linux-kernel - Re: [PATCH] arm64/ptdump: Ensure memory hotplug is prevented during ptdump_check

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <5c22c792-0648-4ced-b0ed-86882610b4be@arm.com>
Date: Fri, 13 Jun 2025 10:39:02 +0530
From: Anshuman Khandual <anshuman.khandual@....com>
To: Will Deacon <will@...nel.org>
Cc: linux-arm-kernel@...ts.infradead.org, stable@...r.kernel.org,
 Catalin Marinas <catalin.marinas@....com>,
 Ryan Roberts <ryan.roberts@....com>, linux-kernel@...r.kernel.org,
 Dev Jain <dev.jain@....com>
Subject: Re: [PATCH] arm64/ptdump: Ensure memory hotplug is prevented during
 ptdump_check_wx()



On 12/06/25 8:28 PM, Will Deacon wrote:
> On Mon, Jun 09, 2025 at 05:12:14AM +0100, Anshuman Khandual wrote:
>> The arm64 page table dump code can race with concurrent modification of the
>> kernel page tables. When a leaf entries are modified concurrently, the dump
>> code may log stale or inconsistent information for a VA range, but this is
>> otherwise not harmful.
>>
>> When intermediate levels of table are freed, the dump code will continue to
>> use memory which has been freed and potentially reallocated for another
>> purpose. In such cases, the dump code may dereference bogus addresses,
>> leading to a number of potential problems.
>>
>> This problem was fixed for ptdump_show() earlier via commit 'bf2b59f60ee1
>> ("arm64/mm: Hold memory hotplug lock while walking for kernel page table
>> dump")' but a same was missed for ptdump_check_wx() which faced the race
>> condition as well. Let's just take the memory hotplug lock while executing
>> ptdump_check_wx().
> 
> How do other architectures (e.g. x86) handle this? I don't see any usage
> of {get,put}_online_mems() over there. Should this be moved into the core
> code?

Memory hot remove on arm64 unmaps kernel linear and vmemmap mapping while
also freeing page table pages if those become empty. Although this might
not be true for all other architectures, which might just unmap affected
kernel regions but does not tear down the kernel page table.