Commit 647f605276c0b5e3019fcf8ad302d217d87adedc

Authored by Ard Biesheuvel
Committed by Greg Kroah-Hartman
1 parent f9f73c58fe

mm/vmalloc.c: huge-vmap: fail gracefully on unexpected huge vmap mappings

commit 029c54b09599573015a5c18dbe59cbdf42742237 upstream.

Existing code that uses vmalloc_to_page() may assume that any address
for which is_vmalloc_addr() returns true may be passed into
vmalloc_to_page() to retrieve the associated struct page.

This is not un unreasonable assumption to make, but on architectures
that have CONFIG_HAVE_ARCH_HUGE_VMAP=y, it no longer holds, and we need
to ensure that vmalloc_to_page() does not go off into the weeds trying
to dereference huge PUDs or PMDs as table entries.

Given that vmalloc() and vmap() themselves never create huge mappings or
deal with compound pages at all, there is no correct answer in this
case, so return NULL instead, and issue a warning.

When reading /proc/kcore on arm64, you will hit an oops as soon as you
hit the huge mappings used for the various segments that make up the
mapping of vmlinux.  With this patch applied, you will no longer hit the
oops, but the kcore contents willl be incorrect (these regions will be
zeroed out)

We are fixing this for kcore specifically, so it avoids vread() for
those regions.  At least one other problematic user exists, i.e.,
/dev/kmem, but that is currently broken on arm64 for other reasons.

Link: http://lkml.kernel.org/r/20170609082226.26152-1-ard.biesheuvel@linaro.org
Signed-off-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
Acked-by: Mark Rutland <mark.rutland@arm.com>
Reviewed-by: Laura Abbott <labbott@redhat.com>
Cc: Michal Hocko <mhocko@suse.com>
Cc: zhong jiang <zhongjiang@huawei.com>
Cc: Dave Hansen <dave.hansen@intel.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
[ardb: non-trivial backport to v4.9]
Signed-off-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Showing 1 changed file with 12 additions and 2 deletions Side-by-side Diff

... ... @@ -244,11 +244,21 @@
244 244 */
245 245 VIRTUAL_BUG_ON(!is_vmalloc_or_module_addr(vmalloc_addr));
246 246  
  247 + /*
  248 + * Don't dereference bad PUD or PMD (below) entries. This will also
  249 + * identify huge mappings, which we may encounter on architectures
  250 + * that define CONFIG_HAVE_ARCH_HUGE_VMAP=y. Such regions will be
  251 + * identified as vmalloc addresses by is_vmalloc_addr(), but are
  252 + * not [unambiguously] associated with a struct page, so there is
  253 + * no correct value to return for them.
  254 + */
247 255 if (!pgd_none(*pgd)) {
248 256 pud_t *pud = pud_offset(pgd, addr);
249   - if (!pud_none(*pud)) {
  257 + WARN_ON_ONCE(pud_bad(*pud));
  258 + if (!pud_none(*pud) && !pud_bad(*pud)) {
250 259 pmd_t *pmd = pmd_offset(pud, addr);
251   - if (!pmd_none(*pmd)) {
  260 + WARN_ON_ONCE(pmd_bad(*pmd));
  261 + if (!pmd_none(*pmd) && !pmd_bad(*pmd)) {
252 262 pte_t *ptep, pte;
253 263  
254 264 ptep = pte_offset_map(pmd, addr);