linux-kernel - Re: [PATCH 1/1] x86/ioremap: Use is_vmalloc

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <66b59314b3d4_c1448294d3@dwillia2-xfh.jf.intel.com.notmuch>
Date: Thu, 8 Aug 2024 20:55:00 -0700
From: Dan Williams <dan.j.williams@...el.com>
To: Alistair Popple <apopple@...dia.com>, Dan Williams
	<dan.j.williams@...el.com>
CC: Thomas Gleixner <tglx@...utronix.de>, <dave.hansen@...ux.intel.com>,
	<luto@...nel.org>, <peterz@...radead.org>, <max8rr8@...il.com>,
	<linux-kernel@...r.kernel.org>, <x86@...nel.org>, <jhubbard@...dia.com>
Subject: Re: [PATCH 1/1] x86/ioremap: Use is_vmalloc_addr in iounmap

Alistair Popple wrote:
> 
> Dan Williams <dan.j.williams@...el.com> writes:
> 
> > [ add Alistair and John ]
> >
> > Thomas Gleixner wrote:
> >> On Thu, Aug 08 2024 at 09:39, Dan Williams wrote:
> >> > Dan Williams wrote:
> >> >> Apologies was trying to quickly reverse engineer how private memory
> >> >> might be different than typical memremap_pages(), but it is indeed the
> >> >> same in this aspect.
> >> >> 
> >> >> So the real difference is that the private memory case tries to
> >> >> allocate physical memory by searching for holes in the iomem_resource
> >> >> starting from U64_MAX. That might explain why only the private memory
> >> >> case is violating assumptions with respect to high_memory spilling into
> >> >> vmalloc space.
> >> >
> >> > Not U64_MAX, but it starts searching for free physical address space
> >> > starting at MAX_PHYSMEM_BITS, see gfr_start().
> >> 
> >> Wait. MAX_PHYSMEM_BITS is either 46 (4-level) or 52 (5-level), which is
> >> fully covered by the identity map space.
> >> 
> >> So even if the search starts from top of that space, how do we end up
> >> with high_memory > VMALLOC_START?
> >> 
> >> That does not make any sense at all
> >
> > Max, or Alistair can you provide more details of how private memory spills over
> > into the VMALLOC space on these platforms?
> 
> Well I was hoping pleading ignorance on x86 memory maps would get me out
> of having to look too deeply :-) But alas...
> 
> It appears the problem originates in KASLR which can cause the VMALLOC
> region to overlap with the top of the linear map.
> 
> > I too would have thought that MAX_PHYSMEM_BITS protects against this?
> 
> Me too, until about an hour ago. As noted above
> request_free_mem_region() allocates from (1 << MAX_PHYSMEM_BITS) - 1
> down. Therefore VMALLOC_START needs to be greater than PAGE_OFFSET + (1
> << MAX_PHYSMEM_BITS) - 1.  However the default configuration for KASLR
> as set by RANDOMIZE_MEMORY_PHYSICAL_PADDING is to only provide 10TB
> above what max_pfn is set to at boot time (and even then only if
> CONFIG_MEMORY_HOTPLUG is enabled).
> 
> Obviously ZONE_DEVICE memory ends up being way above that and crosses
> into the VMALLOC region. So I think the actual fix is something like:
> 
> ---
> 
> diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig
> index e36261b4ea14..c58d7b0f5bca 100644
> --- a/arch/x86/Kconfig
> +++ b/arch/x86/Kconfig
> @@ -2277,6 +2277,7 @@ config RANDOMIZE_MEMORY_PHYSICAL_PADDING
>         depends on RANDOMIZE_MEMORY
>         default "0xa" if MEMORY_HOTPLUG
>         default "0x0"
> +       range 0x40 0x40 if GET_FREE_REGION
>         range 0x1 0x40 if MEMORY_HOTPLUG
>         range 0x0 0x40
>         help

Oh, good find! Alternatively if you wanted some kaslr + private memory
then something like this? (untested):

diff --git a/kernel/resource.c b/kernel/resource.c
index 14777afb0a99..2eeb8d8a40d4 100644
--- a/kernel/resource.c
+++ b/kernel/resource.c
@@ -1824,10 +1824,11 @@ static resource_size_t gfr_start(struct resource *base, resource_size_t size,
                                 resource_size_t align, unsigned long flags)
 {
        if (flags & GFR_DESCENDING) {
+               u64 kaslr_pad = CONFIG_RANDOMIZE_MEMORY_PHYSICAL_PADDING << 40;
                resource_size_t end;
 
                end = min_t(resource_size_t, base->end,
-                           (1ULL << MAX_PHYSMEM_BITS) - 1);
+                           (1ULL << MAX_PHYSMEM_BITS) - kaslr_pad - 1);
                return end - size + 1;
        }