linux-kernel - Re: [PATCH mm-hotfixes] mm/pagewalk: fix EFI_PGT

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <CABXGCsPe+gjOy3WiVYHsnLX+jiQkizE2g+wF4t3yS2emgCMNYQ@mail.gmail.com>
Date:   Mon, 24 Jul 2023 12:55:36 +0500
From:   Mikhail Gavrilov <mikhail.v.gavrilov@...il.com>
To:     Hugh Dickins <hughd@...gle.com>
Cc:     Andrew Morton <akpm@...ux-foundation.org>,
        Bagas Sanjaya <bagasdotme@...il.com>,
        Laura Abbott <labbott@...oraproject.org>, x86@...nel.org,
        linux-efi@...r.kernel.org, linux-kernel@...r.kernel.org,
        linux-mm@...ck.org, regressions@...ts.linux.dev
Subject: Re: [PATCH mm-hotfixes] mm/pagewalk: fix EFI_PGT_DUMP of espfix area

On Mon, Jul 24, 2023 at 2:17 AM Hugh Dickins <hughd@...gle.com> wrote:
>
> Booting x86_64 with CONFIG_EFI_PGT_DUMP=y shows messages of the form
> "mm/pgtable-generic.c:53: bad pmd (____ptrval____)(8000000100077061)".
>
> EFI_PGT_DUMP dumps all of efi_mm, including the espfix area, which is
> set up with pmd entries which fit the pmd_bad() check: so 0d940a9b270b
> warns and clears those entries, which would ruin running Win16 binaries.
>
> The failing pte_offset_map() stopped such a kernel from even booting,
> until a few commits later be872f83bf57 changed the pagewalk to tolerate
> that: but it needs to be even more careful, to not spoil those entries.
>
> I might have preferred to change init_espfix_ap() not to use "bad" pmd
> entries; or to leave them out of the efi_mm dump.  But there is great
> value in staying away from there, and a pagewalk check of address
> against TASK_SIZE may protect from other such aberrations too.
>
> Reported-by: Mikhail Gavrilov <mikhail.v.gavrilov@...il.com>
> Closes: https://lore.kernel.org/linux-mm/CABXGCsN3JqXckWO=V7p=FhPU1tK03RE1w9UE6xL5Y86SMk209w@mail.gmail.com/
> Fixes: 0d940a9b270b ("mm/pgtable: allow pte_offset_map[_lock]() to fail")
> Fixes: be872f83bf57 ("mm/pagewalk: walk_pte_range() allow for pte_offset_map()")
> Signed-off-by: Hugh Dickins <hughd@...gle.com>
> ---
>  mm/pagewalk.c | 5 ++++-
>  1 file changed, 4 insertions(+), 1 deletion(-)
>
> diff --git a/mm/pagewalk.c b/mm/pagewalk.c
> index 64437105fe0d..2022333805d3 100644
> --- a/mm/pagewalk.c
> +++ b/mm/pagewalk.c
> @@ -48,8 +48,11 @@ static int walk_pte_range(pmd_t *pmd, unsigned long addr, unsigned long end,
>         if (walk->no_vma) {
>                 /*
>                  * pte_offset_map() might apply user-specific validation.
> +                * Indeed, on x86_64 the pmd entries set up by init_espfix_ap()
> +                * fit its pmd_bad() check (_PAGE_NX set and _PAGE_RW clear),
> +                * and CONFIG_EFI_PGT_DUMP efi_mm goes so far as to walk them.
>                  */
> -               if (walk->mm == &init_mm)
> +               if (walk->mm == &init_mm || addr >= TASK_SIZE)
>                         pte = pte_offset_kernel(pmd, addr);
>                 else
>                         pte = pte_offset_map(pmd, addr);
> --
> 2.35.3
>

Thanks,
I confirm with this patch "bad pmd" went from kernel logs on all my machines.
Tested-by: Mikhail Gavrilov <mikhail.v.gavrilov@...il.com>

-- 
Best Regards,
Mike Gavrilov.