Message ID | 20240930030427.591560-3-koichiro.den@canonical.com |
---|---|
State | New |
Headers | show |
Series | [SRU,J,v2,1/1] ARM: 9359/1: flush: check if the folio is reserved for no-mapping addresses | expand |
On Mon, Sep 30, 2024 at 12:04:23PM +0900, Koichiro Den wrote: > From: Yongqiang Liu <liuyongqiang13@huawei.com> > > Since commit a4d5613c4dc6 ("arm: extend pfn_valid to take into account > freed memory map alignment") changes the semantics of pfn_valid() to check > presence of the memory map for a PFN. A valid page for an address which > is reserved but not mapped by the kernel[1], the system crashed during > some uio test with the following memory layout: > > node 0: [mem 0x00000000c0a00000-0x00000000cc8fffff] > node 0: [mem 0x00000000d0000000-0x00000000da1fffff] > the uio layout is:0xc0900000, 0x100000 > > the crash backtrace like: > > Unable to handle kernel paging request at virtual address bff00000 > [...] > CPU: 1 PID: 465 Comm: startapp.bin Tainted: G O 5.10.0 #1 > Hardware name: Generic DT based system > PC is at b15_flush_kern_dcache_area+0x24/0x3c > LR is at __sync_icache_dcache+0x6c/0x98 > [...] > (b15_flush_kern_dcache_area) from (__sync_icache_dcache+0x6c/0x98) > (__sync_icache_dcache) from (set_pte_at+0x28/0x54) > (set_pte_at) from (remap_pfn_range+0x1a0/0x274) > (remap_pfn_range) from (uio_mmap+0x184/0x1b8 [uio]) > (uio_mmap [uio]) from (__mmap_region+0x264/0x5f4) > (__mmap_region) from (__do_mmap_mm+0x3ec/0x440) > (__do_mmap_mm) from (do_mmap+0x50/0x58) > (do_mmap) from (vm_mmap_pgoff+0xfc/0x188) > (vm_mmap_pgoff) from (ksys_mmap_pgoff+0xac/0xc4) > (ksys_mmap_pgoff) from (ret_fast_syscall+0x0/0x5c) > Code: e0801001 e2423001 e1c00003 f57ff04f (ee070f3e) > ---[ end trace 09cf0734c3805d52 ]--- > Kernel panic - not syncing: Fatal exception > > So check if PG_reserved was set to solve this issue. > > [1]: https://lore.kernel.org/lkml/Zbtdue57RO0QScJM@linux.ibm.com/ > > Fixes: a4d5613c4dc6 ("arm: extend pfn_valid to take into account freed memory map alignment") > Suggested-by: Mike Rapoport <rppt@linux.ibm.com> > Signed-off-by: Yongqiang Liu <liuyongqiang13@huawei.com> > Signed-off-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk> > (backported from commit 0c66c6f4e21cb22220cbd8821c5c73fc157d20dc) > [koichiroden: folio_test_reserved replaced by PageReserved due to > missing commit 8b5989f33337 ("arm: implement the new page table range > API"). folio conversion is not backported in general, so notice that > even d389a4a81155 ("mm: Add folio flag manipulation functions") does > not exist in Xenial] s/Xenial/Jammy/ > CVE-2024-26947 > Signed-off-by: Koichiro Den <koichiro.den@canonical.com> > --- > arch/arm/mm/flush.c | 2 ++ > 1 file changed, 2 insertions(+) > > diff --git a/arch/arm/mm/flush.c b/arch/arm/mm/flush.c > index 7ff9feea13a6..b19ecc307ad4 100644 > --- a/arch/arm/mm/flush.c > +++ b/arch/arm/mm/flush.c > @@ -280,6 +280,8 @@ void __sync_icache_dcache(pte_t pteval) > return; > > page = pfn_to_page(pfn); > + if (PageReserved(page)) > + return; > if (cache_is_vipt_aliasing()) > mapping = page_mapping_file(page); > else > -- > 2.43.0 >
diff --git a/arch/arm/mm/flush.c b/arch/arm/mm/flush.c index 7ff9feea13a6..b19ecc307ad4 100644 --- a/arch/arm/mm/flush.c +++ b/arch/arm/mm/flush.c @@ -280,6 +280,8 @@ void __sync_icache_dcache(pte_t pteval) return; page = pfn_to_page(pfn); + if (PageReserved(page)) + return; if (cache_is_vipt_aliasing()) mapping = page_mapping_file(page); else