linux-kernel - Re: [PATCH 1/1] x86/ioremap: Use is_vmalloc

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <87seve4e37.fsf@nvdebian.thelocal>
Date: Fri, 09 Aug 2024 12:28:17 +1000
From: Alistair Popple <apopple@...dia.com>
To: Dan Williams <dan.j.williams@...el.com>
Cc: Thomas Gleixner <tglx@...utronix.de>, dave.hansen@...ux.intel.com,
 luto@...nel.org, peterz@...radead.org, max8rr8@...il.com,
 linux-kernel@...r.kernel.org, x86@...nel.org, jhubbard@...dia.com
Subject: Re: [PATCH 1/1] x86/ioremap: Use is_vmalloc_addr in iounmap


Dan Williams <dan.j.williams@...el.com> writes:

> [ add Alistair and John ]
>
> Thomas Gleixner wrote:
>> On Thu, Aug 08 2024 at 09:39, Dan Williams wrote:
>> > Dan Williams wrote:
>> >> Apologies was trying to quickly reverse engineer how private memory
>> >> might be different than typical memremap_pages(), but it is indeed the
>> >> same in this aspect.
>> >> 
>> >> So the real difference is that the private memory case tries to
>> >> allocate physical memory by searching for holes in the iomem_resource
>> >> starting from U64_MAX. That might explain why only the private memory
>> >> case is violating assumptions with respect to high_memory spilling into
>> >> vmalloc space.
>> >
>> > Not U64_MAX, but it starts searching for free physical address space
>> > starting at MAX_PHYSMEM_BITS, see gfr_start().
>> 
>> Wait. MAX_PHYSMEM_BITS is either 46 (4-level) or 52 (5-level), which is
>> fully covered by the identity map space.
>> 
>> So even if the search starts from top of that space, how do we end up
>> with high_memory > VMALLOC_START?
>> 
>> That does not make any sense at all
>
> Max, or Alistair can you provide more details of how private memory spills over
> into the VMALLOC space on these platforms?

Well I was hoping pleading ignorance on x86 memory maps would get me out
of having to look too deeply :-) But alas...

It appears the problem originates in KASLR which can cause the VMALLOC
region to overlap with the top of the linear map.

> I too would have thought that MAX_PHYSMEM_BITS protects against this?

Me too, until about an hour ago. As noted above
request_free_mem_region() allocates from (1 << MAX_PHYSMEM_BITS) - 1
down. Therefore VMALLOC_START needs to be greater than PAGE_OFFSET + (1
<< MAX_PHYSMEM_BITS) - 1.  However the default configuration for KASLR
as set by RANDOMIZE_MEMORY_PHYSICAL_PADDING is to only provide 10TB
above what max_pfn is set to at boot time (and even then only if
CONFIG_MEMORY_HOTPLUG is enabled).

Obviously ZONE_DEVICE memory ends up being way above that and crosses
into the VMALLOC region. So I think the actual fix is something like:

---

diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig
index e36261b4ea14..c58d7b0f5bca 100644
--- a/arch/x86/Kconfig
+++ b/arch/x86/Kconfig
@@ -2277,6 +2277,7 @@ config RANDOMIZE_MEMORY_PHYSICAL_PADDING
        depends on RANDOMIZE_MEMORY
        default "0xa" if MEMORY_HOTPLUG
        default "0x0"
+       range 0x40 0x40 if GET_FREE_REGION
        range 0x1 0x40 if MEMORY_HOTPLUG
        range 0x0 0x40
        help