Skip to contentSkip to conversation

arm64: add sentinel to kpti_safe_list

PATCH New Mark Rutland 3 participants 4 messages Apr 23, 2018 – Apr 24, 2018 arm64

lore
Share & tools
lore

Mark Rutland

author reviewer
#0 lore raw

PATCH 1/1 arm64: add sentinel to kpti_safe_list

We're missing a sentinel entry in kpti_safe_list. Thus is_midr_in_range_list() can walk past the end of kpti_safe_list. Depending on the contents of memory, this could erroneously match a CPU's MIDR, cause a data abort, or other bad outcomes.

Add the sentinel entry to avoid this.

Fixes be5b299830c63ed7 ("arm64: capabilities: Add support for checks based on a list of MIDRs")
Signed-off-by Mark Rutland <[email protected]>
Reported-by Jan Kiszka <[email protected]>
Tested-by Jan Kiszka <[email protected]>
Cc Catalin Marinas <[email protected]>
Cc Suzuki K Poulose <[email protected]>
Cc Will Deacon <[email protected]>
---
 arch/arm64/kernel/cpufeature.c | 1 +
 1 file changed, 1 insertion(+)

As discussesd in [1].

Mark.

[1] https://lkml.kernel.org/r/97d99ad9-c5cf-a4d2-126a-2b39ffead0b3 at web.de

arch/arm64/kernel/cpufeature.c +1 -0
index 536d572e5596..9d1b06d67c53 100644
@@ -868,6 +868,7 @@ static bool unmap_kernel_at_el0(const struct arm64_cpu_capabilities *entry,
 	static const struct midr_range kpti_safe_list[] = {
 		MIDR_ALL_VERSIONS(MIDR_CAVIUM_THUNDERX2),
 		MIDR_ALL_VERSIONS(MIDR_BRCM_VULCAN),
+		{ /* sentinel */ }
 	};
 	char const *str = "command line option";
Signature · 1 line
2.11.0
#1 lore raw

PATCH 1/1 arm64: add sentinel to kpti_safe_list

Quoted 29 lines · Mark Rutland

We're missing a sentinel entry in kpti_safe_list. Thus is_midr_in_range_list() can walk past the end of kpti_safe_list. Depending on the contents of memory, this could erroneously match a CPU's MIDR, cause a data abort, or other bad outcomes.

Add the sentinel entry to avoid this.

Fixes be5b299830c63ed7 ("arm64: capabilities: Add support for checks based on a list of MIDRs")
Signed-off-by Mark Rutland <[email protected]>
Reported-by Jan Kiszka <[email protected]>
Tested-by Jan Kiszka <[email protected]>
Cc Catalin Marinas <[email protected]>
Cc Suzuki K Poulose <[email protected]>
Cc Will Deacon <[email protected]>
---
  arch/arm64/kernel/cpufeature.c | 1 +
  1 file changed, 1 insertion(+)

As discussesd in [1].

Mark.

[1] https://lkml.kernel.org/r/97d99ad9-c5cf-a4d2-126a-2b39ffead0b3 at web.de

arch/arm64/kernel/cpufeature.c +0 -0
index 536d572e5596..9d1b06d67c53 100644

arch/arm64/kernel/cpufeature.c static bool unmap_kernel_at_el0(const struct arm64_cpu_capabilities *entry, · line 873

Quoted 6 lines
arch/arm64/kernel/cpufeature.c +1 -0
@@ -868,6 +868,7 @@ static bool unmap_kernel_at_el0(const struct arm64_cpu_capabilities *entry,
  	static const struct midr_range kpti_safe_list[] = {
  		MIDR_ALL_VERSIONS(MIDR_CAVIUM_THUNDERX2),
  		MIDR_ALL_VERSIONS(MIDR_BRCM_VULCAN),
+		{ /* sentinel */ }
  	};
  	char const *str = "command line option";

Thanks for the report and the fix.

Reviewed-by Suzuki K Poulose <[email protected]>
author reviewer
#2 lore raw

PATCH 1/1 arm64: add sentinel to kpti_safe_list

Quoted 39 lines · Suzuki K Poulose
Quoted 29 lines · Mark Rutland

We're missing a sentinel entry in kpti_safe_list. Thus is_midr_in_range_list() can walk past the end of kpti_safe_list. Depending on the contents of memory, this could erroneously match a CPU's MIDR, cause a data abort, or other bad outcomes.

Add the sentinel entry to avoid this.

Fixes be5b299830c63ed7 ("arm64: capabilities: Add support for checks based on a list of MIDRs")
Signed-off-by Mark Rutland <[email protected]>
Reported-by Jan Kiszka <[email protected]>
Tested-by Jan Kiszka <[email protected]>
Cc Catalin Marinas <[email protected]>
Cc Suzuki K Poulose <[email protected]>
Cc Will Deacon <[email protected]>
---
  arch/arm64/kernel/cpufeature.c | 1 +
  1 file changed, 1 insertion(+)

As discussesd in [1].

Mark.

[1] https://lkml.kernel.org/r/97d99ad9-c5cf-a4d2-126a-2b39ffead0b3 at web.de

arch/arm64/kernel/cpufeature.c +0 -0
index 536d572e5596..9d1b06d67c53 100644

arch/arm64/kernel/cpufeature.c static bool unmap_kernel_at_el0(const struct arm64_cpu_capabilities *entry, · line 873

Quoted 6 lines
arch/arm64/kernel/cpufeature.c +1 -0
@@ -868,6 +868,7 @@ static bool unmap_kernel_at_el0(const struct arm64_cpu_capabilities *entry,
  	static const struct midr_range kpti_safe_list[] = {
  		MIDR_ALL_VERSIONS(MIDR_CAVIUM_THUNDERX2),
  		MIDR_ALL_VERSIONS(MIDR_BRCM_VULCAN),
+		{ /* sentinel */ }
  	};
  	char const *str = "command line option";

Thanks for the report and the fix.

Quoted 1 line
Reviewed-by Suzuki K Poulose <[email protected]>

Cheers!

Catalin, are you happy to pick this up as a fix for -rc3?

Thanks,
Mark.

#3 lore raw

PATCH 1/1 arm64: add sentinel to kpti_safe_list

Quoted 40 lines · Mark Rutland
Quoted 39 lines · Suzuki K Poulose
Quoted 29 lines · Mark Rutland

We're missing a sentinel entry in kpti_safe_list. Thus is_midr_in_range_list() can walk past the end of kpti_safe_list. Depending on the contents of memory, this could erroneously match a CPU's MIDR, cause a data abort, or other bad outcomes.

Add the sentinel entry to avoid this.

Fixes be5b299830c63ed7 ("arm64: capabilities: Add support for checks based on a list of MIDRs")
Signed-off-by Mark Rutland <[email protected]>
Reported-by Jan Kiszka <[email protected]>
Tested-by Jan Kiszka <[email protected]>
Cc Catalin Marinas <[email protected]>
Cc Suzuki K Poulose <[email protected]>
Cc Will Deacon <[email protected]>
---
  arch/arm64/kernel/cpufeature.c | 1 +
  1 file changed, 1 insertion(+)

As discussesd in [1].

Mark.

[1] https://lkml.kernel.org/r/97d99ad9-c5cf-a4d2-126a-2b39ffead0b3 at web.de

arch/arm64/kernel/cpufeature.c +0 -0
index 536d572e5596..9d1b06d67c53 100644

arch/arm64/kernel/cpufeature.c static bool unmap_kernel_at_el0(const struct arm64_cpu_capabilities *entry, · line 873

Quoted 6 lines
arch/arm64/kernel/cpufeature.c +1 -0
@@ -868,6 +868,7 @@ static bool unmap_kernel_at_el0(const struct arm64_cpu_capabilities *entry,
  	static const struct midr_range kpti_safe_list[] = {
  		MIDR_ALL_VERSIONS(MIDR_CAVIUM_THUNDERX2),
  		MIDR_ALL_VERSIONS(MIDR_BRCM_VULCAN),
+		{ /* sentinel */ }
  	};
  	char const *str = "command line option";

Thanks for the report and the fix.

Quoted 5 lines
Quoted 1 line
Reviewed-by Suzuki K Poulose <[email protected]>

Cheers!

Catalin, are you happy to pick this up as a fix for -rc3?

Already got it queued locally.

Will