linux-kernel - Re: [External] Re: [PATCH v3] riscv: mm: Fix the out of bound issue of vmemmap address

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <CAPYmKFtq4zT4Jk0QyGnZacQJ=6JY-kgQuiGYrbjsfDE+r36QBA@mail.gmail.com>
Date: Mon, 9 Dec 2024 19:25:32 +0800
From: Xu Lu <luxu.kernel@...edance.com>
To: Björn Töpel <bjorn@...nel.org>
Cc: paul.walmsley@...ive.com, palmer@...belt.com, alexghiti@...osinc.com, 
	bjorn@...osinc.com, lihangjing@...edance.com, xieyongji@...edance.com, 
	linux-riscv@...ts.infradead.org, linux-kernel@...r.kernel.org
Subject: Re: [External] Re: [PATCH v3] riscv: mm: Fix the out of bound issue
 of vmemmap address

Hi Björn,

Thanks for your comment. Is it OK to introduce the new and unused
variable 'vmemmap_start_pfn' when CONFIG_SPARSEMEM_VMEMMAP is
disabled?

On Mon, Dec 9, 2024 at 7:03 PM Björn Töpel <bjorn@...nel.org> wrote:
>
> Minor nits below; Too many ifdefs.
>
> Xu Lu <luxu.kernel@...edance.com> writes:
>
> > In sparse vmemmap model, the virtual address of vmemmap is calculated as:
> > ((struct page *)VMEMMAP_START - (phys_ram_base >> PAGE_SHIFT)).
> > And the struct page's va can be calculated with an offset:
> > (vmemmap + (pfn)).
> >
> > However, when initializing struct pages, kernel actually starts from the
> > first page from the same section that phys_ram_base belongs to. If the
> > first page's physical address is not (phys_ram_base >> PAGE_SHIFT), then
> > we get an va below VMEMMAP_START when calculating va for it's struct page.
> >
> > For example, if phys_ram_base starts from 0x82000000 with pfn 0x82000, the
> > first page in the same section is actually pfn 0x80000. During
> > init_unavailable_range(), we will initialize struct page for pfn 0x80000
> > with virtual address ((struct page *)VMEMMAP_START - 0x2000), which is
> > below VMEMMAP_START as well as PCI_IO_END.
> >
> > This commit fixes this bug by introducing a new variable
> > 'vmemmap_start_pfn' which is aligned with memory section size and using
> > it to calculate vmemmap address instead of phys_ram_base.
> >
> > Fixes: a11dd49dcb93 ("riscv: Sparse-Memory/vmemmap out-of-bounds fix")
> > Signed-off-by: Xu Lu <luxu.kernel@...edance.com>
> > ---
> >  arch/riscv/include/asm/page.h    |  4 ++++
> >  arch/riscv/include/asm/pgtable.h |  4 +++-
> >  arch/riscv/mm/init.c             | 18 ++++++++++++++++++
> >  3 files changed, 25 insertions(+), 1 deletion(-)
> >
> > diff --git a/arch/riscv/include/asm/page.h b/arch/riscv/include/asm/page.h
> > index 71aabc5c6713..a1be1adcfb85 100644
> > --- a/arch/riscv/include/asm/page.h
> > +++ b/arch/riscv/include/asm/page.h
> > @@ -123,6 +123,10 @@ struct kernel_mapping {
> >  extern struct kernel_mapping kernel_map;
> >  extern phys_addr_t phys_ram_base;
> >
> > +#ifdef CONFIG_SPARSEMEM_VMEMMAP
>
> Not needed, and should be removed.
>
> > +extern unsigned long vmemmap_start_pfn;
> > +#endif
> > +
> >  #define is_kernel_mapping(x) \
> >       ((x) >= kernel_map.virt_addr && (x) < (kernel_map.virt_addr + kernel_map.size))
> >
> > diff --git a/arch/riscv/include/asm/pgtable.h b/arch/riscv/include/asm/pgtable.h
> > index d4e99eef90ac..e2dbd4b9a686 100644
> > --- a/arch/riscv/include/asm/pgtable.h
> > +++ b/arch/riscv/include/asm/pgtable.h
> > @@ -87,7 +87,9 @@
> >   * Define vmemmap for pfn_to_page & page_to_pfn calls. Needed if kernel
> >   * is configured with CONFIG_SPARSEMEM_VMEMMAP enabled.
> >   */
> > -#define vmemmap              ((struct page *)VMEMMAP_START - (phys_ram_base >> PAGE_SHIFT))
> > +#ifdef CONFIG_SPARSEMEM_VMEMMAP
>
> Dito, please remove.
>
> > +#define vmemmap              ((struct page *)VMEMMAP_START - vmemmap_start_pfn)
> > +#endif
> >
> >  #define PCI_IO_SIZE      SZ_16M
> >  #define PCI_IO_END       VMEMMAP_START
> > diff --git a/arch/riscv/mm/init.c b/arch/riscv/mm/init.c
> > index 0e8c20adcd98..e7c52d647f50 100644
> > --- a/arch/riscv/mm/init.c
> > +++ b/arch/riscv/mm/init.c
> > @@ -32,6 +32,9 @@
> >  #include <asm/numa.h>
> >  #include <asm/pgtable.h>
> >  #include <asm/sections.h>
> > +#ifdef CONFIG_SPARSEMEM_VMEMMAP
>
> Not needed, please remove.
>
> > +#include <asm/sparsemem.h>
> > +#endif
> >  #include <asm/soc.h>
> >  #include <asm/tlbflush.h>
> >
> > @@ -62,6 +65,13 @@ EXPORT_SYMBOL(pgtable_l5_enabled);
> >  phys_addr_t phys_ram_base __ro_after_init;
> >  EXPORT_SYMBOL(phys_ram_base);
> >
> > +#ifdef CONFIG_SPARSEMEM_VMEMMAP
> > +#define VMEMMAP_ADDR_ALIGN   (1ULL << SECTION_SIZE_BITS)
> > +
> > +unsigned long vmemmap_start_pfn __ro_after_init;
> > +EXPORT_SYMBOL(vmemmap_start_pfn);
> > +#endif
> > +
> >  unsigned long empty_zero_page[PAGE_SIZE / sizeof(unsigned long)]
> >                                                       __page_aligned_bss;
> >  EXPORT_SYMBOL(empty_zero_page);
> > @@ -243,6 +253,11 @@ static void __init setup_bootmem(void)
> >       if (!IS_ENABLED(CONFIG_XIP_KERNEL))
> >               phys_ram_base = memblock_start_of_DRAM() & PMD_MASK;
> >
> > +#ifdef CONFIG_SPARSEMEM_VMEMMAP
> > +     if (!IS_ENABLED(CONFIG_XIP_KERNEL))
> > +             vmemmap_start_pfn = round_down(phys_ram_base, VMEMMAP_ADDR_ALIGN) >> PAGE_SHIFT;
> > +#endif
> > +
>
> Please fold this into the if-statement above, e.g.:
>   |         if (!IS_ENABLED(CONFIG_XIP_KERNEL)) {
>   |                 phys_ram_base = memblock_start_of_DRAM() & PMD_MASK;
>   | #if defined(CONFIG_SPARSEMEM_VMEMMAP)
>   |                 vmemmap_start_pfn = round_down(phys_ram_base, VMEMMAP_ADDR_ALIGN) >> PAGE_SHIFT;
>   | #endif
>   |         }
>
>
> Björn

Best Regards,

Xu Lu