linux-kernel - Re: [PATCH v3] arm64: Don't call NULL in do_compat_alignment

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <03b4456f-de06-42c6-91e0-4ea21de665ad@arm.com>
Date: Tue, 1 Apr 2025 16:46:09 +0530
From: Anshuman Khandual <anshuman.khandual@....com>
To: Angelos Oikonomopoulos <angelos@...lia.com>,
 linux-arm-kernel@...ts.infradead.org
Cc: catalin.marinas@....com, will@...nel.org, linux-kernel@...r.kernel.org,
 kernel-dev@...lia.com, stable@...r.kernel.org
Subject: Re: [PATCH v3] arm64: Don't call NULL in do_compat_alignment_fixup



On 4/1/25 14:21, Angelos Oikonomopoulos wrote:
> do_alignment_t32_to_handler only fixes up alignment faults for specific
> instructions; it returns NULL otherwise. When that's the case, signal to
> the caller that it needs to proceed with the regular alignment fault
> handling (i.e. SIGBUS). Without this patch, we get:
> 
>   Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000
>   Mem abort info:
>     ESR = 0x0000000086000006
>     EC = 0x21: IABT (current EL), IL = 32 bits
>     SET = 0, FnV = 0
>     EA = 0, S1PTW = 0
>     FSC = 0x06: level 2 translation fault
>   user pgtable: 4k pages, 48-bit VAs, pgdp=00000800164aa000
>   [0000000000000000] pgd=0800081fdbd22003, p4d=0800081fdbd22003, pud=08000815d51c6003, pmd=0000000000000000
>   Internal error: Oops: 0000000086000006 [#1] SMP
>   Modules linked in: cfg80211 rfkill xt_nat xt_tcpudp xt_conntrack nft_chain_nat xt_MASQUERADE nf_nat nf_conntrack_netlink nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 xfrm_user xfrm_algo xt_addrtype nft_compat br_netfilter veth nvme_fa>
>    libcrc32c crc32c_generic raid0 multipath linear dm_mod dax raid1 md_mod xhci_pci nvme xhci_hcd nvme_core t10_pi usbcore igb crc64_rocksoft crc64 crc_t10dif crct10dif_generic crct10dif_ce crct10dif_common usb_common i2c_algo_bit i2c>
>   CPU: 2 PID: 3932954 Comm: WPEWebProcess Not tainted 6.1.0-31-arm64 #1  Debian 6.1.128-1
>   Hardware name: GIGABYTE MP32-AR1-00/MP32-AR1-00, BIOS F18v (SCP: 1.08.20211002) 12/01/2021
>   pstate: 80400009 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
>   pc : 0x0
>   lr : do_compat_alignment_fixup+0xd8/0x3dc
>   sp : ffff80000f973dd0
>   x29: ffff80000f973dd0 x28: ffff081b42526180 x27: 0000000000000000
>   x26: 0000000000000000 x25: 0000000000000000 x24: 0000000000000000
>   x23: 0000000000000004 x22: 0000000000000000 x21: 0000000000000001
>   x20: 00000000e8551f00 x19: ffff80000f973eb0 x18: 0000000000000000
>   x17: 0000000000000000 x16: 0000000000000000 x15: 0000000000000000
>   x14: 0000000000000000 x13: 0000000000000000 x12: 0000000000000000
>   x11: 0000000000000000 x10: 0000000000000000 x9 : ffffaebc949bc488
>   x8 : 0000000000000000 x7 : 0000000000000000 x6 : 0000000000000000
>   x5 : 0000000000400000 x4 : 0000fffffffffffe x3 : 0000000000000000
>   x2 : ffff80000f973eb0 x1 : 00000000e8551f00 x0 : 0000000000000001
>   Call trace:
>    0x0
>    do_alignment_fault+0x40/0x50
>    do_mem_abort+0x4c/0xa0
>    el0_da+0x48/0xf0
>    el0t_32_sync_handler+0x110/0x140
>    el0t_32_sync+0x190/0x194
>   Code: bad PC value
>   ---[ end trace 0000000000000000 ]---
> 
> Signed-off-by: Angelos Oikonomopoulos <angelos@...lia.com>
> Fixes: 3fc24ef32d3b93 ("arm64: compat: Implement misalignment fixups for multiword loads")
> Cc: stable@...r.kernel.org

Commit message looks good and attributed commit ID in "Fixes: "
tag also checks out.

Reviewed-by: Anshuman Khandual <anshuman.khandual@....com>

> ---
>  arch/arm64/kernel/compat_alignment.c | 2 ++
>  1 file changed, 2 insertions(+)
> 
> diff --git a/arch/arm64/kernel/compat_alignment.c b/arch/arm64/kernel/compat_alignment.c
> index deff21bfa680..b68e1d328d4c 100644
> --- a/arch/arm64/kernel/compat_alignment.c
> +++ b/arch/arm64/kernel/compat_alignment.c
> @@ -368,6 +368,8 @@ int do_compat_alignment_fixup(unsigned long addr, struct pt_regs *regs)
>  		return 1;
>  	}
>  
> +	if (!handler)
> +		return 1;
>  	type = handler(addr, instr, regs);
>  
>  	if (type == TYPE_ERROR || type == TYPE_FAULT)