Received-SPF: pass (google.com: domain of linux-kernel+bounces-162296-linux.lists.archive=gmail.com@vger.kernel.org designates 147.75.199.223 as permitted sender) client-ip=147.75.199.223;
Date: Mon, 29 Apr 2024 14:52:30 +0200
From: Joel Granados <j.granados@samsung.com>
To: Nam Cao <namcao@linutronix.de>
CC: Mike Rapoport <rppt@kernel.org>, Andreas Dilger <adilger@dilger.ca>,
	=?utf-8?B?QmrDtnJuIFTDtnBlbA==?= <bjorn@kernel.org>,
	<linux-riscv@lists.infradead.org>, Thomas Gleixner <tglx@linutronix.de>,
	Andrew Morton <akpm@linux-foundation.org>, "ndesaulniers @ google . com"
	<ndesaulniers@google.com>, Luis Chamberlain <mcgrof@kernel.org>, Ingo Molnar
	<mingo@kernel.org>, Christophe Leroy <christophe.leroy@csgroup.eu>, Tejun
	Heo <tj@kernel.org>, Krister Johansen <kjlx@templeofstupid.com>, Changbin Du
	<changbin.du@huawei.com>, Arnd Bergmann <arnd@arndb.de>, Geert Uytterhoeven
	<geert+renesas@glider.be>, <linux-kernel@vger.kernel.org>,
	<stable@vger.kernel.org>
Subject: Re: [PATCH] init: fix allocated page overlapping with PTR_ERR
Message-ID: <20240429125230.s5pbeye24iw5aurz@joelS2.panther.com>
Precedence: bulk
MIME-Version: 1.0
Content-Type: multipart/signed; micalg="pgp-sha512";
	protocol="application/pgp-signature"; boundary="s6e23wdofaldi5z4"
Content-Disposition: inline
In-Reply-To: <20240418102943.180510-1-namcao@linutronix.de>
CMS-TYPE: 201P
References: <20240418102943.180510-1-namcao@linutronix.de>
	<CGME20240429125236eucas1p24219f2d332e0267794a2f87dea9f39c4@eucas1p2.samsung.com>

--s6e23wdofaldi5z4
Content-Type: text/plain; charset="us-ascii"
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

On Thu, Apr 18, 2024 at 12:29:43PM +0200, Nam Cao wrote:
> There is nothing preventing kernel memory allocators from allocating a
> page that overlaps with PTR_ERR(), except for architecture-specific
> code that setup memblock.
>=20
> It was discovered that RISCV architecture doesn't setup memblock
> corectly, leading to a page overlapping with PTR_ERR() being allocated,
> and subsequently crashing the kernel (link in Close: )
>=20
> The reported crash has nothing to do with PTR_ERR(): the last page
> (at address 0xfffff000) being allocated leads to an unexpected
> arithmetic overflow in ext4; but still, this page shouldn't be
> allocated in the first place.
>=20
> Because PTR_ERR() is an architecture-independent thing, we shouldn't
> ask every single architecture to set this up. There may be other
> architectures beside RISCV that have the same problem.
>=20
> Fix this one and for all by reserving the physical memory page that
> may be mapped to the last virtual memory page as part of low memory.
>=20
> Unfortunately, this means if there is actual memory at this reserved
> location, that memory will become inaccessible. However, if this page
> is not reserved, it can only be accessed as high memory, so this
> doesn't matter if high memory is not supported. Even if high memory is
> supported, it is still only one page.
>=20
> Closes: https://lore.kernel.org/linux-riscv/878r1ibpdn.fsf@all.your.base.=
are.belong.to.us
> Signed-off-by: Nam Cao <namcao@linutronix.de>
> Cc: <stable@vger.kernel.org> # all versions
> ---
>  init/main.c | 1 +
>  1 file changed, 1 insertion(+)
>=20
> diff --git a/init/main.c b/init/main.c
> index 881f6230ee59..f8d2793c4641 100644
> --- a/init/main.c
> +++ b/init/main.c
> @@ -900,6 +900,7 @@ void start_kernel(void)
>  	page_address_init();
>  	pr_notice("%s", linux_banner);
>  	early_security_init();
> +	memblock_reserve(__pa(-PAGE_SIZE), PAGE_SIZE); /* reserve last page for=
 ERR_PTR */
>  	setup_arch(&command_line);
>  	setup_boot_config();
>  	setup_command_line(command_line);
> --=20
> 2.39.2
>=20

I received a similar(ish) report recently
https://lore.kernel.org/oe-kbuild-all/202404211031.J6l2AfJk-lkp@intel.com/
regarding RISC-V in init/mail.c. Here is the meat of the report in case
you want to avoid going to the actual link:
"
=2E..
   riscv64-linux-ld: section .data LMA [000000000099b000,0000000001424de7] =
overlaps section .text LMA [0000000000104040,000000000213c543]
   riscv64-linux-ld: section .data..percpu LMA [00000000024e2000,0000000002=
6b46e7] overlaps section .rodata LMA [000000000213c580,000000000292d0dd]
   riscv64-linux-ld: section .rodata VMA [ffffffff8213c580,ffffffff8292d0dd=
] overlaps section .data VMA [ffffffff82000000,ffffffff82a89de7]
   init/main.o: in function `rdinit_setup':
>> init/main.c:613:(.init.text+0x358): relocation truncated to fit: R_RISCV=
_GPREL_I against symbol `__setup_start' defined in .init.rodata section in =
=2Etmp_vmlinux.kallsyms1
   net/ipv4/ipconfig.o: in function `ic_dhcp_init_options':
   net/ipv4/ipconfig.c:682:(.init.text+0x9b4): relocation truncated to fit:=
 R_RISCV_GPREL_I against `ic_bootp_cookie'
   net/sunrpc/auth_gss/gss_krb5_mech.o: in function `gss_krb5_prepare_encty=
pe_priority_list':
>> net/sunrpc/auth_gss/gss_krb5_mech.c:213:(.text.gss_krb5_prepare_enctype_=
priority_list+0x9c): relocation truncated to fit: R_RISCV_GPREL_I against `=
gss_krb5_enctypes.0'
   lib/maple_tree.o: in function `mas_leaf_max_gap':
>> lib/maple_tree.c:1512:(.text.mas_leaf_max_gap+0x2b8): relocation truncat=
ed to fit: R_RISCV_GPREL_I against `mt_pivots'
   lib/maple_tree.o: in function `ma_dead_node':
>> lib/maple_tree.c:560:(.text.mas_data_end+0x110): relocation truncated to=
 fit: R_RISCV_GPREL_I against `mt_pivots'
   lib/maple_tree.o: in function `mas_extend_spanning_null':
>> lib/maple_tree.c:3662:(.text.mas_extend_spanning_null+0x69c): relocation=
 truncated to fit: R_RISCV_GPREL_I against `mt_pivots'
   lib/maple_tree.o: in function `mas_mab_cp':
>> lib/maple_tree.c:1943:(.text.mas_mab_cp+0x248): relocation truncated to =
fit: R_RISCV_GPREL_I against `mt_pivots'
   lib/maple_tree.o: in function `mab_mas_cp':
>> lib/maple_tree.c:2000:(.text.mab_mas_cp+0x15c): relocation truncated to =
fit: R_RISCV_GPREL_I against `mt_pivots'
   lib/maple_tree.o: in function `mas_reuse_node':
>> lib/maple_tree.c:3416:(.text.mas_reuse_node+0x17c): relocation truncated=
 to fit: R_RISCV_GPREL_I against `mt_slots'
   lib/maple_tree.o: in function `mt_free_walk':
>> lib/maple_tree.c:5238:(.text.mt_free_walk+0x15c): relocation truncated t=
o fit: R_RISCV_GPREL_I against `mt_slots'
   lib/maple_tree.o: in function `mtree_lookup_walk':
   lib/maple_tree.c:3700:(.text.mtree_lookup_walk+0x94): additional relocat=
ion overflows omitted from the output
=2E..

"

Could the fix that you have posted here be related to that report?
Comments are greatly appreciated.

Best
--

Joel Granados

--s6e23wdofaldi5z4
Content-Type: application/pgp-signature; name="signature.asc"

-----BEGIN PGP SIGNATURE-----

iQGzBAABCgAdFiEErkcJVyXmMSXOyyeQupfNUreWQU8FAmYvmA0ACgkQupfNUreW
QU/TcAv/R+pAjTDoAeoU3WyOOx6zyEtWCvRsTNWxaadNCk5n4YLTRmFZRke/ETZo
A4yKXDjtCXhcwL7pDR0BicIVEJQa0MujxGb2Re0S5ijajV93/KtJ4UXZri1Ij1la
zBbc0UEhVO39bgFkmtyWFR+4Ln+ugL6hOOO0rN2FQ76i2W6X+stesxjBydf9cmil
fYsHn/UHLBXgsP2wHt6nP6/qT+RvXDG/cfRhYmHUOOAphed5HuK+TKekNGDr2Dxw
VDzxzPleawaT0O8bfKwfGH9qi+AbfK0LanHBJIsTdSAPUbot7K1P5f7IDLgnDUgk
pw6GipBbpEKuSJL5fFrok10uI5Z+6lfiocfI91xRluVUoSJf9ZsvT9l4jTGVmcRU
+gjX/LRFZP4iuVjeiAOZdER7+42QQtxyPWZvnPM/xZ3vOJQ5DmsPYzxDMQqxq2i0
dhWobw9vNWAQMCdqt3kqE52WswbMKFMQNZdxN1/BFIOPCjeZQRkJ/sgz/G1+VsJM
saTJu/RZ
=UHv0
-----END PGP SIGNATURE-----

--s6e23wdofaldi5z4--