From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.133]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id A3FD0C4345F for ; Thu, 18 Apr 2024 11:12:54 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20210309; h=Sender: Content-Transfer-Encoding:Content-Type:List-Subscribe:List-Help:List-Post: List-Archive:List-Unsubscribe:List-Id:MIME-Version:References:In-Reply-To: Message-ID:Subject:Cc:To:From:Date:Reply-To:Content-ID:Content-Description: Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID: List-Owner; bh=U/UPBXBBhBejWN2Kabo3jcfJ2n+DxxJrKs2hyuDgPRU=; b=PgKOOM4EjvzlLr etzWxqPC/mLWdvpLeJOjW58pvfiC+pUZy52HvByAqxsaecSZwhGgTLkIwT9sRYYXdPJf2WiSzvfA0 Kbh1NEmWKo8kMo2alw1Bn1+lDrB8QOhFmLmcFHIi2PjVSHh45NLDpEzZtq6b6sNmJGhL8Ti6Y6G8i uPTw5EtmoSDzCG86gDz3+cE2bOIsGGSiwDFzIQ7/gj+aLQCoa2ZXpCyCxm1HvmzRUpVVuOZOoGtDM MCt7yQKPRp/10aB9x8i+XekPZMzig7qojQ0Y2ucxFIFcq5ele3GIIR+Ebr59Fyoqq9Ir0NykZaX2u 8lngcxYRw7XeS9y3mcyQ==; Received: from localhost ([::1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.97.1 #2 (Red Hat Linux)) id 1rxPhB-00000001xRl-45RJ; Thu, 18 Apr 2024 11:12:49 +0000 Received: from galois.linutronix.de ([2a0a:51c0:0:12e:550::1]) by bombadil.infradead.org with esmtps (Exim 4.97.1 #2 (Red Hat Linux)) id 1rxPh5-00000001xPd-3add for linux-riscv@lists.infradead.org; Thu, 18 Apr 2024 11:12:47 +0000 Date: Thu, 18 Apr 2024 13:12:38 +0200 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linutronix.de; s=2020; t=1713438759; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=nCv9ASSWxGZcIN7EnwuxCIn0p9FkfWST0gNno06amaQ=; b=l6a+QUypxbl9h555q2yiw/t94zDEElznKUzGxGLAY/rHnR02Y/nSIP4bBAiuhDhJDVZUK5 H7Np4stZZGUcBsoAjV4oysMkigqHK4i2tspfqn9A4bR1K54JUR9lxe+/RIfaJu3RwmVrS2 7P6Bte7YnLDphUF1DtMd4oS3ccYZQTcjjXSic9zRlTt1gNqwO0q7KsZlY6/+E1Vvk50bHR GUeCDi7Nnkfzr4+5dYFOKNdrVCpxFh9lpbZfAKlZEmX7qQVbNeNAqfpugKtYCEAKNEJ470 ZLMjEUwZ8XEQj7TEjffWRS5wc/xE8vPB+Xl+nB1Hd5iemqeNli8Bkz5+N+3Hrw== DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/relaxed; d=linutronix.de; s=2020e; t=1713438759; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=nCv9ASSWxGZcIN7EnwuxCIn0p9FkfWST0gNno06amaQ=; b=ODGVWrPhBwMPbqT0n48i9td51IgqEIAiB+5frU9luBafGaLa8VPMmXOcF4TATtx3YH0bzt ghlP4tJrhhPeHEBA== From: Nam Cao To: Mike Rapoport , Andreas Dilger , =?UTF-8?B?QmrDtnJuIFTDtnBlbA==?= , linux-riscv@lists.infradead.org, Thomas Gleixner , Andrew Morton , "ndesaulniers @ google . com" , Luis Chamberlain , Ingo Molnar , Christophe Leroy , Tejun Heo , Krister Johansen , Changbin Du , Arnd Bergmann , Geert Uytterhoeven , linux-kernel@vger.kernel.org Cc: stable@vger.kernel.org Subject: Re: [PATCH] init: fix allocated page overlapping with PTR_ERR Message-ID: <20240418131238.636bee2c@namcao> In-Reply-To: <20240418102943.180510-1-namcao@linutronix.de> References: <20240418102943.180510-1-namcao@linutronix.de> MIME-Version: 1.0 X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20240418_041244_062929_8E390175 X-CRM114-Status: GOOD ( 21.66 ) X-BeenThere: linux-riscv@lists.infradead.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 Sender: "linux-riscv" Errors-To: linux-riscv-bounces+linux-riscv=archiver.kernel.org@lists.infradead.org T24gMjAyNC0wNC0xOCBOYW0gQ2FvIHdyb3RlOgo+IFRoZXJlIGlzIG5vdGhpbmcgcHJldmVudGlu ZyBrZXJuZWwgbWVtb3J5IGFsbG9jYXRvcnMgZnJvbSBhbGxvY2F0aW5nIGEKPiBwYWdlIHRoYXQg b3ZlcmxhcHMgd2l0aCBQVFJfRVJSKCksIGV4Y2VwdCBmb3IgYXJjaGl0ZWN0dXJlLXNwZWNpZmlj Cj4gY29kZSB0aGF0IHNldHVwIG1lbWJsb2NrLgo+IAo+IEl0IHdhcyBkaXNjb3ZlcmVkIHRoYXQg UklTQ1YgYXJjaGl0ZWN0dXJlIGRvZXNuJ3Qgc2V0dXAgbWVtYmxvY2sKPiBjb3JlY3RseSwgbGVh ZGluZyB0byBhIHBhZ2Ugb3ZlcmxhcHBpbmcgd2l0aCBQVFJfRVJSKCkgYmVpbmcgYWxsb2NhdGVk LAo+IGFuZCBzdWJzZXF1ZW50bHkgY3Jhc2hpbmcgdGhlIGtlcm5lbCAobGluayBpbiBDbG9zZTog KQo+IAo+IFRoZSByZXBvcnRlZCBjcmFzaCBoYXMgbm90aGluZyB0byBkbyB3aXRoIFBUUl9FUlIo KTogdGhlIGxhc3QgcGFnZQo+IChhdCBhZGRyZXNzIDB4ZmZmZmYwMDApIGJlaW5nIGFsbG9jYXRl ZCBsZWFkcyB0byBhbiB1bmV4cGVjdGVkCj4gYXJpdGhtZXRpYyBvdmVyZmxvdyBpbiBleHQ0OyBi dXQgc3RpbGwsIHRoaXMgcGFnZSBzaG91bGRuJ3QgYmUKPiBhbGxvY2F0ZWQgaW4gdGhlIGZpcnN0 IHBsYWNlLgo+IAo+IEJlY2F1c2UgUFRSX0VSUigpIGlzIGFuIGFyY2hpdGVjdHVyZS1pbmRlcGVu ZGVudCB0aGluZywgd2Ugc2hvdWxkbid0Cj4gYXNrIGV2ZXJ5IHNpbmdsZSBhcmNoaXRlY3R1cmUg dG8gc2V0IHRoaXMgdXAuIFRoZXJlIG1heSBiZSBvdGhlcgo+IGFyY2hpdGVjdHVyZXMgYmVzaWRl IFJJU0NWIHRoYXQgaGF2ZSB0aGUgc2FtZSBwcm9ibGVtLgo+IAo+IEZpeCB0aGlzIG9uZSBhbmQg Zm9yIGFsbCBieSByZXNlcnZpbmcgdGhlIHBoeXNpY2FsIG1lbW9yeSBwYWdlIHRoYXQKPiBtYXkg YmUgbWFwcGVkIHRvIHRoZSBsYXN0IHZpcnR1YWwgbWVtb3J5IHBhZ2UgYXMgcGFydCBvZiBsb3cg bWVtb3J5Lgo+IAo+IFVuZm9ydHVuYXRlbHksIHRoaXMgbWVhbnMgaWYgdGhlcmUgaXMgYWN0dWFs IG1lbW9yeSBhdCB0aGlzIHJlc2VydmVkCj4gbG9jYXRpb24sIHRoYXQgbWVtb3J5IHdpbGwgYmVj b21lIGluYWNjZXNzaWJsZS4gSG93ZXZlciwgaWYgdGhpcyBwYWdlCj4gaXMgbm90IHJlc2VydmVk LCBpdCBjYW4gb25seSBiZSBhY2Nlc3NlZCBhcyBoaWdoIG1lbW9yeSwgc28gdGhpcwo+IGRvZXNu J3QgbWF0dGVyIGlmIGhpZ2ggbWVtb3J5IGlzIG5vdCBzdXBwb3J0ZWQuIEV2ZW4gaWYgaGlnaCBt ZW1vcnkgaXMKPiBzdXBwb3J0ZWQsIGl0IGlzIHN0aWxsIG9ubHkgb25lIHBhZ2UuCj4gCj4gQ2xv c2VzOiBodHRwczovL2xvcmUua2VybmVsLm9yZy9saW51eC1yaXNjdi84NzhyMWlicGRuLmZzZkBh bGwueW91ci5iYXNlLmFyZS5iZWxvbmcudG8udXMKPiBTaWduZWQtb2ZmLWJ5OiBOYW0gQ2FvIDxu YW1jYW9AbGludXRyb25peC5kZT4KPiBDYzogPHN0YWJsZUB2Z2VyLmtlcm5lbC5vcmc+ICMgYWxs IHZlcnNpb25zCgpTb3JyeSwgZm9yZ290IHRvIGFkZDoKUmVwb3J0ZWQtYnk6IEJqw7ZybiBUw7Zw ZWwgPGJqb3JuQGtlcm5lbC5vcmc+Cgo+IC0tLQo+ICBpbml0L21haW4uYyB8IDEgKwo+ICAxIGZp bGUgY2hhbmdlZCwgMSBpbnNlcnRpb24oKykKPiAKPiBkaWZmIC0tZ2l0IGEvaW5pdC9tYWluLmMg Yi9pbml0L21haW4uYwo+IGluZGV4IDg4MWY2MjMwZWU1OS4uZjhkMjc5M2M0NjQxIDEwMDY0NAo+ IC0tLSBhL2luaXQvbWFpbi5jCj4gKysrIGIvaW5pdC9tYWluLmMKPiBAQCAtOTAwLDYgKzkwMCw3 IEBAIHZvaWQgc3RhcnRfa2VybmVsKHZvaWQpCj4gIAlwYWdlX2FkZHJlc3NfaW5pdCgpOwo+ICAJ cHJfbm90aWNlKCIlcyIsIGxpbnV4X2Jhbm5lcik7Cj4gIAllYXJseV9zZWN1cml0eV9pbml0KCk7 Cj4gKwltZW1ibG9ja19yZXNlcnZlKF9fcGEoLVBBR0VfU0laRSksIFBBR0VfU0laRSk7IC8qIHJl c2VydmUgbGFzdCBwYWdlIGZvciBFUlJfUFRSICovCj4gIAlzZXR1cF9hcmNoKCZjb21tYW5kX2xp bmUpOwo+ICAJc2V0dXBfYm9vdF9jb25maWcoKTsKPiAgCXNldHVwX2NvbW1hbmRfbGluZShjb21t YW5kX2xpbmUpOwoKCl9fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fCmxpbnV4LXJpc2N2IG1haWxpbmcgbGlzdApsaW51eC1yaXNjdkBsaXN0cy5pbmZyYWRlYWQu b3JnCmh0dHA6Ly9saXN0cy5pbmZyYWRlYWQub3JnL21haWxtYW4vbGlzdGluZm8vbGludXgtcmlz Y3YK From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from galois.linutronix.de (Galois.linutronix.de [193.142.43.55]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id E6F6615D5A8; Thu, 18 Apr 2024 11:12:40 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=193.142.43.55 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1713438763; cv=none; b=qKPBrcxTL6Ffntnp+F2FjHuXq0UUIvHww4BebUagiE8fDi7VbTuemO28Iw4mR8+psBOwV4J39+rBRZ+OpPqmSRCykbdFpiIUWMHvSRLiQcpX/cz8F772oi1BPVCPOmUIZQZWVJWqBX0kjJ2znaEhGAU0qBDEU2nKGu/tpbpWFBs= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1713438763; c=relaxed/simple; bh=fNlxzM+FeEWS046ooaGKqIMrCq4ZXCHkyzA7h0Mb/9U=; h=Date:From:To:Cc:Subject:Message-ID:In-Reply-To:References: MIME-Version:Content-Type; b=cEhhiNxkkQPQzkpNTmJeLuMAaa41xe6/iZpfEKOAHB7ThmCvacHPKi6uJeiri+D6mnlWjt2fknoPuYPMHE9kL4LaqBLO+rZjaIKlyk47R6Mq4/oU8NpKA+K0XWWIlM+UzXrAtoBCmHgQchaPxiODrN7de/syydPgS3zqvuswjwg= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linutronix.de; spf=pass smtp.mailfrom=linutronix.de; dkim=pass (2048-bit key) header.d=linutronix.de header.i=@linutronix.de header.b=l6a+QUyp; dkim=permerror (0-bit key) header.d=linutronix.de header.i=@linutronix.de header.b=ODGVWrPh; arc=none smtp.client-ip=193.142.43.55 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linutronix.de Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linutronix.de Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=linutronix.de header.i=@linutronix.de header.b="l6a+QUyp"; dkim=permerror (0-bit key) header.d=linutronix.de header.i=@linutronix.de header.b="ODGVWrPh" Date: Thu, 18 Apr 2024 13:12:38 +0200 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linutronix.de; s=2020; t=1713438759; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=nCv9ASSWxGZcIN7EnwuxCIn0p9FkfWST0gNno06amaQ=; b=l6a+QUypxbl9h555q2yiw/t94zDEElznKUzGxGLAY/rHnR02Y/nSIP4bBAiuhDhJDVZUK5 H7Np4stZZGUcBsoAjV4oysMkigqHK4i2tspfqn9A4bR1K54JUR9lxe+/RIfaJu3RwmVrS2 7P6Bte7YnLDphUF1DtMd4oS3ccYZQTcjjXSic9zRlTt1gNqwO0q7KsZlY6/+E1Vvk50bHR GUeCDi7Nnkfzr4+5dYFOKNdrVCpxFh9lpbZfAKlZEmX7qQVbNeNAqfpugKtYCEAKNEJ470 ZLMjEUwZ8XEQj7TEjffWRS5wc/xE8vPB+Xl+nB1Hd5iemqeNli8Bkz5+N+3Hrw== DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/relaxed; d=linutronix.de; s=2020e; t=1713438759; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=nCv9ASSWxGZcIN7EnwuxCIn0p9FkfWST0gNno06amaQ=; b=ODGVWrPhBwMPbqT0n48i9td51IgqEIAiB+5frU9luBafGaLa8VPMmXOcF4TATtx3YH0bzt ghlP4tJrhhPeHEBA== From: Nam Cao To: Mike Rapoport , Andreas Dilger , =?UTF-8?B?QmrDtnJuIFTDtnBlbA==?= , linux-riscv@lists.infradead.org, Thomas Gleixner , Andrew Morton , "ndesaulniers @ google . com" , Luis Chamberlain , Ingo Molnar , Christophe Leroy , Tejun Heo , Krister Johansen , Changbin Du , Arnd Bergmann , Geert Uytterhoeven , linux-kernel@vger.kernel.org Cc: stable@vger.kernel.org Subject: Re: [PATCH] init: fix allocated page overlapping with PTR_ERR Message-ID: <20240418131238.636bee2c@namcao> In-Reply-To: <20240418102943.180510-1-namcao@linutronix.de> References: <20240418102943.180510-1-namcao@linutronix.de> Precedence: bulk X-Mailing-List: stable@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable On 2024-04-18 Nam Cao wrote: > There is nothing preventing kernel memory allocators from allocating a > page that overlaps with PTR_ERR(), except for architecture-specific > code that setup memblock. >=20 > It was discovered that RISCV architecture doesn't setup memblock > corectly, leading to a page overlapping with PTR_ERR() being allocated, > and subsequently crashing the kernel (link in Close: ) >=20 > The reported crash has nothing to do with PTR_ERR(): the last page > (at address 0xfffff000) being allocated leads to an unexpected > arithmetic overflow in ext4; but still, this page shouldn't be > allocated in the first place. >=20 > Because PTR_ERR() is an architecture-independent thing, we shouldn't > ask every single architecture to set this up. There may be other > architectures beside RISCV that have the same problem. >=20 > Fix this one and for all by reserving the physical memory page that > may be mapped to the last virtual memory page as part of low memory. >=20 > Unfortunately, this means if there is actual memory at this reserved > location, that memory will become inaccessible. However, if this page > is not reserved, it can only be accessed as high memory, so this > doesn't matter if high memory is not supported. Even if high memory is > supported, it is still only one page. >=20 > Closes: https://lore.kernel.org/linux-riscv/878r1ibpdn.fsf@all.your.base.= are.belong.to.us > Signed-off-by: Nam Cao > Cc: # all versions Sorry, forgot to add: Reported-by: Bj=C3=B6rn T=C3=B6pel > --- > init/main.c | 1 + > 1 file changed, 1 insertion(+) >=20 > diff --git a/init/main.c b/init/main.c > index 881f6230ee59..f8d2793c4641 100644 > --- a/init/main.c > +++ b/init/main.c > @@ -900,6 +900,7 @@ void start_kernel(void) > page_address_init(); > pr_notice("%s", linux_banner); > early_security_init(); > + memblock_reserve(__pa(-PAGE_SIZE), PAGE_SIZE); /* reserve last page for= ERR_PTR */ > setup_arch(&command_line); > setup_boot_config(); > setup_command_line(command_line);