linux-kernel - Re: [PATCHv2 1/4] x86/mm/ident_map: Fix virtual address wrap to zero

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <5iijyqzxd3ccranzvmfgvf3mvkesfbjsuggtuppa5wf6z444dd@ft5h2m6u2ggw>
Date: Thu, 15 Aug 2024 12:15:14 +0300
From: "Kirill A. Shutemov" <kirill.shutemov@...ux.intel.com>
To: Thomas Gleixner <tglx@...utronix.de>
Cc: Ingo Molnar <mingo@...hat.com>, Borislav Petkov <bp@...en8.de>, 
	Dave Hansen <dave.hansen@...ux.intel.com>, x86@...nel.org, "H. Peter Anvin" <hpa@...or.com>, 
	"Rafael J. Wysocki" <rafael@...nel.org>, Andy Lutomirski <luto@...nel.org>, 
	Peter Zijlstra <peterz@...radead.org>, Baoquan He <bhe@...hat.com>, Ard Biesheuvel <ardb@...nel.org>, 
	Tom Lendacky <thomas.lendacky@....com>, Andrew Morton <akpm@...ux-foundation.org>, 
	Thomas Zimmermann <tzimmermann@...e.de>, Sean Christopherson <seanjc@...gle.com>, 
	linux-kernel@...r.kernel.org, linux-acpi@...r.kernel.org, Kai Huang <kai.huang@...el.com>
Subject: Re: [PATCHv2 1/4] x86/mm/ident_map: Fix virtual address wrap to zero

On Wed, Aug 14, 2024 at 09:25:35PM +0200, Thomas Gleixner wrote:
> On Wed, Aug 14 2024 at 15:46, Kirill A. Shutemov wrote:
> > Calculation of 'next' virtual address doesn't protect against wrapping
> > to zero. It can result in page table corruption and hang. The
> > problematic case is possible if user sets high x86_mapping_info::offset.
> 
> So this should have a Fixes tag, right?

Well, I guess we can add

Fixes: e4630fdd4763 ("x86/power/64: Always create temporary identity mapping correctly")

but the bug is not triggirable with current upstream code.

It only wraps to zero if you touch top PGD entry. There's no such users in
upstream. Only hibernate_64.c uses x86_mapping_info::offset and it works
on direct mapping range which is not top PGD entry.

-- 
  Kiryl Shutsemau / Kirill A. Shutemov