALLOCATED_USER_PMDS be KERNEL_PGD_PTRS and not 0 (and I don't
have CONFIG_PAGE_TABLE_ISOLATION so it was 0 here with my .config
before) but this patch causes the fun below.

If I revert it, no splat.

Also, config has CONFIG_X86_PAE=y. And CONFIG_STACKPROTECTOR_STRONG=y. If I
disable _STRONG, it boots too. Attached.

[    1.749047] Kernel panic - not syncing: stack-protector: Kernel stack is corrupted in: pgd_alloc+0x29e/0x2a0
[    1.750306] CPU: 0 PID: 1 Comm: swapper/0 Tainted: G        W         4.19.0-rc6+ #5
[    1.751353] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.11.1-1 04/01/2014
[    1.752452] Call Trace:
[    1.752902]  dump_stack+0x66/0x95
[    1.753426]  panic+0x94/0x1dd
[    1.753922]  __stack_chk_fail+0x1e/0x20
[    1.754486]  ? pgd_alloc+0x29e/0x2a0
[    1.755028]  pgd_alloc+0x29e/0x2a0
[    1.755556]  mm_init.isra.60+0x1ec/0x210
[    1.756128]  mm_alloc+0x30/0x40
[    1.756635]  __do_execve_file+0x378/0x930
[    1.757215]  ? __do_execve_file+0x108/0x930
[    1.757820]  ? kmem_cache_alloc+0x123/0x220
[    1.758414]  do_execve+0x2c/0x30
[    1.758936]  run_init_process+0x31/0x36
[    1.759501]  ? rest_init+0xb0/0xb0
[    1.760029]  try_to_run_init_process+0x11/0x33
[    1.760644]  ? rest_init+0xb0/0xb0
[    1.761173]  kernel_init+0x9e/0xda
[    1.761705]  ret_from_fork+0x2e/0x38
[    1.762309] Kernel Offset: disabled
[    1.762858] ---[ end Kernel panic - not syncing: stack-protector: Kernel stack is corrupted in: pgd_alloc+0x29e/0x2a0 ]---

-- 
Regards/Gruss,
    Boris.

Good mailing practices for 400: avoid top-posting and trim the reply.

View attachment ".config" of type "text/plain" (103559 bytes)