Received: by 2002:a05:6a10:5bc5:0:0:0:0 with SMTP id os5csp1360288pxb; Sat, 30 Oct 2021 11:34:55 -0700 (PDT) X-Google-Smtp-Source: ABdhPJxLAJ8509U0E5/+Z30jlSemJjsv3//PcbAM3gWbDnTaQKdO2z5qP/nwtLwINY8xDoMwgSAZ X-Received: by 2002:a50:9d49:: with SMTP id j9mr25389863edk.39.1635618895374; Sat, 30 Oct 2021 11:34:55 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1635618895; cv=none; d=google.com; s=arc-20160816; b=G+7cJx6KttTTk7TL6reevqsHpVc/NiQC2eKNBWWUbLvJ5tLDLNEDcvpsdho2SkMZ/R UL76eb+t2fC0Dga9qud+9quJ9CnJ/z2czTFc4IyvV7DI53rI1pVBqeI8Xc/t547ddgaP 4db+dDKmVtH+2KW3HR+3hzpI7POSqNw5G+rQRq7QY9KI8+B3TdQWf3b/4nht841DMjtS MR/qEJkKv57N7G2Pk+9xczbXs5aiPUW1zXPG96URT8pet2OuQyRD5TqagkrWn+qWqI0r 0/EAT/7u8Cg9M0vBQYJ2Kmk+Qt7/D78tieZgfTaD4aDL9+lQI/fgim6pSAhGoB9Mu/Ik bF2A== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :references:in-reply-to:message-id:date:subject:cc:to:from; bh=GOu8OGpX1b4EUYcpHod6aGivBx15Cxcr6R/yzAykQ+0=; b=GZQtGhRb8YjEVoh3MSFrZXeu/8RyriYhnofBAiWV8E5z3YsumtSJ5iiOVf+34XsSgX y9nWxO3+NmvcF3udR/PVblhweoZ4S0g5ngtqEI4Dxwtup52UJQ7LbF/4RpthyprCqrRh MzeBvSeidmC8xI9bj8slScxdDVqfSjkfGTRr6SQ6XI3L61WPTi/lCa2GCcL9y0RhVoxS iUEWpInD8vr4UBmxGDP4Hbf8wPWv1mRQtxXjk6we8DXvskjJ63HrR6FpZMfoXAQwxkto fefbTojzAtGrrf8zTFXs8IHGnjFknrd06Oh6txQDehlwx+wCwGJ1hKoxQrrhH3IRt6iJ LJ8w== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=alibaba.com Return-Path: Received: from vger.kernel.org (vger.kernel.org. [23.128.96.18]) by mx.google.com with ESMTP id c30si17875900ejj.396.2021.10.30.11.34.31; Sat, 30 Oct 2021 11:34:55 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18; Authentication-Results: mx.google.com; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=alibaba.com Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S231950AbhJ3Sel (ORCPT + 99 others); Sat, 30 Oct 2021 14:34:41 -0400 Received: from out30-130.freemail.mail.aliyun.com ([115.124.30.130]:51213 "EHLO out30-130.freemail.mail.aliyun.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S230323AbhJ3Seh (ORCPT ); Sat, 30 Oct 2021 14:34:37 -0400 X-Alimail-AntiSpam: AC=PASS;BC=-1|-1;BR=01201311R151e4;CH=green;DM=||false|;DS=||;FP=0|-1|-1|-1|0|-1|-1|-1;HT=e01e04407;MF=rongwei.wang@linux.alibaba.com;NM=1;PH=DS;RN=11;SR=0;TI=SMTPD_---0UuHo6Jk_1635618721; Received: from localhost.localdomain(mailfrom:rongwei.wang@linux.alibaba.com fp:SMTPD_---0UuHo6Jk_1635618721) by smtp.aliyun-inc.com(127.0.0.1); Sun, 31 Oct 2021 02:32:05 +0800 From: Rongwei Wang To: catalin.marinas@arm.com, will@kernel.org, mark.rutland@arm.com, james.morse@arm.com, ardb@kernel.org, tabba@google.com, akpm@linux-foundation.org, rppt@kernel.org, anshuman.khandual@arm.com Cc: linux-arm-kernel@lists.infradead.org, linux-kernel@vger.kernel.org Subject: [PATCH 1/2] arm64: trans_pgd: fix incorrect use of pmd_populate_kernel in copy_pte() Date: Sun, 31 Oct 2021 02:31:59 +0800 Message-Id: <20211030183200.51295-2-rongwei.wang@linux.alibaba.com> X-Mailer: git-send-email 2.32.0 In-Reply-To: <20211030183200.51295-1-rongwei.wang@linux.alibaba.com> References: <20211030183200.51295-1-rongwei.wang@linux.alibaba.com> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org In commit 5de59884ac0e ("arm64: trans_pgd: pass NULL instead of init_mm to *_populate functions"), simply replace init_mm with NULL for pmd_populate_kernel. But in commit 59511cfd08f3 ("arm64: mm: use XN table mapping attributes for user/kernel mappings"), adding the check of mm context in pmd_populate_kernel. And these changes will cause a crash when executing copy_pte/trans_pgd.c, as follows: kernel BUG at arch/arm64/include/asm/pgalloc.h:79! Internal error: Oops - BUG: 0 [#1] SMP Modules linked in: rfkill(E) aes_ce_blk(E) aes_ce_cipher(E) ... CPU: 21 PID: 1617 Comm: a.out Kdump: loaded Tainted: ... 5.15.0-rc7-mm1+ #8 Hardware name: ECS, BIOS 0.0.0 02/06/2015 pstate: 40400005 (nZcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : trans_pgd_create_copy+0x4ac/0x4f0 lr : trans_pgd_create_copy+0x34c/0x4f0 sp : ffff80001bf2bc50 x29: ffff80001bf2bc50 x28: ffff0010067f1000 x27: ffff800011072000 x26: ffff001fffff8000 x25: ffff008000000000 x24: 0040000000000041 x23: 0040000000000001 x22: ffff80001bf2bd68 x21: ffff80001188ded8 x20: ffff800000000000 x19: ffff000000000000 x18: 0000000000000000 x17: 0000000000000000 x16: 0000000000000000 x15: 00000000200004c0 x14: ffff00003fffffff x13: ffff007fffffffff x12: ffff800010f882a8 x11: 0000000000face57 x10: 0000000000000001 x9 : 0000000000000000 x8 : ffff00100cece000 x7 : ffff001001c9f000 x6 : ffff00100ae40000 x5 : 0000000000000040 x4 : 0000000000000000 x3 : ffff001fffff7000 x2 : ffff000000200000 x1 : ffff000040000000 x0 : ffff00100cecd000 Call trace: trans_pgd_create_copy+0x4ac/0x4f0 machine_kexec_post_load+0x94/0x3bc do_kexec_load+0x11c/0x2e0 __arm64_sys_kexec_load+0xa8/0xf4 invoke_syscall+0x50/0x120 el0_svc_common.constprop.0+0x58/0x190 do_el0_svc+0x2c/0x90 el0_svc+0x28/0xe0 el0t_64_sync_handler+0xb0/0xb4 el0t_64_sync+0x180/0x184 Code: f90000c0 d5033a9f d5033fdf 17ffff7b (d4210000) ---[ end trace cc5461ffe1a085db ]--- Kernel panic - not syncing: Oops - BUG: Fatal exception This bug can be reproduced by a user case: void execute_kexec_load(void) { syscall(__NR_mmap, 0x1ffff000ul, 0x1000ul, 0ul, 0x32ul, -1, 0ul); syscall(__NR_mmap, 0x20000000ul, 0x1000000ul, 7ul, 0x32ul, -1, 0ul); syscall(__NR_mmap, 0x21000000ul, 0x1000ul, 0ul, 0x32ul, -1, 0ul); *(uint64_t*)0x200004c0 = 0; *(uint64_t*)0x200004c8 = 0; *(uint64_t*)0x200004d0 = 0; *(uint64_t*)0x200004d8 = 0; syscall(__NR_kexec_load, 0ul, 1ul, 0x200004c0ul, 0ul); } And this patch just make some simple changes, and including replace pmd_populate_kernel with pmd_populate. Fixes: 59511cfd08f3 ("arm64: mm: use XN table mapping attributes for user/kernel mappings") Reported-by: Abaci Signed-off-by: Rongwei Wang --- arch/arm64/mm/trans_pgd.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/arch/arm64/mm/trans_pgd.c b/arch/arm64/mm/trans_pgd.c index d7da8ca40d2e..3f1fc6cb9c9d 100644 --- a/arch/arm64/mm/trans_pgd.c +++ b/arch/arm64/mm/trans_pgd.c @@ -62,12 +62,13 @@ static int copy_pte(struct trans_pgd_info *info, pmd_t *dst_pmdp, { pte_t *src_ptep; pte_t *dst_ptep; + struct page *page; unsigned long addr = start; - dst_ptep = trans_alloc(info); - if (!dst_ptep) + page = virt_to_page(trans_alloc(info)); + if (!page) return -ENOMEM; - pmd_populate_kernel(NULL, dst_pmdp, dst_ptep); + pmd_populate(NULL, dst_pmdp, page); dst_ptep = pte_offset_kernel(dst_pmdp, start); src_ptep = pte_offset_kernel(src_pmdp, start); -- 2.27.0