linux-kernel - Re: [tip:x86/mm] [x86/mm] b389949485: WARNING:at_arch/x86/mm/pat/set_memory.c:#__change_page

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <Y2ksBbNMsRKFzN4Y@hirez.programming.kicks-ass.net>
Date:   Mon, 7 Nov 2022 17:02:13 +0100
From:   Peter Zijlstra <peterz@...radead.org>
To:     kernel test robot <oliver.sang@...el.com>
Cc:     oe-lkp@...ts.linux.dev, lkp@...el.com,
        Linus Torvalds <torvalds@...ux-foundation.org>,
        linux-kernel@...r.kernel.org, x86@...nel.org,
        Dave Hansen <dave.hansen@...el.com>
Subject: Re: [tip:x86/mm] [x86/mm]  b389949485:
 WARNING:at_arch/x86/mm/pat/set_memory.c:#__change_page_attr

On Mon, Nov 07, 2022 at 04:12:20PM +0100, Peter Zijlstra wrote:
> On Sun, Nov 06, 2022 at 08:38:27PM +0800, kernel test robot wrote:
> > 
> > Greeting,
> > 
> > FYI, we noticed WARNING:at_arch/x86/mm/pat/set_memory.c:#__change_page_attr due to commit (built with gcc-11):
> > 
> > commit: b38994948567e6d6b62947401c57f4ab2efe070c ("x86/mm: Implement native set_memory_rox()")
> > https://git.kernel.org/cgit/linux/kernel/git/tip/tip.git x86/mm
> > 
> > [test failed on linux-next/master 0cdb3579f1ee4c1e55acf8dfb0697b660067b1f8]
> > 
> > in testcase: boot
> > 
> > on test machine: qemu-system-x86_64 -enable-kvm -cpu SandyBridge -smp 2 -m 16G
> > 
> > caused below changes (please refer to attached dmesg/kmsg for entire log/backtrace):
> > 
> > 
> > If you fix the issue, kindly add following tag
> > | Reported-by: kernel test robot <oliver.sang@...el.com>
> > | Link: https://lore.kernel.org/oe-lkp/202211061748.eb591682-oliver.sang@intel.com
> > 
> > 
> > [   44.943065][   T11] ------------[ cut here ]------------
> > [   44.943725][   T11] CPA detected W^X violation: 0000000000000060 -> 0000000000000063 range: 0xffff8881beca5000 - 0xffff8881beca5fff PFN 1beca5
> > [ 44.944929][ T11] WARNING: CPU: 0 PID: 11 at arch/x86/mm/pat/set_memory.c:609 __change_page_attr (arch/x86/mm/pat/set_memory.c:609 arch/x86/mm/pat/set_memory.c:1582) 
> > [   44.945824][   T11] Modules linked in:
> > [   44.946229][   T11] CPU: 0 PID: 11 Comm: kworker/0:1 Tainted: G        W          6.1.0-rc3-00010-gb38994948567 #1 f37474c2082f37dd433f70907b94c2b0df8d70b8
> > [   44.947518][   T11] Workqueue: events bpf_prog_free_deferred
> > [ 44.948074][ T11] RIP: 0010:__change_page_attr (arch/x86/mm/pat/set_memory.c:609 arch/x86/mm/pat/set_memory.c:1582) 
> 
> Urgh, as spotted by dhansen, the code in change_page_attr_set_clr(),
> specifically the checkalias thing, seems to rely on single bit flips for
> NX.
> 
> Let me try to make sense of this stuff....

This appears to appease the test case, but I definitely need to look at
this again with a fresh mind, horrid stuff this and I'm sure I hate this
patch.


---
diff --git a/arch/x86/mm/pat/set_memory.c b/arch/x86/mm/pat/set_memory.c
index f275605892df..07339ac8bc41 100644
--- a/arch/x86/mm/pat/set_memory.c
+++ b/arch/x86/mm/pat/set_memory.c
@@ -69,10 +69,11 @@ static const int cpa_warn_level = CPA_PROTECT;
  */
 static DEFINE_SPINLOCK(cpa_lock);
 
-#define CPA_FLUSHTLB 1
-#define CPA_ARRAY 2
-#define CPA_PAGES_ARRAY 4
-#define CPA_NO_CHECK_ALIAS 8 /* Do not search for aliases */
+#define CPA_FLUSHTLB		0x01
+#define CPA_ARRAY		0x02
+#define CPA_PAGES_ARRAY		0x04
+#define CPA_NO_CHECK_ALIAS	0x08 /* Do not search for aliases */
+#define CPA_HAS_NX		0x10
 
 static inline pgprot_t cachemode2pgprot(enum page_cache_mode pcm)
 {
@@ -1708,9 +1709,21 @@ static int __change_page_attr_set_clr(struct cpa_data *cpa, int checkalias)
 			goto out;
 
 		if (checkalias) {
-			ret = cpa_process_alias(cpa);
-			if (ret)
-				goto out;
+			pgprot_t set = cpa->mask_set;
+			pgprot_t clr = cpa->mask_clr;
+
+			if (cpa->flags & CPA_HAS_NX) {
+				cpa->mask_set.pgprot &= ~_PAGE_NX;
+				cpa->mask_clr.pgprot &= ~_PAGE_NX;
+			}
+			if (pgprot_val(cpa->mask_set) | pgprot_val(cpa->mask_clr)) {
+				ret = cpa_process_alias(cpa);
+				if (ret)
+					goto out;
+			}
+
+			cpa->mask_set = set;
+			cpa->mask_clr = clr;
 		}
 
 		/*
@@ -1788,8 +1801,10 @@ static int change_page_attr_set_clr(unsigned long *addr, int numpages,
 	if (in_flag & (CPA_ARRAY | CPA_PAGES_ARRAY))
 		cpa.flags |= in_flag;
 
-	/* No alias checking for _NX bit modifications */
-	checkalias = (pgprot_val(mask_set) | pgprot_val(mask_clr)) != _PAGE_NX;
+	if ((pgprot_val(mask_set) | pgprot_val(mask_clr)) & _PAGE_NX)
+		cpa.flags |= CPA_HAS_NX;
+
+	checkalias = 1;
 	/* Has caller explicitly disabled alias checking? */
 	if (in_flag & CPA_NO_CHECK_ALIAS)
 		checkalias = 0;