x86/mm: Fix preallocated PMD stack array
PATCH 1/1 x86/mm: Fix preallocated PMD stack array
While trying to remove VLAs in pgd_alloc(), a typo was made and a use of PREALLOCATED_PMDS was replaced with the new MAX_PREALLOCATED_USER_PMDS (note "...USER..."). Instead, we also need a new MAX_PREALLOCATED_PMDS. This adds it and fixes the stack array size.
Without this fix, 32-bit kernels would trip the stack protector at boot:
Kernel panic - not syncing: stack-protector: Kernel stack is corrupted in: pgd_alloc+0x29e/0x2a0 CPU: 0 PID: 1 Comm: swapper/0 Tainted: G W 4.19.0-rc6+ #5 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.11.1-1 04/01/2014 Call Trace: dump_stack+0x66/0x95 panic+0x94/0x1dd __stack_chk_fail+0x1e/0x20 ? pgd_alloc+0x29e/0x2a0 pgd_alloc+0x29e/0x2a0 mm_init.isra.60+0x1ec/0x210 mm_alloc+0x30/0x40 __do_execve_file+0x378/0x930 ? __do_execve_file+0x108/0x930 ? kmem_cache_alloc+0x123/0x220 do_execve+0x2c/0x30 run_init_process+0x31/0x36 ? rest_init+0xb0/0xb0 try_to_run_init_process+0x11/0x33 ? rest_init+0xb0/0xb0 kernel_init+0x9e/0xda ret_from_fork+0x2e/0x38 Kernel Offset: disabled ---[ end Kernel panic - not syncing: stack-protector: Kernel stack is corrupted in: pgd_alloc+0x29e/0x2a0 ]---
--- arch/x86/mm/pgtable.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
arch/x86/mm/pgtable.c +5 -1
@@ -115,6 +115,8 @@ static inline void pgd_list_del(pgd_t *pgd)#define UNSHARED_PTRS_PER_PGD \ (SHARED_KERNEL_PMD ? KERNEL_PGD_BOUNDARY : PTRS_PER_PGD) +#define MAX_UNSHARED_PTRS_PER_PGD \ + max_t(size_t, KERNEL_PGD_BOUNDARY, PTRS_PER_PGD)static void pgd_set_mm (pgd_t *pgd,struct mm_struct *mm)
@@ -181,6 +183,7 @@ static void pgd_dtor(pgd_t *pgd)* and initialize the kernel pmds here. */ #define PREALLOCATED_PMDS UNSHARED_PTRS_PER_PGD +#define MAX_PREALLOCATED_PMDS MAX_UNSHARED_PTRS_PER_PGD/* * We allocate separate PMDs for the kernel part of the user page-table
@@ -211,6 +214,7 @@ void pud_populate(struct mm_struct *mm, pud_t *pudp, pmd_t *pmd)/* No need to prepopulate any pagetable entries in non-PAE modes. */ #define PREALLOCATED_PMDS 0 +#define MAX_PREALLOCATED_PMDS 0#define PREALLOCATED_USER_PMDS 0#define MAX_PREALLOCATED_USER_PMDS 0#endif /* CONFIG_X86_PAE */
@@ -431,7 +435,7 @@ pgd_t *pgd_alloc(struct mm_struct *mm) {pgd_t *pgd;pmd_t *u_pmds[MAX_PREALLOCATED_USER_PMDS ]; -pmd_t *pmds[MAX_PREALLOCATED_USER_PMDS ]; +pmd_t *pmds[MAX_PREALLOCATED_PMDS ]; pgd =_pgd_alloc ();
Signature · 6 lines
2.17.1 -- Kees Cook Pixel Security
tip-bot for Kees Cook
merge bot[tip:x86/urgent] x86/mm: Avoid VLA in pgd_alloc()
x86/mm: Avoid VLA in pgd_alloc()
Commit-ID: 184d47f0fd365108bd06ab26cdb3450b716269fd Gitweb: https://git.kernel.org/tip/184d47f0fd365108bd06ab26cdb3450b716269fd Author: Kees Cook <[email protected]> AuthorDate: Mon, 8 Oct 2018 16:54:34 -0700 Committer: Ingo Molnar <[email protected]> CommitDate: Tue, 9 Oct 2018 08:55:07 +0200
x86/mm: Avoid VLA in pgd_alloc()
Arnd Bergmann reported that turning on -Wvla found a new (unintended) VLA usage:
arch/x86/mm/pgtable.c: In function 'pgd_alloc':
include/linux/build_bug.h:29:45: error: ISO C90 forbids variable length array 'u_pmds' [-Werror=vla] arch/x86/mm/pgtable.c:190:34: note: in expansion of macro 'static_cpu_has'
#define PREALLOCATED_USER_PMDS (static_cpu_has(X86_FEATURE_PTI) ? \
^~~~~~~~~~~~~~
arch/x86/mm/pgtable.c:431:16: note: in expansion of macro 'PREALLOCATED_USER_PMDS'
pmd_t *u_pmds[PREALLOCATED_USER_PMDS];
^~~~~~~~~~~~~~~~~~~~~~Use the actual size of the array that is used for X86_FEATURE_PTI, which is known at build time, instead of the variable size.
[ mingo: Squashed original fix with followup fix to avoid bisection breakage, wrote new changelog. ]
--- arch/x86/mm/pgtable.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-)
arch/x86/mm/pgtable.c +8 -2
@@ -115,6 +115,8 @@ static inline void pgd_list_del(pgd_t *pgd)#define UNSHARED_PTRS_PER_PGD \ (SHARED_KERNEL_PMD ? KERNEL_PGD_BOUNDARY : PTRS_PER_PGD) +#define MAX_UNSHARED_PTRS_PER_PGD \ + max_t(size_t, KERNEL_PGD_BOUNDARY, PTRS_PER_PGD)static void pgd_set_mm (pgd_t *pgd,struct mm_struct *mm)
@@ -181,6 +183,7 @@ static void pgd_dtor(pgd_t *pgd)* and initialize the kernel pmds here. */ #define PREALLOCATED_PMDS UNSHARED_PTRS_PER_PGD +#define MAX_PREALLOCATED_PMDS MAX_UNSHARED_PTRS_PER_PGD/* * We allocate separate PMDs for the kernel part of the user page-table
@@ -189,6 +192,7 @@ static void pgd_dtor(pgd_t *pgd)*/ #define PREALLOCATED_USER_PMDS (static_cpu_has(X86_FEATURE_PTI) ? \ KERNEL_PGD_PTRS : 0) +#define MAX_PREALLOCATED_USER_PMDS KERNEL_PGD_PTRSvoid pud_populate (struct mm_struct *mm,pud_t *pudp,pmd_t *pmd) {
@@ -210,7 +214,9 @@ void pud_populate(struct mm_struct *mm, pud_t *pudp, pmd_t *pmd)/* No need to prepopulate any pagetable entries in non-PAE modes. */ #define PREALLOCATED_PMDS 0 +#define MAX_PREALLOCATED_PMDS 0#define PREALLOCATED_USER_PMDS 0 +#define MAX_PREALLOCATED_USER_PMDS 0#endif /* CONFIG_X86_PAE */ static void free_pmds (struct mm_struct *mm,pmd_t *pmds[],int count)
@@ -428,8 +434,8 @@ static inline void _pgd_free(pgd_t *pgd)pgd_t *pgd_alloc (struct mm_struct *mm) {pgd_t *pgd; -pmd_t *u_pmds[PREALLOCATED_USER_PMDS ]; -pmd_t *pmds[PREALLOCATED_PMDS ]; +pmd_t *u_pmds[MAX_PREALLOCATED_USER_PMDS ]; +pmd_t *pmds[MAX_PREALLOCATED_PMDS ]; pgd =_pgd_alloc ();
Re: [tip:x86/urgent] x86/mm: Avoid VLA in pgd_alloc()
Quoted 24 lines · tip-bot for Kees Cook
Commit-ID: 184d47f0fd365108bd06ab26cdb3450b716269fd Gitweb: https://git.kernel.org/tip/184d47f0fd365108bd06ab26cdb3450b716269fd Author: Kees Cook <[email protected]> AuthorDate: Mon, 8 Oct 2018 16:54:34 -0700 Committer: Ingo Molnar <[email protected]> CommitDate: Tue, 9 Oct 2018 08:55:07 +0200x86/mm: Avoid VLA in
pgd_alloc()Arnd Bergmann reported that turning on -Wvla found a new (unintended) VLA usage:
arch/x86/mm/pgtable.c: In function 'pgd_alloc':
include/linux/build_bug.h:29:45: error: ISO C90 forbids variable length array 'u_pmds' [-Werror=vla]arch/x86/mm/pgtable.c:190:34: note: in expansion of macro 'static_cpu_has'#define PREALLOCATED_USER_PMDS (static_cpu_has(X86_FEATURE_PTI) ? \ ^~~~~~~~~~~~~~ arch/x86/mm/pgtable.c:431:16: note: in expansion of macro 'PREALLOCATED_USER_PMDS' pmd_t *u_pmds[PREALLOCATED_USER_PMDS]; ^~~~~~~~~~~~~~~~~~~~~~Use the actual size of the array that is used for
X86_FEATURE_PTI, which is known at build time, instead of the variable size.
Quoted 6 lines
[ mingo: Squashed original fix with followup fix to avoid bisection breakage, wrote new changelog. ]
Reported-by Arnd Bergmann <[email protected]>Original-written-by Arnd Bergmann <[email protected]>Reported-by Borislav Petkov <[email protected]>Signed-off-by Kees Cook <[email protected]>
Thanks for fixing up my incorrect fix, looks correct to me now.
Arnd