| Message ID | 20240930031016.592223-1-koichiro.den@canonical.com |
|---|---|
| Headers | show |
| Series | CVE-2024-26947 | expand |
Acked-by: Guoqing Jiang <guoqing.jiang@canonical.com> On 9/30/24 11:10, Koichiro Den wrote: > [Impact] > > ARM: 9359/1: flush: check if the folio is reserved for no-mapping addresses > > Since commit a4d5613c4dc6 ("arm: extend pfn_valid to take into account > freed memory map alignment") changes the semantics of pfn_valid() to check > presence of the memory map for a PFN. A valid page for an address which > is reserved but not mapped by the kernel[1], the system crashed during > some uio test with the following memory layout: > > node 0: [mem 0x00000000c0a00000-0x00000000cc8fffff] > node 0: [mem 0x00000000d0000000-0x00000000da1fffff] > the uio layout is：0xc0900000, 0x100000 > > the crash backtrace like: > > Unable to handle kernel paging request at virtual address bff00000 > [...] > CPU: 1 PID: 465 Comm: startapp.bin Tainted: G O 5.10.0 #1 > Hardware name: Generic DT based system > PC is at b15_flush_kern_dcache_area+0x24/0x3c > LR is at __sync_icache_dcache+0x6c/0x98 > [...] > (b15_flush_kern_dcache_area) from (__sync_icache_dcache+0x6c/0x98) > (__sync_icache_dcache) from (set_pte_at+0x28/0x54) > (set_pte_at) from (remap_pfn_range+0x1a0/0x274) > (remap_pfn_range) from (uio_mmap+0x184/0x1b8 [uio]) > (uio_mmap [uio]) from (__mmap_region+0x264/0x5f4) > (__mmap_region) from (__do_mmap_mm+0x3ec/0x440) > (__do_mmap_mm) from (do_mmap+0x50/0x58) > (do_mmap) from (vm_mmap_pgoff+0xfc/0x188) > (vm_mmap_pgoff) from (ksys_mmap_pgoff+0xac/0xc4) > (ksys_mmap_pgoff) from (ret_fast_syscall+0x0/0x5c) > Code: e0801001 e2423001 e1c00003 f57ff04f (ee070f3e) > ---[ end trace 09cf0734c3805d52 ]--- > Kernel panic - not syncing: Fatal exception > > So check if PG_reserved was set to solve this issue. > > [1]: https://lore.kernel.org/lkml/Zbtdue57RO0QScJM@linux.ibm.com/ > > [Backport] > > Adjusted context due to missing commits: > - 8b5989f33337 ("arm: implement the new page table range API") > - d389a4a81155 ("mm: Add folio flag manipulation functions")] > > without merging them to avoid unnecessary changes to the code base. > > [Fix] > > Noble: fixed via stable > Jammy: Backport - adjusted contexts, see [Backport] > Focal: Backport - adjusted contexts, see [Backport] > Bionic: not affected > Xenial: not affected > Trusty: not affected > > [Test case] > > Compile and boot tested > > [Where problems could occur] > > This fix affects __LINUX_ARM_ARCH__>=6, an issue with this fix would be > visible to user via a system crash. > > [Notes] > > v3: > - fix the backport description for Jammy in its commit message trailer > > v2: > - improve the backport descriptions in commit message trailers > > > Yongqiang Liu (1): > ARM: 9359/1: flush: check if the folio is reserved for no-mapping > addresses > > arch/arm/mm/flush.c | 2 ++ > 1 file changed, 2 insertions(+) >
Acked-by: Ivan Hu <ivan.hu@canonical.com> On 9/30/24 11:10, Koichiro Den wrote: > [Impact] > > ARM: 9359/1: flush: check if the folio is reserved for no-mapping addresses > > Since commit a4d5613c4dc6 ("arm: extend pfn_valid to take into account > freed memory map alignment") changes the semantics of pfn_valid() to check > presence of the memory map for a PFN. A valid page for an address which > is reserved but not mapped by the kernel[1], the system crashed during > some uio test with the following memory layout: > > node 0: [mem 0x00000000c0a00000-0x00000000cc8fffff] > node 0: [mem 0x00000000d0000000-0x00000000da1fffff] > the uio layout is：0xc0900000, 0x100000 > > the crash backtrace like: > > Unable to handle kernel paging request at virtual address bff00000 > [...] > CPU: 1 PID: 465 Comm: startapp.bin Tainted: G O 5.10.0 #1 > Hardware name: Generic DT based system > PC is at b15_flush_kern_dcache_area+0x24/0x3c > LR is at __sync_icache_dcache+0x6c/0x98 > [...] > (b15_flush_kern_dcache_area) from (__sync_icache_dcache+0x6c/0x98) > (__sync_icache_dcache) from (set_pte_at+0x28/0x54) > (set_pte_at) from (remap_pfn_range+0x1a0/0x274) > (remap_pfn_range) from (uio_mmap+0x184/0x1b8 [uio]) > (uio_mmap [uio]) from (__mmap_region+0x264/0x5f4) > (__mmap_region) from (__do_mmap_mm+0x3ec/0x440) > (__do_mmap_mm) from (do_mmap+0x50/0x58) > (do_mmap) from (vm_mmap_pgoff+0xfc/0x188) > (vm_mmap_pgoff) from (ksys_mmap_pgoff+0xac/0xc4) > (ksys_mmap_pgoff) from (ret_fast_syscall+0x0/0x5c) > Code: e0801001 e2423001 e1c00003 f57ff04f (ee070f3e) > ---[ end trace 09cf0734c3805d52 ]--- > Kernel panic - not syncing: Fatal exception > > So check if PG_reserved was set to solve this issue. > > [1]: https://lore.kernel.org/lkml/Zbtdue57RO0QScJM@linux.ibm.com/ > > [Backport] > > Adjusted context due to missing commits: > - 8b5989f33337 ("arm: implement the new page table range API") > - d389a4a81155 ("mm: Add folio flag manipulation functions")] > > without merging them to avoid unnecessary changes to the code base. > > [Fix] > > Noble: fixed via stable > Jammy: Backport - adjusted contexts, see [Backport] > Focal: Backport - adjusted contexts, see [Backport] > Bionic: not affected > Xenial: not affected > Trusty: not affected > > [Test case] > > Compile and boot tested > > [Where problems could occur] > > This fix affects __LINUX_ARM_ARCH__>=6, an issue with this fix would be > visible to user via a system crash. > > [Notes] > > v3: > - fix the backport description for Jammy in its commit message trailer > > v2: > - improve the backport descriptions in commit message trailers > > > Yongqiang Liu (1): > ARM: 9359/1: flush: check if the folio is reserved for no-mapping > addresses > > arch/arm/mm/flush.c | 2 ++ > 1 file changed, 2 insertions(+) >
[Impact] ARM: 9359/1: flush: check if the folio is reserved for no-mapping addresses Since commit a4d5613c4dc6 ("arm: extend pfn_valid to take into account freed memory map alignment") changes the semantics of pfn_valid() to check presence of the memory map for a PFN. A valid page for an address which is reserved but not mapped by the kernel[1], the system crashed during some uio test with the following memory layout: node 0: [mem 0x00000000c0a00000-0x00000000cc8fffff] node 0: [mem 0x00000000d0000000-0x00000000da1fffff] the uio layout is：0xc0900000, 0x100000 the crash backtrace like: Unable to handle kernel paging request at virtual address bff00000 [...] CPU: 1 PID: 465 Comm: startapp.bin Tainted: G O 5.10.0 #1 Hardware name: Generic DT based system PC is at b15_flush_kern_dcache_area+0x24/0x3c LR is at __sync_icache_dcache+0x6c/0x98 [...] (b15_flush_kern_dcache_area) from (__sync_icache_dcache+0x6c/0x98) (__sync_icache_dcache) from (set_pte_at+0x28/0x54) (set_pte_at) from (remap_pfn_range+0x1a0/0x274) (remap_pfn_range) from (uio_mmap+0x184/0x1b8 [uio]) (uio_mmap [uio]) from (__mmap_region+0x264/0x5f4) (__mmap_region) from (__do_mmap_mm+0x3ec/0x440) (__do_mmap_mm) from (do_mmap+0x50/0x58) (do_mmap) from (vm_mmap_pgoff+0xfc/0x188) (vm_mmap_pgoff) from (ksys_mmap_pgoff+0xac/0xc4) (ksys_mmap_pgoff) from (ret_fast_syscall+0x0/0x5c) Code: e0801001 e2423001 e1c00003 f57ff04f (ee070f3e) ---[ end trace 09cf0734c3805d52 ]--- Kernel panic - not syncing: Fatal exception So check if PG_reserved was set to solve this issue. [1]: https://lore.kernel.org/lkml/Zbtdue57RO0QScJM@linux.ibm.com/ [Backport] Adjusted context due to missing commits: - 8b5989f33337 ("arm: implement the new page table range API") - d389a4a81155 ("mm: Add folio flag manipulation functions")] without merging them to avoid unnecessary changes to the code base. [Fix] Noble: fixed via stable Jammy: Backport - adjusted contexts, see [Backport] Focal: Backport - adjusted contexts, see [Backport] Bionic: not affected Xenial: not affected Trusty: not affected [Test case] Compile and boot tested [Where problems could occur] This fix affects __LINUX_ARM_ARCH__>=6, an issue with this fix would be visible to user via a system crash. [Notes] v3: - fix the backport description for Jammy in its commit message trailer v2: - improve the backport descriptions in commit message trailers Yongqiang Liu (1): ARM: 9359/1: flush: check if the folio is reserved for no-mapping addresses arch/arm/mm/flush.c | 2 ++ 1 file changed, 2 insertions(+)