linux-kernel - Re: [PATCH] powerpc: don't select KFENCE on platform PPC_FSL

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <9c1ee778-b38b-3d41-37f3-5ea22dca063b@csgroup.eu>
Date:   Tue, 12 Oct 2021 19:28:19 +0200
From:   Christophe Leroy <christophe.leroy@...roup.eu>
To:     Michael Ellerman <mpe@...erman.id.au>,
        Liu Shixin <liushixin2@...wei.com>,
        Marco Elver <elver@...gle.com>,
        Benjamin Herrenschmidt <benh@...nel.crashing.org>,
        Paul Mackerras <paulus@...ba.org>
Cc:     linuxppc-dev@...ts.ozlabs.org, linux-kernel@...r.kernel.org
Subject: Re: [PATCH] powerpc: don't select KFENCE on platform PPC_FSL_BOOK3E



Le 12/10/2021 à 08:24, Michael Ellerman a écrit :
> Liu Shixin <liushixin2@...wei.com> writes:
>> kindly ping.
> 
> I was under the impression you were trying to debug why it wasn't
> working with Christophe.

The investigation was a bit dormant to be honest since Liu confirmed 
that neither KFENCE not DEBUG_PAGEALLOC works.

I now looked at the effort to make it work, and it is not trivial.
At the time being, all linear space is mapped with pinned TLBs and 
everything is setup for space 0, with space 1 being used temporarily 
when doing heavy changes to space 0.

We can't use standard pages for linear space on space 0 because we need 
memory mapped at all time for exceptions (on booke exception run with 
MMU on in space 0).

In order to use standard pages, we'd need to reorganise the kernel to 
have it run mostly in space 1 (for data at least) where we would map 
almost everything with standard pages, and keep pinned TLB to map linear 
space on space 0 for TLB miss exceptions. Then we'd do more or less like 
book3s/32 and switch back into space 1 into other exceptions prolog.

That could be good to do it as we could maybe have more code in common 
with non booke 32 bits, but it is not a trivial job.

So I suggest that for now, we just make KFENCE and DEBUG_PAGEALLOC 
unselectable for booke/32 (e500 and 44x).

Christophe

> 
> cheers
> 
>> On 2021/9/24 14:39, Liu Shixin wrote:
>>> On platform PPC_FSL_BOOK3E, all lowmem is managed by tlbcam. That means
>>> we didn't really map the kfence pool with page granularity. Therefore,
>>> if KFENCE is enabled, the system will hit the following panic:
>>>
>>>      BUG: Kernel NULL pointer dereference on read at 0x00000000
>>>      Faulting instruction address: 0xc01de598
>>>      Oops: Kernel access of bad area, sig: 11 [#1]
>>>      BE PAGE_SIZE=4K SMP NR_CPUS=4 MPC8544 DS
>>>      Dumping ftrace buffer:
>>>         (ftrace buffer empty)
>>>      Modules linked in:
>>>      CPU: 0 PID: 0 Comm: swapper/0 Not tainted 5.12.0-rc3+ #298
>>>      NIP:  c01de598 LR: c08ae9c4 CTR: 00000000
>>>      REGS: c0b4bea0 TRAP: 0300   Not tainted  (5.12.0-rc3+)
>>>      MSR:  00021000 <CE,ME>  CR: 24000228  XER: 20000000
>>>      DEAR: 00000000 ESR: 00000000
>>>      GPR00: c08ae9c4 c0b4bf60 c0ad64e0 ef720000 00021000 00000000 00000000 00000200
>>>      GPR08: c0ad5000 00000000 00000000 00000004 00000000 008fbb30 00000000 00000000
>>>      GPR16: 00000000 00000000 00000000 00000000 c0000000 00000000 00000000 00000000
>>>      GPR24: c08ca004 c08ca004 c0b6a0e0 c0b60000 c0b58f00 c0850000 c08ca000 ef720000
>>>      NIP [c01de598] kfence_protect+0x44/0x6c
>>>      LR [c08ae9c4] kfence_init+0xfc/0x2a4
>>>      Call Trace:
>>>      [c0b4bf60] [efffe160] 0xefffe160 (unreliable)
>>>      [c0b4bf70] [c08ae9c4] kfence_init+0xfc/0x2a4
>>>      [c0b4bfb0] [c0894d3c] start_kernel+0x3bc/0x574
>>>      [c0b4bff0] [c0000470] set_ivor+0x14c/0x188
>>>      Instruction dump:
>>>      7c0802a6 8109d594 546a653a 90010014 54630026 39200000 7d48502e 2c0a0000
>>>      41820010 554a0026 5469b53a 7d295214 <81490000> 38831000 554a003c 91490000
>>>      random: get_random_bytes called from print_oops_end_marker+0x40/0x78 with crng_init=0
>>>      ---[ end trace 0000000000000000 ]---
>>>
>>> Signed-off-by: Liu Shixin <liushixin2@...wei.com>
>>> ---
>>>   arch/powerpc/Kconfig | 2 +-
>>>   1 file changed, 1 insertion(+), 1 deletion(-)
>>>
>>> diff --git a/arch/powerpc/Kconfig b/arch/powerpc/Kconfig
>>> index d46db0bfb998..cffd57bcb5e4 100644
>>> --- a/arch/powerpc/Kconfig
>>> +++ b/arch/powerpc/Kconfig
>>> @@ -185,7 +185,7 @@ config PPC
>>>   	select HAVE_ARCH_KASAN			if PPC32 && PPC_PAGE_SHIFT <= 14
>>>   	select HAVE_ARCH_KASAN_VMALLOC		if PPC32 && PPC_PAGE_SHIFT <= 14
>>>   	select HAVE_ARCH_KGDB
>>> -	select HAVE_ARCH_KFENCE			if PPC32
>>> +	select HAVE_ARCH_KFENCE			if PPC32 && !PPC_FSL_BOOK3E
>>>   	select HAVE_ARCH_MMAP_RND_BITS
>>>   	select HAVE_ARCH_MMAP_RND_COMPAT_BITS	if COMPAT
>>>   	select HAVE_ARCH_NVRAM_OPS