linux-kernel - Re: [PATCH v3] arm64: Don't call NULL in do_compat_alignment

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-Id: <174351444424.198539.17675821891390639702.b4-ty@arm.com>
Date: Tue,  1 Apr 2025 14:34:18 +0100
From: Catalin Marinas <catalin.marinas@....com>
To: linux-arm-kernel@...ts.infradead.org,
	Angelos Oikonomopoulos <angelos@...lia.com>
Cc: Will Deacon <will@...nel.org>,
	linux-kernel@...r.kernel.org,
	kernel-dev@...lia.com,
	anshuman.khandual@....com,
	stable@...r.kernel.org
Subject: Re: [PATCH v3] arm64: Don't call NULL in do_compat_alignment_fixup

On Tue, 01 Apr 2025 10:51:50 +0200, Angelos Oikonomopoulos wrote:
> do_alignment_t32_to_handler only fixes up alignment faults for specific
> instructions; it returns NULL otherwise. When that's the case, signal to
> the caller that it needs to proceed with the regular alignment fault
> handling (i.e. SIGBUS). Without this patch, we get:
> 
>   Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000
>   Mem abort info:
>     ESR = 0x0000000086000006
>     EC = 0x21: IABT (current EL), IL = 32 bits
>     SET = 0, FnV = 0
>     EA = 0, S1PTW = 0
>     FSC = 0x06: level 2 translation fault
>   user pgtable: 4k pages, 48-bit VAs, pgdp=00000800164aa000
>   [0000000000000000] pgd=0800081fdbd22003, p4d=0800081fdbd22003, pud=08000815d51c6003, pmd=0000000000000000
>   Internal error: Oops: 0000000086000006 [#1] SMP
>   Modules linked in: cfg80211 rfkill xt_nat xt_tcpudp xt_conntrack nft_chain_nat xt_MASQUERADE nf_nat nf_conntrack_netlink nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 xfrm_user xfrm_algo xt_addrtype nft_compat br_netfilter veth nvme_fa>
>    libcrc32c crc32c_generic raid0 multipath linear dm_mod dax raid1 md_mod xhci_pci nvme xhci_hcd nvme_core t10_pi usbcore igb crc64_rocksoft crc64 crc_t10dif crct10dif_generic crct10dif_ce crct10dif_common usb_common i2c_algo_bit i2c>
>   CPU: 2 PID: 3932954 Comm: WPEWebProcess Not tainted 6.1.0-31-arm64 #1  Debian 6.1.128-1
>   Hardware name: GIGABYTE MP32-AR1-00/MP32-AR1-00, BIOS F18v (SCP: 1.08.20211002) 12/01/2021
>   pstate: 80400009 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
>   pc : 0x0
>   lr : do_compat_alignment_fixup+0xd8/0x3dc
>   sp : ffff80000f973dd0
>   x29: ffff80000f973dd0 x28: ffff081b42526180 x27: 0000000000000000
>   x26: 0000000000000000 x25: 0000000000000000 x24: 0000000000000000
>   x23: 0000000000000004 x22: 0000000000000000 x21: 0000000000000001
>   x20: 00000000e8551f00 x19: ffff80000f973eb0 x18: 0000000000000000
>   x17: 0000000000000000 x16: 0000000000000000 x15: 0000000000000000
>   x14: 0000000000000000 x13: 0000000000000000 x12: 0000000000000000
>   x11: 0000000000000000 x10: 0000000000000000 x9 : ffffaebc949bc488
>   x8 : 0000000000000000 x7 : 0000000000000000 x6 : 0000000000000000
>   x5 : 0000000000400000 x4 : 0000fffffffffffe x3 : 0000000000000000
>   x2 : ffff80000f973eb0 x1 : 00000000e8551f00 x0 : 0000000000000001
>   Call trace:
>    0x0
>    do_alignment_fault+0x40/0x50
>    do_mem_abort+0x4c/0xa0
>    el0_da+0x48/0xf0
>    el0t_32_sync_handler+0x110/0x140
>    el0t_32_sync+0x190/0x194
>   Code: bad PC value
>   ---[ end trace 0000000000000000 ]---
> 
> [...]

Applied to arm64 (for-next/core), thanks!

[1/1] arm64: Don't call NULL in do_compat_alignment_fixup
      https://git.kernel.org/arm64/c/c28f31deeacd

-- 
Catalin