2018-04-19 18:27:31

by Joerg Roedel

[permalink] [raw]
Subject: [PATCH] x86/power/64: Fix page-table setup for temporary text mapping

From: Joerg Roedel <[email protected]>

When we have a 4-level page-table there is no p4d, so we map
the pud in the pgd. The old code before commit fb43d6cb91ef
already did that.

With the change from above commit we end up with an invalid
page-table which causes undefined behavior. In one report it
caused triple faults.

Fix it by changing the p4d back to pud so that we have a
correct page-table.

Reported-by: Borislav Petkov <[email protected]>
Fixes: fb43d6cb91ef ('x86/mm: Do not auto-massage page protections')
Tested-by: Michal Kubecek <[email protected]>
Tested-by: Borislav Petkov <[email protected]>
Signed-off-by: Joerg Roedel <[email protected]>
---
arch/x86/power/hibernate_64.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/x86/power/hibernate_64.c b/arch/x86/power/hibernate_64.c
index 48b14b534897..ccf4a49bb065 100644
--- a/arch/x86/power/hibernate_64.c
+++ b/arch/x86/power/hibernate_64.c
@@ -98,7 +98,7 @@ static int set_up_temporary_text_mapping(pgd_t *pgd)
set_pgd(pgd + pgd_index(restore_jump_address), new_pgd);
} else {
/* No p4d for 4-level paging: point the pgd to the pud page table */
- pgd_t new_pgd = __pgd(__pa(p4d) | pgprot_val(pgtable_prot));
+ pgd_t new_pgd = __pgd(__pa(pud) | pgprot_val(pgtable_prot));
set_pgd(pgd + pgd_index(restore_jump_address), new_pgd);
}

--
2.13.6



2018-04-19 18:30:07

by Jörg Rödel

[permalink] [raw]
Subject: Re: [PATCH] x86/power/64: Fix page-table setup for temporary text mapping

Adding Dave Hansen to Cc, forgot that in the initial post.

On Thu, Apr 19, 2018 at 08:26:00PM +0200, Joerg Roedel wrote:
> From: Joerg Roedel <[email protected]>
>
> When we have a 4-level page-table there is no p4d, so we map
> the pud in the pgd. The old code before commit fb43d6cb91ef
> already did that.
>
> With the change from above commit we end up with an invalid
> page-table which causes undefined behavior. In one report it
> caused triple faults.
>
> Fix it by changing the p4d back to pud so that we have a
> correct page-table.
>
> Reported-by: Borislav Petkov <[email protected]>
> Fixes: fb43d6cb91ef ('x86/mm: Do not auto-massage page protections')
> Tested-by: Michal Kubecek <[email protected]>
> Tested-by: Borislav Petkov <[email protected]>
> Signed-off-by: Joerg Roedel <[email protected]>
> ---
> arch/x86/power/hibernate_64.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/arch/x86/power/hibernate_64.c b/arch/x86/power/hibernate_64.c
> index 48b14b534897..ccf4a49bb065 100644
> --- a/arch/x86/power/hibernate_64.c
> +++ b/arch/x86/power/hibernate_64.c
> @@ -98,7 +98,7 @@ static int set_up_temporary_text_mapping(pgd_t *pgd)
> set_pgd(pgd + pgd_index(restore_jump_address), new_pgd);
> } else {
> /* No p4d for 4-level paging: point the pgd to the pud page table */
> - pgd_t new_pgd = __pgd(__pa(p4d) | pgprot_val(pgtable_prot));
> + pgd_t new_pgd = __pgd(__pa(pud) | pgprot_val(pgtable_prot));
> set_pgd(pgd + pgd_index(restore_jump_address), new_pgd);
> }
>
> --
> 2.13.6

Subject: [tip:x86/urgent] x86/power/64: Fix page-table setup for temporary text mapping

Commit-ID: 05189820da23fc87ee2a7d87c20257f298af27f4
Gitweb: https://git.kernel.org/tip/05189820da23fc87ee2a7d87c20257f298af27f4
Author: Joerg Roedel <[email protected]>
AuthorDate: Thu, 19 Apr 2018 20:26:00 +0200
Committer: Thomas Gleixner <[email protected]>
CommitDate: Fri, 20 Apr 2018 11:52:00 +0200

x86/power/64: Fix page-table setup for temporary text mapping

On a system with 4-level page-tables there is no p4d, so the pud in the pgd
should be mapped. The old code before commit fb43d6cb91ef already did that.

The change from above commit causes an invalid page-table which causes
undefined behavior. In one report it caused triple faults.

Fix it by changing the p4d back to pud.

Fixes: fb43d6cb91ef ('x86/mm: Do not auto-massage page protections')
Reported-by: Borislav Petkov <[email protected]>
Signed-off-by: Joerg Roedel <[email protected]>
Signed-off-by: Thomas Gleixner <[email protected]>
Tested-by: Michal Kubecek <[email protected]>
Tested-by: Borislav Petkov <[email protected]>
Cc: [email protected]
Cc: [email protected]
Cc: [email protected]
Cc: [email protected]
Cc: Dave Hansen <[email protected]>
Link: https://lkml.kernel.org/r/[email protected]

---
arch/x86/power/hibernate_64.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/x86/power/hibernate_64.c b/arch/x86/power/hibernate_64.c
index 48b14b534897..ccf4a49bb065 100644
--- a/arch/x86/power/hibernate_64.c
+++ b/arch/x86/power/hibernate_64.c
@@ -98,7 +98,7 @@ static int set_up_temporary_text_mapping(pgd_t *pgd)
set_pgd(pgd + pgd_index(restore_jump_address), new_pgd);
} else {
/* No p4d for 4-level paging: point the pgd to the pud page table */
- pgd_t new_pgd = __pgd(__pa(p4d) | pgprot_val(pgtable_prot));
+ pgd_t new_pgd = __pgd(__pa(pud) | pgprot_val(pgtable_prot));
set_pgd(pgd + pgd_index(restore_jump_address), new_pgd);
}