linux-kernel - RE: [PATCH v3] arm64/mm: avoid fixmap race condition when create pud mapping

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <DB7PR08MB3737631DEE8D6625D3A9E393F7209@DB7PR08MB3737.eurprd08.prod.outlook.com>
Date:   Wed, 26 Jan 2022 04:20:31 +0000
From:   Justin He <Justin.He@....com>
To:     Catalin Marinas <Catalin.Marinas@....com>,
        Jianyong Wu <Jianyong.Wu@....com>
CC:     "will@...nel.org" <will@...nel.org>,
        Anshuman Khandual <Anshuman.Khandual@....com>,
        "akpm@...ux-foundation.org" <akpm@...ux-foundation.org>,
        "david@...hat.com" <david@...hat.com>,
        "quic_qiancai@...cinc.com" <quic_qiancai@...cinc.com>,
        "ardb@...nel.org" <ardb@...nel.org>,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
        "linux-arm-kernel@...ts.infradead.org" 
        <linux-arm-kernel@...ts.infradead.org>,
        "gshan@...hat.com" <gshan@...hat.com>, nd <nd@....com>
Subject: RE: [PATCH v3] arm64/mm: avoid fixmap race condition when create pud
 mapping

Hi Catalin

> -----Original Message-----
> From: Catalin Marinas <catalin.marinas@....com>
> Sent: Friday, January 7, 2022 6:43 PM
> To: Jianyong Wu <Jianyong.Wu@....com>
> Cc: will@...nel.org; Anshuman Khandual <Anshuman.Khandual@....com>;
> akpm@...ux-foundation.org; david@...hat.com; quic_qiancai@...cinc.com;
> ardb@...nel.org; linux-kernel@...r.kernel.org; linux-arm-
> kernel@...ts.infradead.org; gshan@...hat.com; Justin He
> <Justin.He@....com>; nd <nd@....com>
> Subject: Re: [PATCH v3] arm64/mm: avoid fixmap race condition when create
> pud mapping
> 
> On Fri, Jan 07, 2022 at 09:10:57AM +0000, Jianyong Wu wrote:
> > Hi Catalin,
> >
> > I roughly find the root cause.
> >  alloc_init_pud will be called at the very beginning of kernel boot in
> create_mapping_noalloc where no memory allocator is initialized. But
> lockdep check may need allocate memory. So, kernel take exception when
> acquire lock.(I have not found the exact code that cause this issue)
> that's say we may not be able to use a lock so early.
> >
> > I come up with 2 methods to address it.
> > 1) skip dead lock check at the very beginning of kernel boot in lockdep
> code.
> > 2) provided 2 two versions of __create_pgd_mapping, one with lock in
> > it and the other without. There may be no possible of race for memory
> > mapping at the very beginning time of kernel boot, thus we can use the
> > no lock version of __create_pgd_mapping safely.
> > In my test, this issue is gone if there is no lock held in
> > create_mapping_noalloc. I think create_mapping_noalloc is called early
> > enough to avoid the race conditions of memory mapping, however, I have
> > not proved it.
> 
> I think method 2 would work better but rather than implementing new
> nolock functions I'd add a NO_LOCK flag and check it in
> alloc_init_pud() before mutex_lock/unlock. Also add a comment when
> passing the NO_LOCK flag on why it's needed and why there wouldn't be
> any races at that stage (early boot etc.)
> 
The problematic code path is:
__primary_switched
	early_fdt_map->fixmap_remap_fdt
		create_mapping_noalloc->alloc_init_pud
			mutex_lock (with Jianyong's patch)

The problem seems to be that we will clear BSS segment twice if kaslr
is enabled. Hence, some of the static variables in lockdep init process were
messed up. That is to said, with kaslr enabled we might initialize lockdep
twice if we add mutex_lock/unlock in alloc_init_pud().

In other ways, if we invoke mutex_lock/unlock in such a early booting stage.
It might be unsafe because lockdep inserts lock_acquire/release as the complex
hooks.

In summary, would it better if Jianyong splits these early boot and late boot
case? e.g. introduce a nolock version for create_mapping_noalloc().

What do you think of it?

--
Cheers,
Justin (Jia He)