linux-kernel - Re: [PATCH v2 1/1] iommu/sva: Invalidate KVA range on kernel TLB flush

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <62580eab-3e68-4132-981a-84167d130d9f@intel.com>
Date: Thu, 10 Jul 2025 08:26:06 -0700
From: Dave Hansen <dave.hansen@...el.com>
To: Jason Gunthorpe <jgg@...dia.com>
Cc: Baolu Lu <baolu.lu@...ux.intel.com>, Joerg Roedel <joro@...tes.org>,
 Will Deacon <will@...nel.org>, Robin Murphy <robin.murphy@....com>,
 Kevin Tian <kevin.tian@...el.com>, Jann Horn <jannh@...gle.com>,
 Vasant Hegde <vasant.hegde@....com>, Alistair Popple <apopple@...dia.com>,
 Peter Zijlstra <peterz@...radead.org>, Uladzislau Rezki <urezki@...il.com>,
 Jean-Philippe Brucker <jean-philippe@...aro.org>,
 Andy Lutomirski <luto@...nel.org>, "Tested-by : Yi Lai" <yi1.lai@...el.com>,
 iommu@...ts.linux.dev, security@...nel.org, linux-kernel@...r.kernel.org,
 stable@...r.kernel.org
Subject: Re: [PATCH v2 1/1] iommu/sva: Invalidate KVA range on kernel TLB
 flush

On 7/10/25 06:22, Jason Gunthorpe wrote:
>> Why does this matter? We flush the CPU TLB in a bunch of different ways,
>> _especially_ when it's being done for kernel mappings. For example,
>> __flush_tlb_all() is a non-ranged kernel flush which has a completely
>> parallel implementation with flush_tlb_kernel_range(). Call sites that
>> use _it_ are unaffected by the patch here.
>>
>> Basically, if we're only worried about vmalloc/vfree freeing page
>> tables, then this patch is OK. If the problem is bigger than that, then
>> we need a more comprehensive patch.
> I think we are worried about any place that frees page tables.

The two places that come to mind are the remove_memory() code and
__change_page_attr().

The remove_memory() gunk is in arch/x86/mm/init_64.c. It has a few sites
that do flush_tlb_all(). Now that I'm looking at it, there look to be
some races between freeing page tables pages and flushing the TLB. But,
basically, if you stick to the sites in there that do flush_tlb_all()
after free_pagetable(), you should be good.

As for the __change_page_attr() code, I think the only spot you need to
hit is cpa_collapse_large_pages() and maybe the one in
__split_large_page() as well.

This is all disturbingly ad-hoc, though. The remove_memory() code needs
fixing and I'll probably go try to bring some order to the chaos in the
process of fixing it up. But that's a separate problem than this IOMMU fun.