From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail-pf1-f198.google.com (mail-pf1-f198.google.com [209.85.210.198]) by kanga.kvack.org (Postfix) with ESMTP id 4D19A6B626E for ; Sun, 2 Sep 2018 09:14:45 -0400 (EDT) Received: by mail-pf1-f198.google.com with SMTP id o27-v6so9653601pfj.6 for ; Sun, 02 Sep 2018 06:14:45 -0700 (PDT) Received: from NAM03-CO1-obe.outbound.protection.outlook.com (mail-co1nam03on0134.outbound.protection.outlook.com. [104.47.40.134]) by mx.google.com with ESMTPS id r39-v6si15068432pld.218.2018.09.02.06.14.43 for (version=TLS1_2 cipher=ECDHE-RSA-AES128-SHA bits=128/128); Sun, 02 Sep 2018 06:14:44 -0700 (PDT) From: Sasha Levin Subject: [PATCH AUTOSEL 4.9 28/62] x86/kexec: Allocate 8k PGDs for PTI Date: Sun, 2 Sep 2018 13:14:39 +0000 Message-ID: <20180902131411.183978-18-alexander.levin@microsoft.com> References: <20180902131411.183978-1-alexander.levin@microsoft.com> In-Reply-To: <20180902131411.183978-1-alexander.levin@microsoft.com> Content-Language: en-US Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Sender: owner-linux-mm@kvack.org List-ID: To: "stable@vger.kernel.org" , "linux-kernel@vger.kernel.org" Cc: Joerg Roedel , Thomas Gleixner , "H . Peter Anvin" , "linux-mm@kvack.org" , Linus Torvalds , Andy Lutomirski , Dave Hansen , Josh Poimboeuf , Juergen Gross , Peter Zijlstra , Borislav Petkov , Jiri Kosina , Boris Ostrovsky , Brian Gerst , David Laight , Denys Vlasenko , Eduardo Valentin , Greg KH , Will Deacon , "aliguori@amazon.com" , Daniel Gruss , "hughd@google.com" , "keescook@google.com" , Andrea Arcangeli , Waiman Long , Pavel Machek , Arnaldo Carvalho de Melo , Alexander Shishkin , Jiri Olsa , Namhyung Kim , "joro@8bytes.org" , Sasha Levin From: Joerg Roedel [ Upstream commit ca38dc8f2724d101038b1205122c93a1c7f38f11 ] Fuzzing the PTI-x86-32 code with trinity showed unhandled kernel paging request oops-messages that looked a lot like silent data corruption. Lot's of debugging and testing lead to the kexec-32bit code, which is still allocating 4k PGDs when PTI is enabled. But since it uses native_set_pud() to build the page-table, it will unevitably call into __pti_set_user_pgtbl(), which writes beyond the allocated 4k page. Use PGD_ALLOCATION_ORDER to allocate PGDs in the kexec code to fix the issue. Signed-off-by: Joerg Roedel Signed-off-by: Thomas Gleixner Tested-by: David H. Gutteridge Cc: "H . Peter Anvin" Cc: linux-mm@kvack.org Cc: Linus Torvalds Cc: Andy Lutomirski Cc: Dave Hansen Cc: Josh Poimboeuf Cc: Juergen Gross Cc: Peter Zijlstra Cc: Borislav Petkov Cc: Jiri Kosina Cc: Boris Ostrovsky Cc: Brian Gerst Cc: David Laight Cc: Denys Vlasenko Cc: Eduardo Valentin Cc: Greg KH Cc: Will Deacon Cc: aliguori@amazon.com Cc: daniel.gruss@iaik.tugraz.at Cc: hughd@google.com Cc: keescook@google.com Cc: Andrea Arcangeli Cc: Waiman Long Cc: Pavel Machek Cc: Arnaldo Carvalho de Melo Cc: Alexander Shishkin Cc: Jiri Olsa Cc: Namhyung Kim Cc: joro@8bytes.org Link: https://lkml.kernel.org/r/1532533683-5988-4-git-send-email-joro@8byte= s.org Signed-off-by: Sasha Levin --- arch/x86/kernel/machine_kexec_32.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/arch/x86/kernel/machine_kexec_32.c b/arch/x86/kernel/machine_k= exec_32.c index fd7e9937ddd6..e9359272c5cb 100644 --- a/arch/x86/kernel/machine_kexec_32.c +++ b/arch/x86/kernel/machine_kexec_32.c @@ -70,7 +70,7 @@ static void load_segments(void) =20 static void machine_kexec_free_page_tables(struct kimage *image) { - free_page((unsigned long)image->arch.pgd); + free_pages((unsigned long)image->arch.pgd, PGD_ALLOCATION_ORDER); image->arch.pgd =3D NULL; #ifdef CONFIG_X86_PAE free_page((unsigned long)image->arch.pmd0); @@ -86,7 +86,8 @@ static void machine_kexec_free_page_tables(struct kimage = *image) =20 static int machine_kexec_alloc_page_tables(struct kimage *image) { - image->arch.pgd =3D (pgd_t *)get_zeroed_page(GFP_KERNEL); + image->arch.pgd =3D (pgd_t *)__get_free_pages(GFP_KERNEL | __GFP_ZERO, + PGD_ALLOCATION_ORDER); #ifdef CONFIG_X86_PAE image->arch.pmd0 =3D (pmd_t *)get_zeroed_page(GFP_KERNEL); image->arch.pmd1 =3D (pmd_t *)get_zeroed_page(GFP_KERNEL); --=20 2.17.1