linux-kernel - Re: [PATCH 4/9] iommu/amd: Simplify pagetable freeing

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <0c55d229-67a4-c5fa-4d0d-9f1497330e45@arm.com>
Date:   Mon, 6 Dec 2021 13:28:11 +0000
From:   Robin Murphy <robin.murphy@....com>
To:     Joerg Roedel <joro@...tes.org>
Cc:     will@...nel.org, iommu@...ts.linux-foundation.org,
        suravee.suthikulpanit@....com, baolu.lu@...ux.intel.com,
        willy@...radead.org, linux-kernel@...r.kernel.org,
        john.garry@...wei.com
Subject: Re: [PATCH 4/9] iommu/amd: Simplify pagetable freeing

On 2021-12-06 12:40, Joerg Roedel wrote:
> On Tue, Nov 23, 2021 at 02:10:39PM +0000, Robin Murphy wrote:
>> For reasons unclear, pagetable freeing is an effectively recursive
>> method implemented via an elaborate system of templated functions that
>> turns out to account for 25% of the object file size. Implementing it
>> using regular straightforward recursion makes the code simpler, and
>> seems like a good thing to do before we work on it further. As part of
>> that, also fix the types to avoid all the needless casting back and
>> forth which just gets in the way.
> 
> Nice cleanup! The stack of functions came from the fact that recursion
> was pretty much discouraged in the kernel. But in this case it looks
> well bounded and should be fine.

I did wonder about explicitly clamping lvl to ensure that it couldn't 
possibly recurse any further than the multi-function version, but given 
that you'd need to craft a suitable bogus pagetable in addition to 
corrupting the arguments to be able to exploit it at all, that seemed 
perhaps a little too paranoid. Happy to add something like:

	if (WARN_ON(lvl > PAGE_MODE_7_LEVEL))
		return NULL;

if you like, though.

>> +static struct page *free_pt_lvl(u64 *pt, struct page *freelist, int lvl)
>> +{
>> +	u64 *p;
>> +	int i;
>> +
>> +	for (i = 0; i < 512; ++i) {
>> +		/* PTE present? */
>> +		if (!IOMMU_PTE_PRESENT(pt[i]))
>> +			continue;
>> +
>> +		/* Large PTE? */
>> +		if (PM_PTE_LEVEL(pt[i]) == 0 ||
>> +		    PM_PTE_LEVEL(pt[i]) == 7)
>> +			continue;
>> +
>> +		p = IOMMU_PTE_PAGE(pt[i]);
>> +		if (lvl > 2)
> 
> I thinkt this function deserves a couple of comments. It took me a while
> to make sense of the 'lvl > 2' comparision. I think it is right, but if
> I have think again I'd appreciate a comment :)

Heh, it's merely a direct transformation of the logic encoded in the 
existing "DEFINE_FREE_PT_FN(...)" cases - I assume that's just an 
optimisation, so I'll add a comment to that effect.

Thanks,
Robin.