linux-kernel - [tip: x86/mm] x86/ioremap: Improve iounmap() address range checks

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <172469724139.2215.3812505849962933435.tip-bot2@tip-bot2>
Date: Mon, 26 Aug 2024 18:34:01 -0000
From: "tip-bot2 for Max Ramanouski" <tip-bot2@...utronix.de>
To: linux-tip-commits@...r.kernel.org
Cc: Max Ramanouski <max8rr8@...il.com>,
 Dave Hansen <dave.hansen@...ux.intel.com>, Christoph Hellwig <hch@....de>,
 Alistair Popple <apopple@...dia.com>, x86@...nel.org,
 linux-kernel@...r.kernel.org
Subject: [tip: x86/mm] x86/ioremap: Improve iounmap() address range checks

The following commit has been merged into the x86/mm branch of tip:

Commit-ID:     50c6dbdfd16e312382842198a7919341ad480e05
Gitweb:        https://git.kernel.org/tip/50c6dbdfd16e312382842198a7919341ad480e05
Author:        Max Ramanouski <max8rr8@...il.com>
AuthorDate:    Sun, 25 Aug 2024 01:01:11 +03:00
Committer:     Dave Hansen <dave.hansen@...ux.intel.com>
CommitterDate: Mon, 26 Aug 2024 10:19:55 -07:00

x86/ioremap: Improve iounmap() address range checks

Allowing iounmap() on memory that was not ioremap()'d in the first
place is obviously a bad idea.  There is currently a feeble attempt to
avoid errant iounmap()s by checking to see if the address is below
"high_memory".  But that's imprecise at best because there are plenty
of high addresses that are also invalid to call iounmap() on.

Thankfully, there is a more precise helper: is_ioremap_addr().  x86
just does not use it in iounmap().

Restrict iounmap() to addresses in the ioremap region, by using
is_ioremap_addr(). This aligns x86 closer to the generic iounmap()
implementation.

Additionally, add a warning in case there is an attempt to iounmap()
invalid memory.  This replaces an existing silent return and will
help alert folks to any incorrect usage of iounmap().

Due to VMALLOC_START on i386 not being present in asm/pgtable.h,
include for asm/vmalloc.h had to be added to include/linux/ioremap.h.

[ dhansen: tweak subject and changelog ]

Signed-off-by: Max Ramanouski <max8rr8@...il.com>
Signed-off-by: Dave Hansen <dave.hansen@...ux.intel.com>
Reviewed-by: Christoph Hellwig <hch@....de>
Reviewed-by: Alistair Popple <apopple@...dia.com>
Link: https://lore.kernel.org/all/20240824220111.84441-1-max8rr8%40gmail.com
---
 arch/x86/mm/ioremap.c   | 3 ++-
 include/linux/ioremap.h | 1 +
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/arch/x86/mm/ioremap.c b/arch/x86/mm/ioremap.c
index aa7d279..70b02fc 100644
--- a/arch/x86/mm/ioremap.c
+++ b/arch/x86/mm/ioremap.c
@@ -11,6 +11,7 @@
 #include <linux/init.h>
 #include <linux/io.h>
 #include <linux/ioport.h>
+#include <linux/ioremap.h>
 #include <linux/slab.h>
 #include <linux/vmalloc.h>
 #include <linux/mmiotrace.h>
@@ -457,7 +458,7 @@ void iounmap(volatile void __iomem *addr)
 {
 	struct vm_struct *p, *o;

-	if ((void __force *)addr <= high_memory)
+	if (WARN_ON_ONCE(!is_ioremap_addr((void __force *)addr)))
 		return;

 	/*
diff --git a/include/linux/ioremap.h b/include/linux/ioremap.h
index f0e99fc..2bd1661 100644
--- a/include/linux/ioremap.h
+++ b/include/linux/ioremap.h
@@ -4,6 +4,7 @@

 #include <linux/kasan.h>
 #include <asm/pgtable.h>
+#include <asm/vmalloc.h>

 #if defined(CONFIG_HAS_IOMEM) || defined(CONFIG_GENERIC_IOREMAP)
 /*