* [PATCH] x86/mm: Fix preallocated PMD stack array
@ 2018-10-08 23:54 Kees Cook
2018-10-09 7:03 ` [tip:x86/urgent] x86/mm: Avoid VLA in pgd_alloc() tip-bot for Kees Cook
0 siblings, 1 reply; 3+ messages in thread
From: Kees Cook @ 2018-10-08 23:54 UTC (permalink / raw)
To: Ingo Molnar
Cc: Borislav Petkov, Arnd Bergmann, Andrew Morton, Andy Lutomirski,
Dave Hansen, Joerg Roedel, Linus Torvalds, Peter Zijlstra,
Thomas Gleixner, Toshi Kani, linux-kernel
While trying to remove VLAs in pgd_alloc(), a typo was made and a use
of PREALLOCATED_PMDS was replaced with the new MAX_PREALLOCATED_USER_PMDS
(note "...USER..."). Instead, we also need a new MAX_PREALLOCATED_PMDS.
This adds it and fixes the stack array size.
Without this fix, 32-bit kernels would trip the stack protector at boot:
Kernel panic - not syncing: stack-protector: Kernel stack is corrupted in: pgd_alloc+0x29e/0x2a0
CPU: 0 PID: 1 Comm: swapper/0 Tainted: G W 4.19.0-rc6+ #5
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.11.1-1 04/01/2014
Call Trace:
dump_stack+0x66/0x95
panic+0x94/0x1dd
__stack_chk_fail+0x1e/0x20
? pgd_alloc+0x29e/0x2a0
pgd_alloc+0x29e/0x2a0
mm_init.isra.60+0x1ec/0x210
mm_alloc+0x30/0x40
__do_execve_file+0x378/0x930
? __do_execve_file+0x108/0x930
? kmem_cache_alloc+0x123/0x220
do_execve+0x2c/0x30
run_init_process+0x31/0x36
? rest_init+0xb0/0xb0
try_to_run_init_process+0x11/0x33
? rest_init+0xb0/0xb0
kernel_init+0x9e/0xda
ret_from_fork+0x2e/0x38
Kernel Offset: disabled
---[ end Kernel panic - not syncing: stack-protector: Kernel stack is corrupted in: pgd_alloc+0x29e/0x2a0 ]---
Reported-by: Borislav Petkov <bp@alien8.de>
Fixes: 1be3f247c288 ("x86/mm: Avoid VLA in pgd_alloc()")
Signed-off-by: Kees Cook <keescook@chromium.org>
---
arch/x86/mm/pgtable.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
diff --git a/arch/x86/mm/pgtable.c b/arch/x86/mm/pgtable.c
index 386b43e3e0ac..59274e2c1ac4 100644
--- a/arch/x86/mm/pgtable.c
+++ b/arch/x86/mm/pgtable.c
@@ -115,6 +115,8 @@ static inline void pgd_list_del(pgd_t *pgd)
#define UNSHARED_PTRS_PER_PGD \
(SHARED_KERNEL_PMD ? KERNEL_PGD_BOUNDARY : PTRS_PER_PGD)
+#define MAX_UNSHARED_PTRS_PER_PGD \
+ max_t(size_t, KERNEL_PGD_BOUNDARY, PTRS_PER_PGD)
static void pgd_set_mm(pgd_t *pgd, struct mm_struct *mm)
@@ -181,6 +183,7 @@ static void pgd_dtor(pgd_t *pgd)
* and initialize the kernel pmds here.
*/
#define PREALLOCATED_PMDS UNSHARED_PTRS_PER_PGD
+#define MAX_PREALLOCATED_PMDS MAX_UNSHARED_PTRS_PER_PGD
/*
* We allocate separate PMDs for the kernel part of the user page-table
@@ -211,6 +214,7 @@ void pud_populate(struct mm_struct *mm, pud_t *pudp, pmd_t *pmd)
/* No need to prepopulate any pagetable entries in non-PAE modes. */
#define PREALLOCATED_PMDS 0
+#define MAX_PREALLOCATED_PMDS 0
#define PREALLOCATED_USER_PMDS 0
#define MAX_PREALLOCATED_USER_PMDS 0
#endif /* CONFIG_X86_PAE */
@@ -431,7 +435,7 @@ pgd_t *pgd_alloc(struct mm_struct *mm)
{
pgd_t *pgd;
pmd_t *u_pmds[MAX_PREALLOCATED_USER_PMDS];
- pmd_t *pmds[MAX_PREALLOCATED_USER_PMDS];
+ pmd_t *pmds[MAX_PREALLOCATED_PMDS];
pgd = _pgd_alloc();
--
2.17.1
--
Kees Cook
Pixel Security
^ permalink raw reply related [flat|nested] 3+ messages in thread
* [tip:x86/urgent] x86/mm: Avoid VLA in pgd_alloc()
2018-10-08 23:54 [PATCH] x86/mm: Fix preallocated PMD stack array Kees Cook
@ 2018-10-09 7:03 ` tip-bot for Kees Cook
2018-10-09 7:58 ` Arnd Bergmann
0 siblings, 1 reply; 3+ messages in thread
From: tip-bot for Kees Cook @ 2018-10-09 7:03 UTC (permalink / raw)
To: linux-tip-commits
Cc: peterz, luto, mingo, tglx, arnd, akpm, linux-kernel, toshi.kani,
torvalds, bp, jroedel, keescook, hpa, dave.hansen
Commit-ID: 184d47f0fd365108bd06ab26cdb3450b716269fd
Gitweb: https://git.kernel.org/tip/184d47f0fd365108bd06ab26cdb3450b716269fd
Author: Kees Cook <keescook@chromium.org>
AuthorDate: Mon, 8 Oct 2018 16:54:34 -0700
Committer: Ingo Molnar <mingo@kernel.org>
CommitDate: Tue, 9 Oct 2018 08:55:07 +0200
x86/mm: Avoid VLA in pgd_alloc()
Arnd Bergmann reported that turning on -Wvla found a new (unintended) VLA usage:
arch/x86/mm/pgtable.c: In function 'pgd_alloc':
include/linux/build_bug.h:29:45: error: ISO C90 forbids variable length array 'u_pmds' [-Werror=vla]
arch/x86/mm/pgtable.c:190:34: note: in expansion of macro 'static_cpu_has'
#define PREALLOCATED_USER_PMDS (static_cpu_has(X86_FEATURE_PTI) ? \
^~~~~~~~~~~~~~
arch/x86/mm/pgtable.c:431:16: note: in expansion of macro 'PREALLOCATED_USER_PMDS'
pmd_t *u_pmds[PREALLOCATED_USER_PMDS];
^~~~~~~~~~~~~~~~~~~~~~
Use the actual size of the array that is used for X86_FEATURE_PTI,
which is known at build time, instead of the variable size.
[ mingo: Squashed original fix with followup fix to avoid bisection breakage, wrote new changelog. ]
Reported-by: Arnd Bergmann <arnd@arndb.de>
Original-written-by: Arnd Bergmann <arnd@arndb.de>
Reported-by: Borislav Petkov <bp@alien8.de>
Signed-off-by: Kees Cook <keescook@chromium.org>
Cc: Andrew Morton <akpm@linux-foundation.org>
Cc: Andy Lutomirski <luto@kernel.org>
Cc: Arnd Bergmann <arnd@arndb.de>
Cc: Dave Hansen <dave.hansen@linux.intel.com>
Cc: Joerg Roedel <jroedel@suse.de>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Toshi Kani <toshi.kani@hpe.com>
Fixes: 1be3f247c288 ("x86/mm: Avoid VLA in pgd_alloc()")
Link: http://lkml.kernel.org/r/20181008235434.GA35035@beast
Signed-off-by: Ingo Molnar <mingo@kernel.org>
---
arch/x86/mm/pgtable.c | 10 ++++++++--
1 file changed, 8 insertions(+), 2 deletions(-)
diff --git a/arch/x86/mm/pgtable.c b/arch/x86/mm/pgtable.c
index 089e78c4effd..59274e2c1ac4 100644
--- a/arch/x86/mm/pgtable.c
+++ b/arch/x86/mm/pgtable.c
@@ -115,6 +115,8 @@ static inline void pgd_list_del(pgd_t *pgd)
#define UNSHARED_PTRS_PER_PGD \
(SHARED_KERNEL_PMD ? KERNEL_PGD_BOUNDARY : PTRS_PER_PGD)
+#define MAX_UNSHARED_PTRS_PER_PGD \
+ max_t(size_t, KERNEL_PGD_BOUNDARY, PTRS_PER_PGD)
static void pgd_set_mm(pgd_t *pgd, struct mm_struct *mm)
@@ -181,6 +183,7 @@ static void pgd_dtor(pgd_t *pgd)
* and initialize the kernel pmds here.
*/
#define PREALLOCATED_PMDS UNSHARED_PTRS_PER_PGD
+#define MAX_PREALLOCATED_PMDS MAX_UNSHARED_PTRS_PER_PGD
/*
* We allocate separate PMDs for the kernel part of the user page-table
@@ -189,6 +192,7 @@ static void pgd_dtor(pgd_t *pgd)
*/
#define PREALLOCATED_USER_PMDS (static_cpu_has(X86_FEATURE_PTI) ? \
KERNEL_PGD_PTRS : 0)
+#define MAX_PREALLOCATED_USER_PMDS KERNEL_PGD_PTRS
void pud_populate(struct mm_struct *mm, pud_t *pudp, pmd_t *pmd)
{
@@ -210,7 +214,9 @@ void pud_populate(struct mm_struct *mm, pud_t *pudp, pmd_t *pmd)
/* No need to prepopulate any pagetable entries in non-PAE modes. */
#define PREALLOCATED_PMDS 0
+#define MAX_PREALLOCATED_PMDS 0
#define PREALLOCATED_USER_PMDS 0
+#define MAX_PREALLOCATED_USER_PMDS 0
#endif /* CONFIG_X86_PAE */
static void free_pmds(struct mm_struct *mm, pmd_t *pmds[], int count)
@@ -428,8 +434,8 @@ static inline void _pgd_free(pgd_t *pgd)
pgd_t *pgd_alloc(struct mm_struct *mm)
{
pgd_t *pgd;
- pmd_t *u_pmds[PREALLOCATED_USER_PMDS];
- pmd_t *pmds[PREALLOCATED_PMDS];
+ pmd_t *u_pmds[MAX_PREALLOCATED_USER_PMDS];
+ pmd_t *pmds[MAX_PREALLOCATED_PMDS];
pgd = _pgd_alloc();
^ permalink raw reply related [flat|nested] 3+ messages in thread
* Re: [tip:x86/urgent] x86/mm: Avoid VLA in pgd_alloc()
2018-10-09 7:03 ` [tip:x86/urgent] x86/mm: Avoid VLA in pgd_alloc() tip-bot for Kees Cook
@ 2018-10-09 7:58 ` Arnd Bergmann
0 siblings, 0 replies; 3+ messages in thread
From: Arnd Bergmann @ 2018-10-09 7:58 UTC (permalink / raw)
To: Joerg Roedel, Borislav Petkov, Linus Torvalds, Toshimitsu Kani,
Dave Hansen, H. Peter Anvin, Kees Cook, Ingo Molnar,
Andy Lutomirski, Peter Zijlstra, Linux Kernel Mailing List,
Andrew Morton, Thomas Gleixner
Cc: linux-tip-commits
On Tue, Oct 9, 2018 at 9:03 AM tip-bot for Kees Cook <tipbot@zytor.com> wrote:
>
> Commit-ID: 184d47f0fd365108bd06ab26cdb3450b716269fd
> Gitweb: https://git.kernel.org/tip/184d47f0fd365108bd06ab26cdb3450b716269fd
> Author: Kees Cook <keescook@chromium.org>
> AuthorDate: Mon, 8 Oct 2018 16:54:34 -0700
> Committer: Ingo Molnar <mingo@kernel.org>
> CommitDate: Tue, 9 Oct 2018 08:55:07 +0200
>
> x86/mm: Avoid VLA in pgd_alloc()
>
> Arnd Bergmann reported that turning on -Wvla found a new (unintended) VLA usage:
>
> arch/x86/mm/pgtable.c: In function 'pgd_alloc':
> include/linux/build_bug.h:29:45: error: ISO C90 forbids variable length array 'u_pmds' [-Werror=vla]
> arch/x86/mm/pgtable.c:190:34: note: in expansion of macro 'static_cpu_has'
> #define PREALLOCATED_USER_PMDS (static_cpu_has(X86_FEATURE_PTI) ? \
> ^~~~~~~~~~~~~~
> arch/x86/mm/pgtable.c:431:16: note: in expansion of macro 'PREALLOCATED_USER_PMDS'
> pmd_t *u_pmds[PREALLOCATED_USER_PMDS];
> ^~~~~~~~~~~~~~~~~~~~~~
>
> Use the actual size of the array that is used for X86_FEATURE_PTI,
> which is known at build time, instead of the variable size.
>
> [ mingo: Squashed original fix with followup fix to avoid bisection breakage, wrote new changelog. ]
>
> Reported-by: Arnd Bergmann <arnd@arndb.de>
> Original-written-by: Arnd Bergmann <arnd@arndb.de>
> Reported-by: Borislav Petkov <bp@alien8.de>
> Signed-off-by: Kees Cook <keescook@chromium.org>
Thanks for fixing up my incorrect fix, looks correct to me now.
Arnd
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2018-10-09 7:58 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2018-10-08 23:54 [PATCH] x86/mm: Fix preallocated PMD stack array Kees Cook
2018-10-09 7:03 ` [tip:x86/urgent] x86/mm: Avoid VLA in pgd_alloc() tip-bot for Kees Cook
2018-10-09 7:58 ` Arnd Bergmann
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox