linux-kernel - Re: [PATCH 5.10 103/157] MIPS: kernel: Reserve exception base early to prevent corruption

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <dda5fbda-e2a0-db06-e112-a07f05ddd388@gmail.com>
Date:   Mon, 22 Mar 2021 09:46:14 -0700
From:   Florian Fainelli <f.fainelli@...il.com>
To:     Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
        Naresh Kamboju <naresh.kamboju@...aro.org>
Cc:     Kamal Dasu <kdasu.kdev@...il.com>,
        Serge Semin <fancer.lancer@...il.com>,
        open list <linux-kernel@...r.kernel.org>,
        linux-stable <stable@...r.kernel.org>,
        Mike Rapoport <rppt@...ux.ibm.com>,
        Thomas Bogendoerfer <tsbogend@...ha.franken.de>,
        Sasha Levin <sashal@...nel.org>,
        Serge Semin <Sergey.Semin@...kalelectronics.ru>,
        lkft-triage@...ts.linaro.org, linux-mips@...r.kernel.org
Subject: Re: [PATCH 5.10 103/157] MIPS: kernel: Reserve exception base early
 to prevent corruption



On 3/22/2021 8:00 AM, Greg Kroah-Hartman wrote:
> On Mon, Mar 22, 2021 at 07:44:05PM +0530, Naresh Kamboju wrote:
>> On Mon, 22 Mar 2021 at 18:14, Greg Kroah-Hartman
>> <gregkh@...uxfoundation.org> wrote:
>>>
>>> From: Thomas Bogendoerfer <tsbogend@...ha.franken.de>
>>>
>>> [ Upstream commit bd67b711bfaa02cf19e88aa2d9edae5c1c1d2739 ]
>>>
>>> BMIPS is one of the few platforms that do change the exception base.
>>> After commit 2dcb39645441 ("memblock: do not start bottom-up allocations
>>> with kernel_end") we started seeing BMIPS boards fail to boot with the
>>> built-in FDT being corrupted.
>>>
>>> Before the cited commit, early allocations would be in the [kernel_end,
>>> RAM_END] range, but after commit they would be within [RAM_START +
>>> PAGE_SIZE, RAM_END].
>>>
>>> The custom exception base handler that is installed by
>>> bmips_ebase_setup() done for BMIPS5000 CPUs ends-up trampling on the
>>> memory region allocated by unflatten_and_copy_device_tree() thus
>>> corrupting the FDT used by the kernel.
>>>
>>> To fix this, we need to perform an early reservation of the custom
>>> exception space. Additional we reserve the first 4k (1k for R3k) for
>>> either normal exception vector space (legacy CPUs) or special vectors
>>> like cache exceptions.
>>>
>>> Huge thanks to Serge for analysing and proposing a solution to this
>>> issue.
>>>
>>> Fixes: 2dcb39645441 ("memblock: do not start bottom-up allocations with kernel_end")
>>> Reported-by: Kamal Dasu <kdasu.kdev@...il.com>
>>> Debugged-by: Serge Semin <Sergey.Semin@...kalelectronics.ru>
>>> Acked-by: Mike Rapoport <rppt@...ux.ibm.com>
>>> Tested-by: Florian Fainelli <f.fainelli@...il.com>
>>> Reviewed-by: Serge Semin <fancer.lancer@...il.com>
>>> Signed-off-by: Thomas Bogendoerfer <tsbogend@...ha.franken.de>
>>> Signed-off-by: Sasha Levin <sashal@...nel.org>
>>> ---
>>>  arch/mips/include/asm/traps.h    |  3 +++
>>>  arch/mips/kernel/cpu-probe.c     |  6 ++++++
>>>  arch/mips/kernel/cpu-r3k-probe.c |  3 +++
>>>  arch/mips/kernel/traps.c         | 10 +++++-----
>>
>> mipc tinyconfig and allnoconfig builds failed on stable-rc 5.10 branch
>>
>> make --silent --keep-going --jobs=8
>> O=/home/tuxbuild/.cache/tuxmake/builds/1/tmp ARCH=mips
>> CROSS_COMPILE=mips-linux-gnu- 'CC=sccache mips-linux-gnu-gcc'
>> 'HOSTCC=sccache gcc'
>> WARNING: modpost: vmlinux.o(.text+0x6a88): Section mismatch in
>> reference from the function reserve_exception_space() to the function
>> .meminit.text:memblock_reserve()
>> The function reserve_exception_space() references
>> the function __meminit memblock_reserve().
>> This is often because reserve_exception_space lacks a __meminit
>> annotation or the annotation of memblock_reserve is wrong.
>>
>> FATAL: modpost: Section mismatches detected.
>> Set CONFIG_SECTION_MISMATCH_WARN_ONLY=y to allow them.
>> make[2]: *** [/builds/linux/scripts/Makefile.modpost:59:
>> vmlinux.symvers] Error 1
>>
>> Here is the list of build failed,
>>  - gcc-8-allnoconfig
>>  - gcc-8-tinyconfig
>>  - gcc-9-allnoconfig
>>  - gcc-9-tinyconfig
>>  - gcc-10-allnoconfig
>>  - gcc-10-tinyconfig
>>  - clang-10-tinyconfig
>>  - clang-10-allnoconfig
>>  - clang-11-allnoconfig
>>  - clang-11-tinyconfig
>>  - clang-12-tinyconfig
>>  - clang-12-allnoconfig
>>
>> Reported-by: Naresh Kamboju <naresh.kamboju@...aro.org>
>>
>> link:
>> https://gitlab.com/Linaro/lkft/mirrors/stable/linux-stable-rc/-/jobs/1117167411#L142
>>
>> steps to reproduce:
>> ---------------------------
>> # TuxMake is a command line tool and Python library that provides
>> # portable and repeatable Linux kernel builds across a variety of
>> # architectures, toolchains, kernel configurations, and make targets.
>> #
>> # TuxMake supports the concept of runtimes.
>> # See https://docs.tuxmake.org/runtimes/, for that to work it requires
>> # that you install podman or docker on your system.
>> #
>> # To install tuxmake on your system globally:
>> # sudo pip3 install -U tuxmake
>> #
>> # See https://docs.tuxmake.org/ for complete documentation.
>>
>>
>> tuxmake --runtime podman --target-arch mips --toolchain gcc-10
>> --kconfig tinyconfig
>>
> 
> Thanks for letting me know, I'll go drop this and push out a new -rc...

2dcb39645441 ("memblock: do not start bottom-up allocations with
kernel_end") is only present in v5.11 AFAICT, so not applicable for
v5.10. I did not observe this problem on v5.10.
-- 
Florian