linux-kernel - Re: [PATCH 1/2] x86/mm/pti: Check unaligned address for pmd clone in pti_clone

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Wed, 2 Dec 2020 16:55:29 +0800
From:   Lai Jiangshan <jiangshanlai@...il.com>
To:     Dave Hansen <dave.hansen@...el.com>
Cc:     LKML <linux-kernel@...r.kernel.org>,
        Lai Jiangshan <laijs@...ux.alibaba.com>,
        Dave Hansen <dave.hansen@...ux.intel.com>,
        Andy Lutomirski <luto@...nel.org>,
        Peter Zijlstra <peterz@...radead.org>,
        Thomas Gleixner <tglx@...utronix.de>,
        Ingo Molnar <mingo@...hat.com>, Borislav Petkov <bp@...en8.de>,
        X86 ML <x86@...nel.org>, "H. Peter Anvin" <hpa@...or.com>
Subject: Re: [PATCH 1/2] x86/mm/pti: Check unaligned address for pmd clone in pti_clone_pagetable()

On Wed, Dec 2, 2020 at 1:43 AM Dave Hansen <dave.hansen@...el.com> wrote:
>
> On 11/30/20 7:25 AM, Lai Jiangshan wrote:
> > The commit 825d0b73cd752("x86/mm/pti: Handle unaligned address gracefully
> > in pti_clone_pagetable()") handles unaligned address well for unmapped
> > PUD/PMD etc. But unaligned address for pmd_large() or PTI_CLONE_PMD is also
> > needed to be aware.
>
> That 825d0b73cd752 changelog says:
>
> >     pti_clone_pmds() assumes that the supplied address is either:
> >
> >      - properly PUD/PMD aligned
> >     or
> >      - the address is actually mapped which means that independently
> >        of the mapping level (PUD/PMD/PTE) the next higher mapping
> >        exists.
>
> ... and that was the root of the bug.  If there was a large, unmapped
> area, it would skip a PUD_SIZE or PMD_SIZE *area* instead of skipping to
> the *next* pud/pmd.
>
> The case being patched here is from a *present* PTE/PMD, so it's a
> mapped area, not a hole.
>
> That said, I think the previous changelog was wrong.  An unaligned
> address to a mapped, large (2M) region followed by a smaller (4k) region
> would skip too far into the 4k region.
>
> That said, I'm not sure I like this fix.  If someone is explicitly
> asking to clone a PMD (which pti_clone_pgtable() forces you to do), they
> better align the address.

Hello, Dave

I think I got what you mean more or less, but I don't think I can
update the patch to address all your concerns and requirements.

I know very little about the area.

Could you make new patches to replace mine.

Thanks
Lai.