arm64: fixmap: make FIX_TEXT_POKE0 permanent
Mark Rutland
reviewerPATCH 1/2 arm64: fixmap: make FIX_TEXT_POKE0 permanent
The FIX_TEST_POKE0 is currently at the end of the temporary fixmap slots, despite the fact that it can be used at any point during runtime (e.g. for poking the text of loaded modules), and thus should be a permanent fixmap slot (as is the case on arm and x86).
This patch moves FIX_TEXT_POKE0 into the set of permanent fixmap slots.
--- arch/arm64/include/asm/fixmap.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm64/include/asm/fixmap.h +1 -1
@@ -33,6 +33,7 @@enum fixed_addresses {FIX_HOLE ,FIX_EARLYCON_MEM_BASE , +FIX_TEXT_POKE0 , __end_of_permanent_fixed_addresses,/*
@@ -49,7 +50,6 @@ enum fixed_addresses {FIX_BTMAP_END = __end_of_permanent_fixed_addresses,FIX_BTMAP_BEGIN =FIX_BTMAP_END +TOTAL_FIX_BTMAPS -1 , -FIX_TEXT_POKE0 , __end_of_fixed_addresses };
Signature · 1 line
1.9.1
Mark Rutland
reviewerPATCH 2/2 arm64: fixmap: check idx is definitely valid
Fixmap indices are in the interval (FIX_HOLE, __end_of_fixed_addresses), but in __set_fixmap we only check idx <= __end_of_fixed_addresses, and therefore indices <= FIX_HOLE are erroneously accepted. If called with such an idx, __set_fixmap may corrupt page tables outside of the fixmap region.
This patch ensures that we validate the idx against both endpoints of the interval.
--- arch/arm64/mm/mmu.c | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-)
arch/arm64/mm/mmu.c +1 -4
@@ -627,10 +627,7 @@ void __set_fixmap(enum fixed_addresses idx,unsigned long addr =__fix_to_virt (idx);pte_t *pte; -if (idx >= __end_of_fixed_addresses) { -BUG (); -return ; - } +BUG_ON (idx <=FIX_HOLE || idx >= __end_of_fixed_addresses); pte =fixmap_pte (addr);
Signature · 1 line
1.9.1
PATCH 2/2 arm64: fixmap: check idx is definitely valid
Quoted 9 lines · Mark Rutland
Fixmap indices are in the interval (
FIX_HOLE,__end_of_fixed_addresses), but in__set_fixmapwe only check idx <=__end_of_fixed_addresses, and therefore indices <=FIX_HOLEare erroneously accepted. If called with such an idx,__set_fixmapmay corrupt page tables outside of the fixmap region.This patch ensures that we validate the idx against both endpoints of the interval.
Quoted 6 lines
Signed-off-by Mark Rutland <[email protected]>Cc Ard Biesheuvel <[email protected]>Cc Catalin Marinas <[email protected]>Cc Kees Cook <[email protected]>Cc Laura Abbott <[email protected]>Cc Will Deacon <[email protected]>
Quoted 23 lines
--- arch/arm64/mm/mmu.c | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-)arch/arm64/mm/mmu.c +1
-5@@ -627,10 +627,7 @@ void __set_fixmap(enum fixed_addresses idx,unsigned long addr =__fix_to_virt (idx);pte_t *pte; -if (idx >= __end_of_fixed_addresses) { -BUG (); -return ; - } +BUG_ON (idx <=FIX_HOLE || idx >= __end_of_fixed_addresses); pte =fixmap_pte (addr); --1.9.1
PATCH 2/2 arm64: fixmap: check idx is definitely valid
In reply to Mark RutlandQuoted 9 lines · Mark Rutland
Fixmap indices are in the interval (
FIX_HOLE,__end_of_fixed_addresses), but in__set_fixmapwe only check idx <=__end_of_fixed_addresses, and therefore indices <=FIX_HOLEare erroneously accepted. If called with such an idx,__set_fixmapmay corrupt page tables outside of the fixmap region.This patch ensures that we validate the idx against both endpoints of the interval.
Quoted 6 lines
Signed-off-by Mark Rutland <[email protected]>Cc Ard Biesheuvel <[email protected]>Cc Catalin Marinas <[email protected]>Cc Kees Cook <[email protected]>Cc Laura Abbott <[email protected]>Cc Will Deacon <[email protected]>
Quoted 21 lines
--- arch/arm64/mm/mmu.c | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-)arch/arm64/mm/mmu.c +1
-4@@ -627,10 +627,7 @@ void __set_fixmap(enum fixed_addresses idx,unsigned long addr =__fix_to_virt (idx);pte_t *pte; -if (idx >= __end_of_fixed_addresses) { -BUG (); -return ; - } +BUG_ON (idx <=FIX_HOLE || idx >= __end_of_fixed_addresses); pte =fixmap_pte (addr);
Signature · 5 lines
Qualcomm Innovation Center, Inc. Qualcomm Innovation Center, Inc. is a member of Code Aurora Forum, a Linux Foundation Collaborative Project This e-mail address will be inactive after March 20, 2015 Please contact privately for follow up after that date.
PATCH 1/2 arm64: fixmap: make FIX_TEXT_POKE0 permanent
In reply to Mark RutlandQuoted 5 lines · Mark Rutland
The
FIX_TEST_POKE0is currently at the end of the temporary fixmap slots, despite the fact that it can be used at any point during runtime (e.g. for poking the text of loaded modules), and thus should be a permanent fixmap slot (as is the case on arm and x86).
Quoted 8 lines
This patch moves
FIX_TEXT_POKE0into the set of permanent fixmap slots.Signed-off-by Mark Rutland <[email protected]>Cc Ard Biesheuvel <[email protected]>Cc Catalin Marinas <[email protected]>Cc Kees Cook <[email protected]>Cc Laura Abbott <[email protected]>Cc Will Deacon <[email protected]>
Quoted 27 lines
--- arch/arm64/include/asm/fixmap.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)arch/arm64/include/asm/fixmap.h +1
-2@@ -33,6 +33,7 @@enum fixed_addresses {FIX_HOLE ,FIX_EARLYCON_MEM_BASE , +FIX_TEXT_POKE0 , __end_of_permanent_fixed_addresses,/* @@ -49,7 +50,6 @@ enum fixed_addresses {FIX_BTMAP_END = __end_of_permanent_fixed_addresses,FIX_BTMAP_BEGIN =FIX_BTMAP_END +TOTAL_FIX_BTMAPS -1 , -FIX_TEXT_POKE0 , __end_of_fixed_addresses }; --1.9.1
PATCH 1/2 arm64: fixmap: make FIX_TEXT_POKE0 permanent
In reply to Mark RutlandQuoted 7 lines · Mark Rutland
The
FIX_TEST_POKE0is currently at the end of the temporary fixmap slots, despite the fact that it can be used at any point during runtime (e.g. for poking the text of loaded modules), and thus should be a permanent fixmap slot (as is the case on arm and x86).This patch moves
FIX_TEXT_POKE0into the set of permanent fixmap slots.
Quoted 7 lines
Signed-off-by Mark Rutland <[email protected]>Cc Ard Biesheuvel <[email protected]>Cc Catalin Marinas <[email protected]>Cc Kees Cook <[email protected]>Cc Laura Abbott <[email protected]>Cc Will Deacon <[email protected]>---
Quoted 24 lines
arch/arm64/include/asm/fixmap.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)arch/arm64/include/asm/fixmap.h +1
-1@@ -33,6 +33,7 @@enum fixed_addresses {FIX_HOLE ,FIX_EARLYCON_MEM_BASE , +FIX_TEXT_POKE0 , __end_of_permanent_fixed_addresses,/* @@ -49,7 +50,6 @@ enum fixed_addresses {FIX_BTMAP_END = __end_of_permanent_fixed_addresses,FIX_BTMAP_BEGIN =FIX_BTMAP_END +TOTAL_FIX_BTMAPS -1 , -FIX_TEXT_POKE0 , __end_of_fixed_addresses };
Signature · 5 lines
Qualcomm Innovation Center, Inc. Qualcomm Innovation Center, Inc. is a member of Code Aurora Forum, a Linux Foundation Collaborative Project This e-mail address will be inactive after March 20, 2015 Please contact privately for follow up after that date.