linux-kernel - Re: [tip:x86/urgent] [x86/kaslr] dfb3911c36: kernel_BUG_at

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <877ccbl840.ffs@tglx>
Date: Tue, 20 Aug 2024 13:57:35 +0200
From: Thomas Gleixner <tglx@...utronix.de>
To: kernel test robot <oliver.sang@...el.com>
Cc: oe-lkp@...ts.linux.dev, lkp@...el.com, linux-kernel@...r.kernel.org,
 x86@...nel.org, Max Ramanouski <max8rr8@...il.com>, Alistair Popple
 <apopple@...dia.com>, Dan Williams <dan.j.williams@...el.com>, Kees Cook
 <kees@...nel.org>, linux-mm@...ck.org, oliver.sang@...el.com
Subject: Re: [tip:x86/urgent] [x86/kaslr]  dfb3911c36:
 kernel_BUG_at_arch/x86/mm/physaddr.c

On Tue, Aug 20 2024 at 15:16, kernel test robot wrote:
> commit: dfb3911c3692e45b027f13c7dca3230921533953 ("x86/kaslr: Expose and use the end of the physical memory address space")
>
> [    0.010309][    T0] ------------[ cut here ]------------
> [    0.011020][    T0] kernel BUG at arch/x86/mm/physaddr.c:28!
> [ 0.026951][ T0] ? __phys_addr (ld-temp.o:?) 
> [ 0.027298][ T0] ? kernel_randomize_memory (ld-temp.o:?)

Sigh. I'm a moron. This obviously needs the fix below.

The end of the region is start + size - 1. So there are two bugs:

    1) It needs to be done before jumping forward to the next PUD.

    2) If the direct map covers the full address space, then
       __pa(vaddr) is wrong because that's the next PUD already.

I'll amend the commit and force push it. Thankfully I did not have time
on sunday to send it to Linus :)

Thanks,

        tglx
---
diff --git a/arch/x86/mm/kaslr.c b/arch/x86/mm/kaslr.c
index 0f2a3a4a1078..230f1dee4f09 100644
--- a/arch/x86/mm/kaslr.c
+++ b/arch/x86/mm/kaslr.c
@@ -141,19 +141,19 @@ void __init kernel_randomize_memory(void)
 		vaddr += entropy;
 		*kaslr_regions[i].base = vaddr;
 
-		/*
-		 * Jump the region and add a minimum padding based on
-		 * randomization alignment.
-		 */
+		/* Calculate the end of the region */
 		vaddr += get_padding(&kaslr_regions[i]);
-		vaddr = round_up(vaddr + 1, PUD_SIZE);
-
 		/*
 		 * KASLR trims the maximum possible size of the
 		 * direct-map. Update the physmem_end boundary.
+		 * No rounding required as the region starts
+		 * PUD aligned and size is in units of TB.
 		 */
 		if (kaslr_regions[i].end)
-			*kaslr_regions[i].end = __pa(vaddr) - 1;
+			*kaslr_regions[i].end = __pa_nodebug(vaddr - 1);
+
+		/* Add a minimum padding based on randomization alignment. */
+		vaddr = round_up(vaddr + 1, PUD_SIZE);
 		remain_entropy -= entropy;
 	}
 }