linux-kernel - Re: [PATCH V2] iscsi_ibft: fix crash due to KASLR physical memory remapping

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <CAFL455=X7aCK=vSBuQZV39gR03mrnc1j+-YHWkWbVor4g89DkQ@mail.gmail.com>
Date:   Wed, 28 Jul 2021 11:39:25 +0200
From:   Maurizio Lombardi <mlombard@...hat.com>
To:     Mike Rapoport <rppt@...nel.org>
Cc:     bp@...en8.de, tglx@...utronix.de, x86@...nel.org,
        pjones@...hat.com, konrad@...nel.org,
        George Kennedy <george.kennedy@...cle.com>,
        "Rafael J. Wysocki" <rafael@...nel.org>,
        linux-kernel@...r.kernel.org
Subject: Re: [PATCH V2] iscsi_ibft: fix crash due to KASLR physical memory remapping

Hi Mike,

st 28. 7. 2021 v 8:05 odesílatel Mike Rapoport <rppt@...nel.org> napsal:
>
> Hi,
>
> On Tue, Jul 27, 2021 at 01:14:46PM +0200, Maurizio Lombardi wrote:
> > Starting with commit a799c2bd29d19c565f37fa038b31a0a1d44d0e4d
> > memory reservations have been moved earlier during the boot process,
> > before the execution of the Kernel Address Space Layout Randomization code.
> >
> > setup_arch() calls the iscsi_ibft's find_ibft_region() function
> > to find and reserve the memory dedicated to the iBFT; this function
> > also saves a (virt) pointer to the iBFT table for later use.
>
>               ^ virtual
>
> > The problem is that if KALSR is active, the physical memory gets
> > remapped somewhere else in the virtual address space and the pointer is
> > no longer valid, this will cause a kernel panic when the iscsi driver tries
> > to dereference it.
>
> Please drop "this patch" and use imperative language, e.g. "Fix this bug
> by..."
>
> > This patch fixes the bug by saving the address of the physical location
> > of the ibft; later the driver will use isa_bus_to_virt() to get
> > the correct virtual address.
> >
> > It will also simplify the code by renaming find_ibft_region()
> > to reserve_ibft_region() and removing all the wrappers.
> >
> > [   37.764225] iBFT detected.
>
> It is better to put the crash report close to the problem description as it
> actually shows how the issue is manifested.

Thanks for the review, I will submit a V3 soon

Maurizio