linux-kernel - Re: [PATCH 1/3] mm: Make generic arch_is_kernel_initmem

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Mon, 27 Sep 2021 15:51:09 +0200
From:   Christophe Leroy <christophe.leroy@...roup.eu>
To:     Michael Ellerman <mpe@...erman.id.au>,
        Andrew Morton <akpm@...ux-foundation.org>, arnd@...db.de
Cc:     linux-kernel@...r.kernel.org, linux-mm@...ck.org,
        linux-s390@...r.kernel.org, linuxppc-dev@...ts.ozlabs.org,
        linux-arch@...r.kernel.org,
        Gerald Schaefer <gerald.schaefer@...ux.ibm.com>
Subject: Re: [PATCH 1/3] mm: Make generic arch_is_kernel_initmem_freed() do
 what it says



Le 27/09/2021 à 15:11, Michael Ellerman a écrit :
> Christophe Leroy <christophe.leroy@...roup.eu> writes:
>> Commit 7a5da02de8d6 ("locking/lockdep: check for freed initmem in
>> static_obj()") added arch_is_kernel_initmem_freed() which is supposed
>> to report whether an object is part of already freed init memory.
>>
>> For the time being, the generic version of arch_is_kernel_initmem_freed()
>> always reports 'false', allthough free_initmem() is generically called
>> on all architectures.
>>
>> Therefore, change the generic version of arch_is_kernel_initmem_freed()
>> to check whether free_initmem() has been called. If so, then check
>> if a given address falls into init memory.
>>
>> In order to use function init_section_contains(), the fonction is
>> moved at the end of asm-generic/section.h
>>
>> Cc: Gerald Schaefer <gerald.schaefer@...ux.ibm.com>
>> Signed-off-by: Christophe Leroy <christophe.leroy@...roup.eu>
>> ---
>>   include/asm-generic/sections.h | 31 +++++++++++++++++--------------
>>   1 file changed, 17 insertions(+), 14 deletions(-)
>>
>> diff --git a/include/asm-generic/sections.h b/include/asm-generic/sections.h
>> index d16302d3eb59..d1e5bb2c6b72 100644
>> --- a/include/asm-generic/sections.h
>> +++ b/include/asm-generic/sections.h
>> @@ -172,4 +158,21 @@ static inline bool is_kernel_rodata(unsigned long addr)
>>   	       addr < (unsigned long)__end_rodata;
>>   }
>>   
>> +/*
>> + * Check if an address is part of freed initmem. This is needed on architectures
>> + * with virt == phys kernel mapping, for code that wants to check if an address
>> + * is part of a static object within [_stext, _end]. After initmem is freed,
>> + * memory can be allocated from it, and such allocations would then have
>> + * addresses within the range [_stext, _end].
>> + */
>> +#ifndef arch_is_kernel_initmem_freed
>> +static inline int arch_is_kernel_initmem_freed(unsigned long addr)
>> +{
>> +	if (system_state < SYSTEM_RUNNING)
>> +		return 0;
>> +
>> +	return init_section_contains((void *)addr, 1);
>> +}
>> +#endif
> 
> This will return an incorrect result for a short period during boot
> won't it?
> 
> See init/main.c:
> 
> static int __ref kernel_init(void *unused)
> {
> 	...
> 	free_initmem();			<- memory is freed here
> 	mark_readonly();
> 
> 	/*
> 	 * Kernel mappings are now finalized - update the userspace page-table
> 	 * to finalize PTI.
> 	 */
> 	pti_finalize();
> 
> 	system_state = SYSTEM_RUNNING;
> 
> 
> After free_initmem() we have address ranges that are now freed initmem,
> but arch_is_kernel_initmem_freed() continues to return 0 (false) for all
> addresses, until we update system_state.
> 
> Possibly that doesn't matter for any of the current callers, but it
> seems pretty dicey to me.
> 

Yes I saw it but as function core_kernel_text() uses that criteria for 
deciding whether a given init text address is valid or not, I thought it 
was just ok.

Should we add an intermediate state called for exemple 
SYSTEM_FREEING_INIT just before SYSTEM_RUNNING ?

Christophe