Kefeng Wang
d36febbcd5
powerpc: Fix virt_addr_valid() for 64-bit Book3E & 32-bit
...
commit ffa0b64e3b upstream.
mpe: On 64-bit Book3E vmalloc space starts at 0x8000000000000000.
Because of the way __pa() works we have:
__pa(0x8000000000000000) == 0, and therefore
virt_to_pfn(0x8000000000000000) == 0, and therefore
virt_addr_valid(0x8000000000000000) == true
Which is wrong, virt_addr_valid() should be false for vmalloc space.
In fact all vmalloc addresses that alias with a valid PFN will return
true from virt_addr_valid(). That can cause bugs with hardened usercopy
as described below by Kefeng Wang:
When running ethtool eth0 on 64-bit Book3E, a BUG occurred:
usercopy: Kernel memory exposure attempt detected from SLUB object not in SLUB page?! (offset 0, size 1048)!
kernel BUG at mm/usercopy.c:99
...
usercopy_abort+0x64/0xa0 (unreliable)
__check_heap_object+0x168/0x190
__check_object_size+0x1a0/0x200
dev_ethtool+0x2494/0x2b20
dev_ioctl+0x5d0/0x770
sock_do_ioctl+0xf0/0x1d0
sock_ioctl+0x3ec/0x5a0
__se_sys_ioctl+0xf0/0x160
system_call_exception+0xfc/0x1f0
system_call_common+0xf8/0x200
The code shows below,
data = vzalloc(array_size(gstrings.len, ETH_GSTRING_LEN));
copy_to_user(useraddr, data, gstrings.len * ETH_GSTRING_LEN))
The data is alloced by vmalloc(), virt_addr_valid(ptr) will return true
on 64-bit Book3E, which leads to the panic.
As commit 4dd7554a64 ("powerpc/64: Add VIRTUAL_BUG_ON checks for __va
and __pa addresses") does, make sure the virt addr above PAGE_OFFSET in
the virt_addr_valid() for 64-bit, also add upper limit check to make
sure the virt is below high_memory.
Meanwhile, for 32-bit PAGE_OFFSET is the virtual address of the start
of lowmem, high_memory is the upper low virtual address, the check is
suitable for 32-bit, this will fix the issue mentioned in commit
602946ec2f ("powerpc: Set max_mapnr correctly") too.
On 32-bit there is a similar problem with high memory, that was fixed in
commit 602946ec2f ("powerpc: Set max_mapnr correctly"), but that
commit breaks highmem and needs to be reverted.
We can't easily fix __pa(), we have code that relies on its current
behaviour. So for now add extra checks to virt_addr_valid().
For 64-bit Book3S the extra checks are not necessary, the combination of
virt_to_pfn() and pfn_valid() should yield the correct result, but they
are harmless.
Signed-off-by: Kefeng Wang <wangkefeng.wang@huawei.com >
Reviewed-by: Christophe Leroy <christophe.leroy@csgroup.eu >
[mpe: Add additional change log detail]
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au >
Link: https://lore.kernel.org/r/20220406145802.538416-1-mpe@ellerman.id.au
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org >
2022-04-13 21:01:11 +02:00
..
2022-02-16 12:54:19 +01:00
2022-02-16 12:54:19 +01:00
2011-04-21 16:59:30 -07:00
2019-05-30 11:26:32 -07:00
2017-11-02 11:10:55 +01:00
2020-01-25 12:18:51 -05:00
2018-07-30 22:48:16 +10:00
2020-10-22 14:26:09 +11:00
2020-10-08 12:50:52 +11:00
2019-05-24 17:27:11 +02:00
2020-08-07 10:33:50 -07:00
2017-11-02 11:10:55 +01:00
2021-07-19 09:44:56 +02:00
2020-12-30 11:54:16 +01:00
2017-11-02 11:10:55 +01:00
2019-06-07 19:00:14 +10:00
2019-11-18 22:27:51 +11:00
2019-05-30 11:26:32 -07:00
2020-10-25 14:51:49 -07:00
2020-09-02 11:00:21 +10:00
2019-05-30 11:26:32 -07:00
2017-11-02 11:10:55 +01:00
2020-08-20 15:45:22 -04:00
2020-05-28 23:24:36 +10:00
2018-08-08 00:32:25 +10:00
2021-11-18 14:04:29 +01:00
2020-09-17 13:00:46 -04:00
2017-11-02 11:10:55 +01:00
2019-05-30 11:26:32 -07:00
2020-12-30 11:54:16 +01:00
2017-11-02 11:10:55 +01:00
2019-12-09 13:54:34 -06:00
2021-03-25 09:04:14 +01:00
2022-01-27 10:54:05 +01:00
2019-05-30 11:26:32 -07:00
2019-04-30 22:37:48 +10:00
2020-12-30 11:54:16 +01:00
2021-07-14 16:55:55 +02:00
2020-07-27 00:01:31 +10:00
2020-07-29 23:47:54 +10:00
2019-08-20 21:22:15 +10:00
2017-11-02 11:10:55 +01:00
2020-07-29 21:02:09 +10:00
2019-05-30 11:26:35 -07:00
2019-05-30 11:26:35 -07:00
2021-03-30 14:31:47 +02:00
2017-11-02 11:10:55 +01:00
2019-05-30 11:26:35 -07:00
2020-05-19 00:11:04 +10:00
2019-05-30 11:26:32 -07:00
2020-10-08 21:17:15 +11:00
2020-08-11 14:13:24 -07:00
2019-06-05 17:30:28 +02:00
2020-09-11 09:14:43 +02:00
2020-04-01 14:30:50 +11:00
2020-10-08 12:50:52 +11:00
2018-07-30 22:48:17 +10:00
2020-07-10 12:00:01 +02:00
2015-05-28 15:31:53 +02:00
2019-05-30 11:26:35 -07:00
2020-10-07 22:34:47 +11:00
2012-02-14 14:06:50 -07:00
2020-07-27 14:29:23 -04:00
2019-08-30 09:40:15 +10:00
2019-06-05 17:37:07 +02:00
2020-07-27 00:01:31 +10:00
2020-07-29 21:08:12 +10:00
2021-01-27 11:55:12 +01:00
2017-11-02 11:10:55 +01:00
2017-11-02 11:10:55 +01:00
2020-05-04 22:29:58 +10:00
2019-09-14 00:04:45 +10:00
2017-11-02 11:10:55 +01:00
2021-01-27 11:55:12 +01:00
2021-11-18 14:04:17 +01:00
2022-02-16 12:54:19 +01:00
2020-05-12 19:34:53 +03:00
2017-08-10 23:32:12 +10:00
2019-05-24 17:36:45 +02:00
2019-05-30 11:26:32 -07:00
2017-02-27 18:43:46 -08:00
2019-05-30 11:26:35 -07:00
2019-06-05 17:30:28 +02:00
2019-05-30 11:26:32 -07:00
2020-05-19 00:10:34 +10:00
2020-05-28 23:24:36 +10:00
2017-11-02 11:10:55 +01:00
2020-07-29 23:47:53 +10:00
2020-07-22 23:00:27 +10:00
2017-11-02 11:10:55 +01:00
2020-06-04 19:06:22 -07:00
2019-05-24 17:39:01 +02:00
2020-07-29 21:09:37 +10:00
2022-01-20 09:17:52 +01:00
2019-05-30 11:26:35 -07:00
2019-05-30 11:26:35 -07:00
2019-01-14 20:39:27 +11:00
2020-09-15 22:13:20 +10:00
2022-01-27 10:54:05 +01:00
2020-07-22 00:01:23 +10:00
2017-11-02 11:10:55 +01:00
2013-06-12 12:37:26 +01:00
2020-08-25 01:31:33 +10:00
2017-11-02 11:10:55 +01:00
2020-04-30 12:35:26 +10:00
2017-11-02 11:10:55 +01:00
2020-07-16 13:12:46 +10:00
2017-11-02 11:10:55 +01:00
2020-07-23 17:41:36 +10:00
2019-05-30 11:26:32 -07:00
2017-11-02 11:10:55 +01:00
2019-08-27 13:03:34 +10:00
2022-04-08 14:40:37 +02:00
2020-10-06 07:07:03 +02:00
2019-05-30 11:26:32 -07:00
2018-03-13 15:50:37 +11:00
2020-09-02 11:00:19 +10:00
2018-01-19 22:37:01 +11:00
2017-11-02 11:10:55 +01:00
2019-05-30 11:26:32 -07:00
2020-08-18 13:39:52 +10:00
2021-01-12 20:18:16 +01:00
2017-11-02 11:10:55 +01:00
2017-11-02 11:10:55 +01:00
2020-07-29 23:47:53 +10:00
2021-03-04 11:38:39 +01:00
2017-11-02 11:10:55 +01:00
2018-10-20 13:26:47 +11:00
2019-05-30 11:26:32 -07:00
2020-05-19 00:10:39 +10:00
2020-11-19 23:47:20 +11:00
2020-03-19 16:39:52 +11:00
2019-06-05 17:30:28 +02:00
2020-05-29 16:09:27 +10:00
2020-07-22 21:56:41 +10:00
2020-07-28 12:34:52 +10:00
2020-06-12 11:05:52 -07:00
2019-06-19 17:09:55 +02:00
2020-07-29 21:02:09 +10:00
2019-06-05 17:30:28 +02:00
2021-11-18 14:04:17 +01:00
2020-09-03 14:12:48 +10:00
2021-11-18 14:04:17 +01:00
2020-07-23 15:50:01 +10:00
2017-11-02 11:10:55 +01:00
2017-11-02 11:10:55 +01:00
2019-05-21 11:28:45 +02:00
2019-11-24 15:06:33 -08:00
2020-07-10 12:00:01 +02:00
2019-05-30 11:26:39 -07:00
2021-03-17 17:06:23 +01:00
2017-11-02 11:10:55 +01:00
2019-05-30 11:26:32 -07:00
2020-08-17 14:13:18 +10:00
2017-11-02 11:10:55 +01:00
2019-08-30 09:55:41 +10:00
2018-02-05 21:34:31 +01:00
2019-06-19 17:09:55 +02:00
2020-08-24 14:12:54 +10:00
2019-04-08 12:09:27 +01:00
2020-09-16 12:24:37 +10:00
2020-07-20 22:57:58 +10:00
2020-11-22 10:48:22 -08:00
2020-06-05 12:39:30 -07:00
2020-09-25 00:36:41 +09:00
2019-05-24 17:27:12 +02:00
2017-11-02 11:10:55 +01:00
2015-10-22 16:06:08 +02:00
2018-05-25 12:04:42 +10:00
2019-05-24 17:27:12 +02:00
2019-06-05 17:37:18 +02:00
2017-11-02 11:10:55 +01:00
2019-06-05 17:37:17 +02:00
2019-05-30 11:26:32 -07:00
2018-10-21 19:32:07 +11:00
2019-06-05 17:37:17 +02:00
2019-02-26 23:28:24 +11:00
2019-05-30 11:26:32 -07:00
2017-11-02 11:10:55 +01:00
2020-03-04 22:44:27 +11:00
2019-11-13 00:33:22 +11:00
2019-05-30 11:26:32 -07:00
2020-08-07 10:33:50 -07:00
2019-08-20 21:22:15 +10:00
2020-04-10 15:36:21 -07:00
2022-04-13 21:01:11 +02:00
2021-05-26 12:06:49 +02:00
2017-11-02 11:10:55 +01:00
2019-06-05 17:37:06 +02:00
2020-10-15 13:42:49 +11:00
2020-10-06 07:07:03 +02:00
2020-08-04 23:15:59 +10:00
2019-05-30 11:26:32 -07:00
2020-08-17 13:11:22 +10:00
2020-08-17 13:11:22 +10:00
2019-09-24 15:54:09 -07:00
2019-05-03 01:20:23 +10:00
2019-05-03 01:20:23 +10:00
2020-06-09 09:39:14 -07:00
2020-07-20 22:57:59 +10:00
2020-07-26 23:34:19 +10:00
2016-06-14 13:58:26 +10:00
2019-05-30 11:26:32 -07:00
2018-05-25 12:04:41 +10:00
2021-09-18 13:40:15 +02:00
2019-05-30 11:26:32 -07:00
2020-08-25 01:31:31 +10:00
2020-01-23 21:31:17 +11:00
2019-07-13 16:08:36 -07:00
2019-05-24 17:27:12 +02:00
2020-10-08 21:17:13 +11:00
2022-02-01 17:25:45 +01:00
2019-08-22 23:12:47 +10:00
2019-05-30 11:26:35 -07:00
2020-10-22 09:59:21 -07:00
2020-06-02 20:59:20 +10:00
2021-07-20 16:05:42 +02:00
2019-05-30 11:26:39 -07:00
2019-06-05 17:37:07 +02:00
2019-07-13 16:08:36 -07:00
2019-07-05 00:43:50 +10:00
2021-05-26 12:06:53 +02:00
2020-07-27 00:01:29 +10:00
2020-07-27 00:01:29 +10:00
2020-01-23 21:31:14 +11:00
2019-05-30 11:26:32 -07:00
2020-10-08 21:17:14 +11:00
2018-07-30 22:48:17 +10:00
2022-01-27 10:54:05 +01:00
2018-05-25 12:04:43 +10:00
2019-05-30 11:26:32 -07:00
2020-06-02 20:59:08 +10:00
2020-07-16 13:12:40 +10:00
2017-11-02 11:10:55 +01:00
2017-11-02 11:10:55 +01:00
2020-06-18 12:10:37 -07:00
2019-11-12 12:25:49 +11:00
2021-11-18 14:04:30 +01:00
2019-11-13 00:33:22 +11:00
2019-05-30 11:26:32 -07:00
2020-04-01 14:30:51 +11:00
2020-11-19 23:47:18 +11:00
2018-12-04 19:45:01 +11:00
2017-11-02 11:10:55 +01:00
2020-04-01 13:42:13 +11:00
2020-07-26 23:34:26 +10:00
2020-07-26 23:34:26 +10:00
2020-05-26 22:22:21 +10:00
2021-05-14 09:50:39 +02:00
2020-07-27 00:01:32 +10:00
2020-11-22 10:48:22 -08:00
2020-07-27 00:01:23 +10:00
2020-07-27 00:01:29 +10:00
2019-05-30 11:26:32 -07:00
2019-05-30 11:26:32 -07:00
2019-05-30 11:26:39 -07:00
2019-05-30 11:26:32 -07:00
2020-07-23 17:43:44 +10:00
2018-10-03 15:40:03 +10:00
2018-08-08 00:32:30 +10:00
2020-10-06 11:18:04 +02:00
2020-09-14 23:07:14 +10:00
2019-05-30 11:26:32 -07:00
2019-05-30 11:26:32 -07:00
2021-03-17 17:06:35 +01:00
2020-10-06 23:22:23 +11:00
2021-05-26 12:06:53 +02:00
2018-05-10 23:25:14 +10:00
2019-02-23 22:31:39 +11:00
2019-05-03 01:20:23 +10:00
2019-05-30 11:26:35 -07:00
2019-05-30 11:26:32 -07:00
2020-09-08 22:21:37 -04:00
2020-10-08 21:17:16 +11:00
2020-10-08 21:17:13 +11:00
2020-09-16 12:24:37 +10:00
2018-07-30 22:48:21 +10:00
2018-05-24 16:04:02 +10:00
2020-11-06 14:16:19 +11:00
2019-06-19 17:09:55 +02:00
2019-05-01 16:45:05 +10:00
2019-05-30 11:26:35 -07:00
2019-05-30 11:26:35 -07:00
2019-05-30 11:26:32 -07:00
2019-05-30 11:26:32 -07:00
2022-04-08 14:40:37 +02:00
2019-05-30 11:26:32 -07:00
2019-05-30 11:26:32 -07:00
2019-11-28 17:02:31 +11:00
2019-11-28 17:02:31 +11:00
2017-11-02 11:10:55 +01:00
2017-11-02 11:10:55 +01:00
2020-04-03 00:09:59 +11:00
2020-05-19 00:10:39 +10:00
2018-10-19 15:09:04 +11:00
2020-04-20 16:53:14 +10:00
2020-01-23 21:31:15 +11:00
2020-03-13 21:13:06 +11:00
2020-04-23 10:50:26 +09:00
2017-11-02 11:10:55 +01:00
2019-05-30 11:26:32 -07:00
2019-12-10 10:12:55 +01:00
2016-11-14 11:11:51 +11:00
2017-11-02 11:10:55 +01:00
2020-05-07 22:58:31 +10:00
2020-07-16 13:12:44 +10:00
2019-05-30 11:26:32 -07:00
2018-05-25 12:04:38 +10:00
2019-05-30 11:26:35 -07:00