linux-kernel - Re: [PATCH 1/1] iommu/amd: Fix "execute NX-protected page" when running CPU hotplug

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <0192198a-8150-465d-ba74-fd7ab7af1b72@amd.com>
Date: Wed, 12 Jun 2024 13:56:40 +0530
From: Vasant Hegde <vasant.hegde@....com>
To: Adrian Huang <adrianhuang0701@...il.com>, Joerg Roedel <joro@...tes.org>,
 Suravee Suthikulpanit <suravee.suthikulpanit@....com>,
 Will Deacon <will@...nel.org>
Cc: Dimitri Sivanich <sivanich@....com>, iommu@...ts.linux.dev,
 linux-kernel@...r.kernel.org, Adrian Huang <ahuang12@...ovo.com>
Subject: Re: [PATCH 1/1] iommu/amd: Fix "execute NX-protected page" when
 running CPU hotplug

Hi Adrian,

On 6/11/2024 9:24 PM, Adrian Huang wrote:
> From: Adrian Huang <ahuang12@...ovo.com>
> 
> When running the following command (cpu hotplug test case of LTP),
> the "execute NX-protected page" exception is triggered.


Thanks for the detailed report and fix. This issue has been discussed and we
already have similar patch [1] from Dimitri.


[1] https://lore.kernel.org/linux-iommu/ZljHE%2FR4KLzGU6vx@hpe.com/

-Vasant




> 
>   # /opt/ltp/testcases/bin/cpuhotplug02.sh -c 1 -l 1
> 
> Here is the call trace:
> 
>   process 14301 (cpuhotplug_do_s) no longer affine to cpu1
>   smpboot: CPU 1 is now offline
>   smpboot: Booting Node 0 Processor 1 APIC 0x2
>   LVT offset 0 assigned for vector 0x400
>   kernel tried to execute NX-protected page - exploit attempt? (uid: 0)
>   BUG: unable to handle page fault for address: ffffffffbb559170
>   #PF: supervisor instruction fetch in kernel mode
>   #PF: error_code(0x0011) - permissions violation
>   PGD 1ae25067 P4D 1ae25067 PUD 1ae26063 PMD 134abd063 PTE 80000000
>   Oops: Oops: 0011 [#1] PREEMPT SMP NOPTI
>   CPU: 1 PID: 24 Comm: cpuhp/1 Kdump: loaded Not tainted 6.10.0-rc3
>   Hardware name: Lenovo ThinkSystem SR665 MB/7D2WRCZ000, BIOS D8E121K-2.20 08/12/2021
>   RIP: 0010:amd_iommu_enable_faulting+0x0/0x10
>   Code: cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc
>    cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc <cc> cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc
>   RSP: 0018:ffffb4e243fafe48 EFLAGS: 00010202
>   RAX: 00000000000003c0 RBX: ffff90f4baea0820 RCX: 0000000000000000
>   RDX: 00000000000000ec RSI: 00000000000000c0 RDI: 0000000000000001
>   RBP: 0000000000000001 R08: ffff90f4baea0848 R09: ffff90f184a90d00
>   R10: ffff90f184a90ce0 R11: ffff90f1834ebaf8 R12: 00000000000000c0
>   R13: ffffffffbb559170 R14: ffffffffbaa4bd00 R15: ffff90f4baea0848
>   FS:  0000000000000000(0000) GS:ffff90f4bae80000(0000) knlGS:0000000000000000
>   CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
>   CR2: ffffffffbb559170 CR3: 000000001ae20000 CR4: 0000000000350ef0
>   Call Trace:
>    <TASK>
>    ? __die+0x20/0x70
>    ? __pfx_amd_iommu_enable_faulting+0x10/0x10
>    ? page_fault_oops+0x75/0x170
>    ? __pfx_amd_iommu_enable_faulting+0x10/0x10
>    ? exc_page_fault+0xaa/0x140
>    ? asm_exc_page_fault+0x22/0x30
>    ? __pfx_amd_iommu_enable_faulting+0x10/0x10
>    ? __pfx_amd_iommu_enable_faulting+0x10/0x10
>    ? __pfx_amd_iommu_enable_faulting+0x10/0x10
>    cpuhp_invoke_callback+0x2cc/0x470
>    ? __pfx_blk_mq_hctx_notify_online+0x10/0x10
>    ? __pfx_smpboot_thread_fn+0x10/0x10
>    cpuhp_thread_fun+0x8b/0x140
>    smpboot_thread_fn+0xd9/0x1d0
>    kthread+0xcf/0x100
>    ? __pfx_kthread+0x10/0x10
>    ret_from_fork+0x30/0x50
>    ? __pfx_kthread+0x10/0x10
>    ret_from_fork_asm+0x1a/0x30
>    </TASK>
> 
> The address '0xffffffffbb559170' is the function address of
> 'amd_iommu_enable_faulting()'. However, this function is declared with
> '__init' keyword and will be freed in free_initmem().
> 
> Fix the issue by removing '__init' keyword since this function is still
> needed for the up-and-running kernel.
> 
> Fixes: d74169ceb0d2 ("iommu/vt-d: Allocate DMAR fault interrupts locally")
> Signed-off-by: Adrian Huang <ahuang12@...ovo.com>
> ---
>  drivers/iommu/amd/init.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/iommu/amd/init.c b/drivers/iommu/amd/init.c
> index 27e293727095..161248067776 100644
> --- a/drivers/iommu/amd/init.c
> +++ b/drivers/iommu/amd/init.c
> @@ -3362,7 +3362,7 @@ int amd_iommu_reenable(int mode)
>  	return 0;
>  }
>  
> -int __init amd_iommu_enable_faulting(unsigned int cpu)
> +int amd_iommu_enable_faulting(unsigned int cpu)
>  {
>  	/* We enable MSI later when PCI is initialized */
>  	return 0;