linux-kernel - Re: [PATCH 1/2] x86/mm: Fix guard hole handling

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <76b8ca15-405a-055f-41b3-532b116c3a8b@suse.com>
Date:   Fri, 30 Nov 2018 13:03:33 +0100
From:   Juergen Gross <jgross@...e.com>
To:     "Kirill A. Shutemov" <kirill.shutemov@...ux.intel.com>,
        tglx@...utronix.de, mingo@...hat.com, bp@...en8.de, hpa@...or.com,
        dave.hansen@...ux.intel.com, luto@...nel.org, peterz@...radead.org
Cc:     boris.ostrovsky@...cle.com, bhe@...hat.com, x86@...nel.org,
        linux-mm@...ck.org, linux-kernel@...r.kernel.org
Subject: Re: [PATCH 1/2] x86/mm: Fix guard hole handling

On 30/11/2018 12:57, Kirill A. Shutemov wrote:
> There is a guard hole at the beginning of kernel address space, also
> used by hypervisors. It occupies 16 PGD entries.
> 
> We do not state the reserved range directly, but calculate it relative
> to other entities: direct mapping and user space ranges.
> 
> The calculation got broken by recent change in kernel memory layout: LDT
> remap range is now mapped before direct mapping and makes the calculation
> invalid.
> 
> The breakage leads to crash on Xen dom0 boot[1].
> 
> State the reserved range directly. It's part of kernel ABI (hypervisors
> expect it to be stable) and must not depend on changes in the rest of
> kernel memory layout.
> 
> [1] https://lists.xenproject.org/archives/html/xen-devel/2018-11/msg03313.html
> 
> Signed-off-by: Kirill A. Shutemov <kirill.shutemov@...ux.intel.com>
> Reported-by: Hans van Kranenburg <Hans.van.Kranenburg@...dix.com>
> Fixes: d52888aa2753 ("x86/mm: Move LDT remap out of KASLR region on 5-level paging")
> ---
>  arch/x86/include/asm/pgtable_64_types.h |  5 +++++
>  arch/x86/mm/dump_pagetables.c           |  8 ++++----
>  arch/x86/xen/mmu_pv.c                   | 11 ++++++-----
>  3 files changed, 15 insertions(+), 9 deletions(-)
> 
> diff --git a/arch/x86/include/asm/pgtable_64_types.h b/arch/x86/include/asm/pgtable_64_types.h
> index 84bd9bdc1987..13aef22cee18 100644
> --- a/arch/x86/include/asm/pgtable_64_types.h
> +++ b/arch/x86/include/asm/pgtable_64_types.h
> @@ -111,6 +111,11 @@ extern unsigned int ptrs_per_p4d;
>   */
>  #define MAXMEM			(1UL << MAX_PHYSMEM_BITS)
>  
> +#define GUARD_HOLE_PGD_ENTRY	-256UL
> +#define GUARD_HOLE_SIZE		(16UL << PGDIR_SHIFT)
> +#define GUARD_HOLE_BASE_ADDR	(LDT_PGD_ENTRY << PGDIR_SHIFT)

s/LDT_PGD_ENTRY/GUARD_HOLE_PGD_ENTRY/


Juergen