linux-kernel - Re: [PATCH] powerpc: don't select KFENCE on platform PPC_FSL

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <63e78249-8878-cbe3-0a22-a094ef53164a@huawei.com>
Date:   Sat, 25 Sep 2021 11:10:25 +0800
From:   Liu Shixin <liushixin2@...wei.com>
To:     Christophe Leroy <christophe.leroy@...roup.eu>,
        Marco Elver <elver@...gle.com>,
        Michael Ellerman <mpe@...erman.id.au>,
        "Benjamin Herrenschmidt" <benh@...nel.crashing.org>,
        Paul Mackerras <paulus@...ba.org>
CC:     <linuxppc-dev@...ts.ozlabs.org>, <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH] powerpc: don't select KFENCE on platform PPC_FSL_BOOK3E



On 2021/9/24 14:41, Christophe Leroy wrote:
>
>
> Le 24/09/2021 à 08:39, Liu Shixin a écrit :
>> On platform PPC_FSL_BOOK3E, all lowmem is managed by tlbcam. That means
>> we didn't really map the kfence pool with page granularity. Therefore,
>> if KFENCE is enabled, the system will hit the following panic:
>
> Could you please explain a bit more what the problem is ?
>
> KFENCE has been implemented with the same logic as DEBUG_PAGEALLOC.
>
> DEBUG_PAGEALLOC is enabled on FSL_BOOK3E.
>
> In MMU_setup(), __map_without_ltlbs is set to 1 when KFENCE is enabled.
>
> __map_without_ltlbs should disable the use of tlbcam.
>
>
> So what's wrong really ?
>
> Does DEBUG_PAGEALLOC work on FSL_BOOK3E ?
>
> Thanks
> Christophe
>
hi Christophe,

The phenomenon is that kernel panic in the kfence_protect_page function because
__kfence_pool is not mapped with page granularity.

The problem is that in the mapin_ram function, the return value(i.e base) of mmu_mapin_ram
is equal to top. As a result, no level-2 page table is created for [base, top]. It seems that
__map_without_ltlbs didn't diable the use of tlbcam.

I have tried to force page table for all lowmem, then this problem will go away
but the kfence_test failed, which could be explained by the fact that tlbcam is still used.

By the way, DEBUG_PAGEALLOC works well on FSL_BOOK3E without level-2 page table.

Thanks,
>>
>>      BUG: Kernel NULL pointer dereference on read at 0x00000000
>>      Faulting instruction address: 0xc01de598
>>      Oops: Kernel access of bad area, sig: 11 [#1]
>>      BE PAGE_SIZE=4K SMP NR_CPUS=4 MPC8544 DS
>>      Dumping ftrace buffer:
>>         (ftrace buffer empty)
>>      Modules linked in:
>>      CPU: 0 PID: 0 Comm: swapper/0 Not tainted 5.12.0-rc3+ #298
>>      NIP:  c01de598 LR: c08ae9c4 CTR: 00000000
>>      REGS: c0b4bea0 TRAP: 0300   Not tainted  (5.12.0-rc3+)
>>      MSR:  00021000 <CE,ME>  CR: 24000228  XER: 20000000
>>      DEAR: 00000000 ESR: 00000000
>>      GPR00: c08ae9c4 c0b4bf60 c0ad64e0 ef720000 00021000 00000000 00000000 00000200
>>      GPR08: c0ad5000 00000000 00000000 00000004 00000000 008fbb30 00000000 00000000
>>      GPR16: 00000000 00000000 00000000 00000000 c0000000 00000000 00000000 00000000
>>      GPR24: c08ca004 c08ca004 c0b6a0e0 c0b60000 c0b58f00 c0850000 c08ca000 ef720000
>>      NIP [c01de598] kfence_protect+0x44/0x6c
>>      LR [c08ae9c4] kfence_init+0xfc/0x2a4
>>      Call Trace:
>>      [c0b4bf60] [efffe160] 0xefffe160 (unreliable)
>>      [c0b4bf70] [c08ae9c4] kfence_init+0xfc/0x2a4
>>      [c0b4bfb0] [c0894d3c] start_kernel+0x3bc/0x574
>>      [c0b4bff0] [c0000470] set_ivor+0x14c/0x188
>>      Instruction dump:
>>      7c0802a6 8109d594 546a653a 90010014 54630026 39200000 7d48502e 2c0a0000
>>      41820010 554a0026 5469b53a 7d295214 <81490000> 38831000 554a003c 91490000
>>      random: get_random_bytes called from print_oops_end_marker+0x40/0x78 with crng_init=0
>>      ---[ end trace 0000000000000000 ]---
>>
>> Signed-off-by: Liu Shixin <liushixin2@...wei.com>
>> ---
>>   arch/powerpc/Kconfig | 2 +-
>>   1 file changed, 1 insertion(+), 1 deletion(-)
>>
>> diff --git a/arch/powerpc/Kconfig b/arch/powerpc/Kconfig
>> index d46db0bfb998..cffd57bcb5e4 100644
>> --- a/arch/powerpc/Kconfig
>> +++ b/arch/powerpc/Kconfig
>> @@ -185,7 +185,7 @@ config PPC
>>       select HAVE_ARCH_KASAN            if PPC32 && PPC_PAGE_SHIFT <= 14
>>       select HAVE_ARCH_KASAN_VMALLOC        if PPC32 && PPC_PAGE_SHIFT <= 14
>>       select HAVE_ARCH_KGDB
>> -    select HAVE_ARCH_KFENCE            if PPC32
>> +    select HAVE_ARCH_KFENCE            if PPC32 && !PPC_FSL_BOOK3E
>>       select HAVE_ARCH_MMAP_RND_BITS
>>       select HAVE_ARCH_MMAP_RND_COMPAT_BITS    if COMPAT
>>       select HAVE_ARCH_NVRAM_OPS
>>
> .
>