Since commit 42e4089c7890 ("x86/speculation/l1tf: Disallow non privileged
high MMIO PROT_NONE mappings"), when the first pfn modify is not allowed,
we would break the loop with pte unchanged. Then the wrong pte - 1 would
be passed to pte_unmap_unlock.
Fixes: 42e4089c789 ("x86/speculation/l1tf: Disallow non privileged high MMIO PROT_NONE mappings")
Signed-off-by: Hongxiang Lou <[email protected]>
Signed-off-by: Miaohe Lin <[email protected]>
Cc: [email protected]
---
mm/memory.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/mm/memory.c b/mm/memory.c
index feff48e1465a..351b78ebd5a4 100644
--- a/mm/memory.c
+++ b/mm/memory.c
@@ -2165,11 +2165,11 @@ static int remap_pte_range(struct mm_struct *mm, pmd_t *pmd,
unsigned long addr, unsigned long end,
unsigned long pfn, pgprot_t prot)
{
- pte_t *pte;
+ pte_t *pte, *mapped_pte;
spinlock_t *ptl;
int err = 0;
- pte = pte_alloc_map_lock(mm, pmd, addr, &ptl);
+ mapped_pte = pte = pte_alloc_map_lock(mm, pmd, addr, &ptl);
if (!pte)
return -ENOMEM;
arch_enter_lazy_mmu_mode();
@@ -2183,7 +2183,7 @@ static int remap_pte_range(struct mm_struct *mm, pmd_t *pmd,
pfn++;
} while (pte++, addr += PAGE_SIZE, addr != end);
arch_leave_lazy_mmu_mode();
- pte_unmap_unlock(pte - 1, ptl);
+ pte_unmap_unlock(mapped_pte, ptl);
return err;
}
--
2.19.1
On Sat, Jan 09, 2021 at 03:01:18AM -0500, Miaohe Lin wrote:
> Since commit 42e4089c7890 ("x86/speculation/l1tf: Disallow non privileged
> high MMIO PROT_NONE mappings"), when the first pfn modify is not allowed,
> we would break the loop with pte unchanged. Then the wrong pte - 1 would
> be passed to pte_unmap_unlock.
Thanks.
While the fix is correct, I'm not sure if it actually is a real bug. Is there
any architecture that would do something else than unlocking the underlying
page? If it's just the underlying page then it should be always the same
page, so no bug.
That said of course the change is the right thing for main line, but probably doesn't
need to be backported.
-Andi
Hi:
On 2021/1/11 1:14, Andi Kleen wrote:
> On Sat, Jan 09, 2021 at 03:01:18AM -0500, Miaohe Lin wrote:
>> Since commit 42e4089c7890 ("x86/speculation/l1tf: Disallow non privileged
>> high MMIO PROT_NONE mappings"), when the first pfn modify is not allowed,
>> we would break the loop with pte unchanged. Then the wrong pte - 1 would
>> be passed to pte_unmap_unlock.
>
> Thanks.
>
> While the fix is correct, I'm not sure if it actually is a real bug. Is there
> any architecture that would do something else than unlocking the underlying
> page? If it's just the underlying page then it should be always the same
> page, so no bug.
>
It's just a theoretical issue via code inspection.
> That said of course the change is the right thing for main line, but probably doesn't
> need to be backported.
>
So it should not be backported. Should I resend a patch or Andrew would kindly do this?
> -Andi
> .
>
Many thanks for review and reply.
Hi Andrew:
On 2021/1/14 10:51, Miaohe Lin wrote:
> Hi:
> On 2021/1/11 1:14, Andi Kleen wrote:
>> On Sat, Jan 09, 2021 at 03:01:18AM -0500, Miaohe Lin wrote:
>>> Since commit 42e4089c7890 ("x86/speculation/l1tf: Disallow non privileged
>>> high MMIO PROT_NONE mappings"), when the first pfn modify is not allowed,
>>> we would break the loop with pte unchanged. Then the wrong pte - 1 would
>>> be passed to pte_unmap_unlock.
>>
>> Thanks.
>>
>> While the fix is correct, I'm not sure if it actually is a real bug. Is there
>> any architecture that would do something else than unlocking the underlying
>> page? If it's just the underlying page then it should be always the same
>> page, so no bug.
>>
>
> It's just a theoretical issue via code inspection.
Should I send a new one without Cc statle or just drop this patch? Thanks.
>
>> That said of course the change is the right thing for main line, but probably doesn't
>> need to be backported.
>>
>
> So it should not be backported. Should I resend a patch or Andrew would kindly do this?
>
>> -Andi
>> .
>>
>
> Many thanks for review and reply.
>
On Fri, 22 Jan 2021 16:27:23 +0800 Miaohe Lin <[email protected]> wrote:
> Hi Andrew:
> On 2021/1/14 10:51, Miaohe Lin wrote:
> > Hi:
> > On 2021/1/11 1:14, Andi Kleen wrote:
> >> On Sat, Jan 09, 2021 at 03:01:18AM -0500, Miaohe Lin wrote:
> >>> Since commit 42e4089c7890 ("x86/speculation/l1tf: Disallow non privileged
> >>> high MMIO PROT_NONE mappings"), when the first pfn modify is not allowed,
> >>> we would break the loop with pte unchanged. Then the wrong pte - 1 would
> >>> be passed to pte_unmap_unlock.
> >>
> >> Thanks.
> >>
> >> While the fix is correct, I'm not sure if it actually is a real bug. Is there
> >> any architecture that would do something else than unlocking the underlying
> >> page? If it's just the underlying page then it should be always the same
> >> page, so no bug.
> >>
> >
> > It's just a theoretical issue via code inspection.
>
> Should I send a new one without Cc statle or just drop this patch? Thanks.
Your patch makes the code much less scary looking. I added Andi's
observation to the changelog, removed the cc:stable and queued it up,
thanks.
Hi:
On 2021/1/24 10:01, Andrew Morton wrote:
> On Fri, 22 Jan 2021 16:27:23 +0800 Miaohe Lin <[email protected]> wrote:
>
>> Hi Andrew:
>> On 2021/1/14 10:51, Miaohe Lin wrote:
>>> Hi:
>>> On 2021/1/11 1:14, Andi Kleen wrote:
>>>> On Sat, Jan 09, 2021 at 03:01:18AM -0500, Miaohe Lin wrote:
>>>>> Since commit 42e4089c7890 ("x86/speculation/l1tf: Disallow non privileged
>>>>> high MMIO PROT_NONE mappings"), when the first pfn modify is not allowed,
>>>>> we would break the loop with pte unchanged. Then the wrong pte - 1 would
>>>>> be passed to pte_unmap_unlock.
>>>>
>>>> Thanks.
>>>>
>>>> While the fix is correct, I'm not sure if it actually is a real bug. Is there
>>>> any architecture that would do something else than unlocking the underlying
>>>> page? If it's just the underlying page then it should be always the same
>>>> page, so no bug.
>>>>
>>>
>>> It's just a theoretical issue via code inspection.
>>
>> Should I send a new one without Cc statle or just drop this patch? Thanks.
>
> Your patch makes the code much less scary looking. I added Andi's
> observation to the changelog, removed the cc:stable and queued it up,
> thanks.
>
> .
>
Sounds reasonable. Many thanks for doing this!