linux-kernel - Re: [PATCH v5 04/15] arm64: errata: Add detection for TRBE write to out-of-range

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <928f02ab-8226-1679-a120-06778d03c93c@arm.com>
Date:   Tue, 19 Oct 2021 14:29:58 +0100
From:   Suzuki K Poulose <suzuki.poulose@....com>
To:     Mathieu Poirier <mathieu.poirier@...aro.org>
Cc:     will@...nel.org, catalin.marinas@....com,
        anshuman.khandual@....com, mike.leach@...aro.org,
        leo.yan@...aro.org, maz@...nel.org, coresight@...ts.linaro.org,
        linux-arm-kernel@...ts.infradead.org, linux-kernel@...r.kernel.org,
        Mark Rutland <mark.rutland@....com>
Subject: Re: [PATCH v5 04/15] arm64: errata: Add detection for TRBE write to
 out-of-range

On 18/10/2021 16:50, Mathieu Poirier wrote:
> Good morning,
> 
> On Thu, Oct 14, 2021 at 11:31:14PM +0100, Suzuki K Poulose wrote:
>> Arm Neoverse-N2 and Cortex-A710 cores are affected by an erratum where the
>> trbe, under some circumstances, might write upto 64bytes to an address after
> 
> Checkpatch gives me a warning about this line...
> 
>> the Limit as programmed by the TRBLIMITR_EL1.LIMIT. This might -
>>
>>    - Corrupt a page in the ring buffer, which may corrupt trace from a
>>      previous session, consumed by userspace.
>>    - Hit the guard page at the end of the vmalloc area and raise a fault.
>>
>> To keep the handling simpler, we always leave the last page from the
>> range, which TRBE is allowed to write. This can be achieved by ensuring
>> that we always have more than a PAGE worth space in the range, while
>> calculating the LIMIT for TRBE. And then the LIMIT pointer can be adjusted
>> to leave the PAGE (TRBLIMITR.LIMIT -= PAGE_SIZE), out of the TRBE range
>> while enabling it. This makes sure that the TRBE will only write to an area
>> within its allowed limit (i.e, [head-head+size]) and we do not have to handle
> 
> I'm pretty sure this line will also be flagged.
> 

Thanks for pointing them out. I have fixed it now.

Suzuki