Re: [PATCH RFC v10 21/22] arm64: mm: Map kernel image alias of init_pg_dir read-only

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential
issue to consider:
- [High] arm64: mm: init_pg_dir split in map_kernel() overflows
  INIT_DIR_SIZE
--

commit 3e7fce4327f018b992b775d63738a09b4b86a015
Author: Kevin Brodsky <kevin.brodsky@arm.com>

arm64: mm: Map kernel image alias of init_pg_dir read-only

This commit splits the early mapping of [init_pg_dir, init_pg_end) from
[_data, _end) in map_kernel() and remaps the kernel image alias of
init_pg_dir read-only in mark_rodata_ro().

[ ... ]

> diff --git a/arch/arm64/kernel/pi/map_kernel.c b/arch/arm64/kernel/pi/map_kernel.c
> index fb44cbdd2f292..81ca3e98f0f7b 100644
> --- a/arch/arm64/kernel/pi/map_kernel.c
> +++ b/arch/arm64/kernel/pi/map_kernel.c
> @@ -92,8 +92,13 @@ static void __init map_kernel(u64 kaslr_offset, u64 va_offset, int root_level)
>  		    __inittext_end, prot, false, root_level);
>  	map_segment(init_pg_dir, &pgdp, va_offset, __initdata_begin,
>  		    __initdata_end, data_prot, false, root_level);
> -	map_segment(init_pg_dir, &pgdp, va_offset, _data, _end, data_prot,
> -		    true, root_level);
> +	map_segment(init_pg_dir, &pgdp, va_offset, _data, init_pg_dir,
> +		    data_prot, true, root_level);
> +	/* Map init_pg_dir separately as we will remap it read-only later on */
> +	map_segment(init_pg_dir, &pgdp, va_offset, init_pg_dir, init_pg_end,
> +		    data_prot, true, root_level);
> +	map_segment(init_pg_dir, &pgdp, va_offset, init_pg_end, _end,
> +		    data_prot, true, root_level);
>  	dsb(ishst);
>  
>  	idmap_cpu_replace_ttbr1((phys_addr_t)init_pg_dir);

[Severity: High]
Can splitting [_data, _end) at init_pg_dir and init_pg_end cause pgdp to
overflow INIT_DIR_SIZE on CONFIG_ARM64_4K_PAGES kernels?

With 4K pages, map_range() uses 2MB PMD block mappings where possible and
allocates a PTE table from pgdp whenever a segment boundary falls inside a
2MB block.  EARLY_SEGMENT_EXTRA_PAGES only reserves PTE tables for
KERNEL_SEGMENT_COUNT plus the [_text, _stext) split added in
4d8e74ad4585 ("arm64: Reserve an extra page for early kernel mapping"):

arch/arm64/include/asm/kernel-pgtable.h:
/*
 * KERNEL_SEGMENT_COUNT counts the permanent kernel VMAs. The early mapping
 * has one additional split, [_text, _stext). Reserve one more page for the
 * SWAPPER_BLOCK_SIZE-unaligned boundaries.
 */
#define EARLY_SEGMENT_EXTRA_PAGES (KERNEL_SEGMENT_COUNT + 2)

When _data lies in an earlier 2MB block and a 2MB boundary falls between
init_pg_dir and _end, splitting [init_pg_dir, init_pg_end) out of
[_data, _end) forces map_range() to allocate an extra PTE table for the
2MB block containing init_pg_dir.  That advances pgdp past __pi_init_pg_end
into the adjacent early_init_stack page, corrupting the active early boot
stack and placing the new PTE table outside the [__pi_init_pg_dir,
__pi_init_pg_end) range that mark_rodata_ro() remaps read-only.

EARLY_SEGMENT_EXTRA_PAGES should be increased to account for the extra
split.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261109-kpkeys-v10-0-aa6c4d9603bc@arm.com?part=21