linux-kernel - Re: [PATCH 1/1] mm/debug_vm_pgtable: fix alignment for pmd/pud_advanced

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Wed, 26 May 2021 18:06:25 +0530
From:   Anshuman Khandual <anshuman.khandual@....com>
To:     Anatoly Pugachev <matorola@...il.com>,
        Gerald Schaefer <gerald.schaefer@...ux.ibm.com>
Cc:     Andrew Morton <akpm@...ux-foundation.org>,
        linux-mm <linux-mm@...ck.org>,
        LKML <linux-kernel@...r.kernel.org>,
        linux-arch <linux-arch@...r.kernel.org>,
        linux-sparc <sparclinux@...r.kernel.org>,
        linux-s390 <linux-s390@...r.kernel.org>, stable@...r.kernel.org
Subject: Re: [PATCH 1/1] mm/debug_vm_pgtable: fix alignment for
 pmd/pud_advanced_tests()



On 5/26/21 4:57 PM, Anatoly Pugachev wrote:
> On Tue, May 25, 2021 at 4:03 PM Gerald Schaefer
> <gerald.schaefer@...ux.ibm.com> wrote:
>>
>> In pmd/pud_advanced_tests(), the vaddr is aligned up to the next pmd/pud
>> entry, and so it does not match the given pmdp/pudp and (aligned down) pfn
>> any more.
>>
>> For s390, this results in memory corruption, because the IDTE instruction
>> used e.g. in xxx_get_and_clear() will take the vaddr for some calculations,
>> in combination with the given pmdp. It will then end up with a wrong table
>> origin, ending on ...ff8, and some of those wrongly set low-order bits will
>> also select a wrong pagetable level for the index addition. IDTE could
>> therefore invalidate (or 0x20) something outside of the page tables,
>> depending on the wrongly picked index, which in turn depends on the random
>> vaddr.
>>
>> As result, we sometimes see "BUG task_struct (Not tainted): Padding
>> overwritten" on s390, where one 0x5a padding value got overwritten with
>> 0x7a.
>>
>> Fix this by aligning down, similar to how the pmd/pud_aligned pfns are
>> calculated.
>>
>> Fixes: a5c3b9ffb0f40 ("mm/debug_vm_pgtable: add tests validating advanced arch page table helpers")
>> Cc: <stable@...r.kernel.org> # v5.9+
>> Signed-off-by: Gerald Schaefer <gerald.schaefer@...ux.ibm.com>
> 
> boot tested on sparc64 with quick run of stress-ng ( --class memory
> --sequential -1 --timeout 10s -v --pathological --oomable
> --metrics-brief )
> stress-ng: debug: [371408] system: Linux ttip
> 5.13.0-rc3-00043-gad9f25d33860-dirty #218 SMP Wed May 26 11:55:54 MSK
> 2021 sparc64
> 
> Tested-by: Anatoly Pugachev <matorola@...il.com>
> 

spac64 does not enable ARCH_HAS_DEBUG_VM_PGTABLE, did you enable it
before running the test ? Did the entire test debug_vm_pgtable() run
successfully on sparc64 ?