linux-kernel - Re: [PATCH 1/2] x86/mm/pti: Check unaligned address for pmd clone in pti_clone

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <0766416e-bab5-c8e7-9466-a72e965fdb8a@intel.com>
Date:   Tue, 1 Dec 2020 09:43:09 -0800
From:   Dave Hansen <dave.hansen@...el.com>
To:     Lai Jiangshan <jiangshanlai@...il.com>,
        linux-kernel@...r.kernel.org
Cc:     Lai Jiangshan <laijs@...ux.alibaba.com>,
        Dave Hansen <dave.hansen@...ux.intel.com>,
        Andy Lutomirski <luto@...nel.org>,
        Peter Zijlstra <peterz@...radead.org>,
        Thomas Gleixner <tglx@...utronix.de>,
        Ingo Molnar <mingo@...hat.com>, Borislav Petkov <bp@...en8.de>,
        x86@...nel.org, "H. Peter Anvin" <hpa@...or.com>
Subject: Re: [PATCH 1/2] x86/mm/pti: Check unaligned address for pmd clone in
 pti_clone_pagetable()

On 11/30/20 7:25 AM, Lai Jiangshan wrote:
> The commit 825d0b73cd752("x86/mm/pti: Handle unaligned address gracefully
> in pti_clone_pagetable()") handles unaligned address well for unmapped
> PUD/PMD etc. But unaligned address for pmd_large() or PTI_CLONE_PMD is also
> needed to be aware.

That 825d0b73cd752 changelog says:

>     pti_clone_pmds() assumes that the supplied address is either:
>     
>      - properly PUD/PMD aligned
>     or
>      - the address is actually mapped which means that independently
>        of the mapping level (PUD/PMD/PTE) the next higher mapping
>        exists.

... and that was the root of the bug.  If there was a large, unmapped
area, it would skip a PUD_SIZE or PMD_SIZE *area* instead of skipping to
the *next* pud/pmd.

The case being patched here is from a *present* PTE/PMD, so it's a
mapped area, not a hole.

That said, I think the previous changelog was wrong.  An unaligned
address to a mapped, large (2M) region followed by a smaller (4k) region
would skip too far into the 4k region.

That said, I'm not sure I like this fix.  If someone is explicitly
asking to clone a PMD (which pti_clone_pgtable() forces you to do), they
better align the address.