From patchwork Thu Oct 25 01:27:44 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Rafael David Tinoco X-Patchwork-Id: 10655317 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id E8AEA109C for ; Thu, 25 Oct 2018 01:27:56 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id CFCB52B34B for ; Thu, 25 Oct 2018 01:27:56 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id C2E362B648; Thu, 25 Oct 2018 01:27:56 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-3.0 required=2.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,MAILING_LIST_MULTI,RCVD_IN_DNSWL_NONE autolearn=ham version=3.3.1 Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 7BE2C2B34B for ; Thu, 25 Oct 2018 01:27:55 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id 4015B6B0005; Wed, 24 Oct 2018 21:27:54 -0400 (EDT) Delivered-To: linux-mm-outgoing@kvack.org Received: by kanga.kvack.org (Postfix, from userid 40) id 386F56B0007; Wed, 24 Oct 2018 21:27:54 -0400 (EDT) X-Original-To: int-list-linux-mm@kvack.org X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 250F86B000C; Wed, 24 Oct 2018 21:27:54 -0400 (EDT) X-Original-To: linux-mm@kvack.org X-Delivered-To: linux-mm@kvack.org Received: from mail-qt1-f199.google.com (mail-qt1-f199.google.com [209.85.160.199]) by kanga.kvack.org (Postfix) with ESMTP id E8D2C6B0005 for ; Wed, 24 Oct 2018 21:27:53 -0400 (EDT) Received: by mail-qt1-f199.google.com with SMTP id h16-v6so7515604qto.23 for ; Wed, 24 Oct 2018 18:27:53 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:dkim-signature:from:to:cc:subject:date :message-id:mime-version:content-transfer-encoding; bh=ti4MDF9979DMD/586tRYIueeMdaiFl0KtuS7MeNcMD0=; b=XjFPHAC/Kf4x06kyoSwXHiouctRGvzYbq81LyhtEIi5tNBvb8Gjqbs+l2IWlrSuaBK QMAGXyF/XuNoyqsLrYL7ISsA8nJD5X8fuPoP9kduTJ3auyJteMwy4lQSrrrjO5+/H/u2 YPSsNc1OCC066NqCuf/xnBieu+lBOb6LGYe2+4pdxo3kwL+c4SfYDM7wzm74bdb9AjT2 ry8fQgGGE8T5rtkl2dDZ5YHKlCLeifYmiMq2VEgJzvI7FjwFmCETQZTlY+N5vdQvVJOV O4eaw8cDqhJcIA79rgK+u+UTi0yXi0RnbckZBoYPeYhDOvkcDnWIBBGIqsrm8aPIDjw5 Tg/g== X-Gm-Message-State: AGRZ1gIZhKPVSS4g0zy+Z5mhTtPI47hwN9i4EAAyCBhar9RdsMI1FUDs NOZrzdaLwgFtN3zCN0w1tG3HW++KOMlarO5TKum9Sqf8hc6EAwfV8d+oe8uJpZkPStFZt8nF8w5 aC9eUv7sImbiUYUz48raZM2YpzpV6mkUVof75uoLood+81Dkd9Si+YifJZUVwskpRLUAP3VKLQB E0D7BIycqO65WzSIKebfTEx5aaRWI+Tnh08k6J+5iHNcBaUqolFF4Bgr5DUcXwpHcEbzr2nCWvc xfqxgMbe/9I2iVLcfOG99gEN27lYR8lrFVcrgk+G7OsP1ZM3G1NeuwnkL2mL54LbNWRiKe4vPEt wmck0NwrmfEpp/GHDza+XhZg5I0LwgnvYXu8v2tYheJa06tcukWnbp7wu3rt7jC3D8oTtUzZRU7 7 X-Received: by 2002:a37:4d89:: with SMTP id a131-v6mr4606770qkb.181.1540430873559; Wed, 24 Oct 2018 18:27:53 -0700 (PDT) X-Received: by 2002:a37:4d89:: with SMTP id a131-v6mr4606750qkb.181.1540430872865; Wed, 24 Oct 2018 18:27:52 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1540430872; cv=none; d=google.com; s=arc-20160816; b=YJBj5OEFhekJoS1EpxzCkHR7wQ1b46krdSUHfKuf/w2dOYACSlCQs8erS/KDbgbEka ygbcily9S6k7EhcXiwKVEjUHWg+IHlconAjT0fjAStKJ9SHNFemGuhBod/5gi5xIjT3X e7/9LzaUxaxC0WYlCcvT0J/guw6M71r5128fPBTQy+B85HDmV6bdxx+k93BSH7VlTOJO tw6NHp02qQGwzrkrwRzSZyOyEYhS4/xm1q4F0Dqvh+swj66M8DnqD7jLAs+InsGXMF4W 9xB7CptH9Sces4Gz2bW6TfL5dfK4yv/kIr8Smy/9XDEtdfVek8iH1tCFurwPuEj2k8Z5 3JvQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:dkim-signature; bh=ti4MDF9979DMD/586tRYIueeMdaiFl0KtuS7MeNcMD0=; b=AlLg8D5Kww1QwtsNUZ5tpVZodn42JnxcOs+nWaa3a8yTbN1O3X4sAWhx8sublcQbGu 6mspS9qoRcvrGDaLlfUeksDp/siVJ+4+nVcfDxpV/qQBudRmdSMHKCQDaNYTSDf4c4wj EMy8nmZcQV9YjWoR47depNY+bPvnliDM2VOk8cmTvyrWqwbPC8MpUCg1t7KOSgrLFcAp AoVLba3KFeHvM+FnyqkF1MUOiUVVwnVl9qWM/+q7P1rmpmu9PLNuHYKe2Y1Y+FAK0FSQ aHucaKpU8f/jB10TCFoZ7GoFTFJLW/3kCzg/SHQB/7rUZCtqXwLYO5KeU6RpIEeUpg40 3Xtw== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@linaro.org header.s=google header.b=SrQiVam+; spf=pass (google.com: domain of rafael.tinoco@linaro.org designates 209.85.220.65 as permitted sender) smtp.mailfrom=rafael.tinoco@linaro.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linaro.org Received: from mail-sor-f65.google.com (mail-sor-f65.google.com. [209.85.220.65]) by mx.google.com with SMTPS id e55sor7388987qvd.9.2018.10.24.18.27.52 for (Google Transport Security); Wed, 24 Oct 2018 18:27:52 -0700 (PDT) Received-SPF: pass (google.com: domain of rafael.tinoco@linaro.org designates 209.85.220.65 as permitted sender) client-ip=209.85.220.65; Authentication-Results: mx.google.com; dkim=pass header.i=@linaro.org header.s=google header.b=SrQiVam+; spf=pass (google.com: domain of rafael.tinoco@linaro.org designates 209.85.220.65 as permitted sender) smtp.mailfrom=rafael.tinoco@linaro.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linaro.org DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linaro.org; s=google; h=from:to:cc:subject:date:message-id:mime-version :content-transfer-encoding; bh=ti4MDF9979DMD/586tRYIueeMdaiFl0KtuS7MeNcMD0=; b=SrQiVam+Gqw4blhB2ENKcEf/DqjBBJYyiJSpd+OJEidU44Quqj5377QkoWaUuO/Ia9 vHGO8wmj13eOS0WP6JkoDi82FOVWqTfV1anRYlvpiTyt6KzlWjFPWl6S7hOVQxMAiN1Z 0BSlrO+fGRTrqWVcGpTfcXXaAWPmir14beqoQ= X-Google-Smtp-Source: AJdET5cdiofEiy4gc+9VWRrh1nG2NFbH5dHruvbYqxulJBP1r0A3tJ9/ryM+D0XpfoPbSZYSX9crAw== X-Received: by 2002:a0c:fcca:: with SMTP id i10mr4580914qvq.69.1540430872434; Wed, 24 Oct 2018 18:27:52 -0700 (PDT) Received: from workstation.celeiro.br ([138.204.25.17]) by smtp.gmail.com with ESMTPSA id m6-v6sm5338994qta.50.2018.10.24.18.27.47 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Wed, 24 Oct 2018 18:27:51 -0700 (PDT) From: Rafael David Tinoco To: linux-kernel@vger.kernel.org Cc: linux-arm-kernel@lists.infradead.org, linux-mm@kvack.org, Rafael David Tinoco , Russell King , Mark Brown , Sergey Senozhatsky , Nitin Gupta , Minchan Kim Subject: [PATCH 1/2] mm/zsmalloc.c: check encoded object value overflow for PAE Date: Wed, 24 Oct 2018 22:27:44 -0300 Message-Id: <20181025012745.20884-1-rafael.tinoco@linaro.org> X-Mailer: git-send-email 2.19.1 MIME-Version: 1.0 X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: X-Virus-Scanned: ClamAV using ClamSMTP On 32-bit systems, zsmalloc uses HIGHMEM and, when PAE is enabled, the physical frame number might be so big that zsmalloc obj encoding (to location) will break IF architecture does not re-define MAX_PHYSMEM_BITS, causing: [ 497.097843] ================================================================== [ 497.102365] BUG: KASAN: null-ptr-deref in zs_map_object+0xa4/0x2bc [ 497.105933] Read of size 4 at addr 00000000 by task mkfs.ext4/623 [ 497.109684] [ 497.110722] CPU: 2 PID: 623 Comm: mkfs.ext4 Not tainted 4.19.0-rc8-00017-g8239bc6d3307-dirty #15 [ 497.116098] Hardware name: Generic DT based system [ 497.119094] [] (unwind_backtrace) from [] (show_stack+0x20/0x24) [ 497.123819] [] (show_stack) from [] (dump_stack+0xbc/0xe8) [ 497.128299] [] (dump_stack) from [] (kasan_report+0x248/0x390) [ 497.132928] [] (kasan_report) from [] (__asan_load4+0x78/0xb4) [ 497.137530] [] (__asan_load4) from [] (zs_map_object+0xa4/0x2bc) [ 497.142335] [] (zs_map_object) from [] (zram_bvec_rw.constprop.2+0x324/0x8e4 [zram]) [ 497.148294] [] (zram_bvec_rw.constprop.2 [zram]) from [] (zram_make_request+0x234/0x46c [zram]) [ 497.154653] [] (zram_make_request [zram]) from [] (generic_make_request+0x304/0x63c) [ 497.160413] [] (generic_make_request) from [] (submit_bio+0x4c/0x1c8) [ 497.165379] [] (submit_bio) from [] (submit_bh_wbc.constprop.15+0x238/0x26c) [ 497.170775] [] (submit_bh_wbc.constprop.15) from [] (__block_write_full_page+0x524/0x76c) [ 497.176776] [] (__block_write_full_page) from [] (block_write_full_page+0x1bc/0x1d4) [ 497.182549] [] (block_write_full_page) from [] (blkdev_writepage+0x24/0x28) [ 497.187849] [] (blkdev_writepage) from [] (__writepage+0x44/0x78) [ 497.192633] [] (__writepage) from [] (write_cache_pages+0x3b8/0x800) [ 497.197616] [] (write_cache_pages) from [] (generic_writepages+0x74/0xa0) [ 497.202807] [] (generic_writepages) from [] (blkdev_writepages+0x18/0x1c) [ 497.208022] [] (blkdev_writepages) from [] (do_writepages+0x68/0x134) [ 497.213002] [] (do_writepages) from [] (__filemap_fdatawrite_range+0xb0/0xf4) [ 497.218447] [] (__filemap_fdatawrite_range) from [] (file_write_and_wait_range+0x64/0xd0) [ 497.224416] [] (file_write_and_wait_range) from [] (blkdev_fsync+0x54/0x84) [ 497.229749] [] (blkdev_fsync) from [] (vfs_fsync_range+0x70/0xd4) [ 497.234549] [] (vfs_fsync_range) from [] (do_fsync+0x4c/0x80) [ 497.239159] [] (do_fsync) from [] (sys_fsync+0x1c/0x20) [ 497.243407] [] (sys_fsync) from [] (ret_fast_syscall+0x0/0x2c) like in this ARM 32-bit (LPAE enabled), example. That occurs because, if not set, MAX_POSSIBLE_PHYSMEM_BITS will default to BITS_PER_LONG (32) in most cases, and, for PAE, _PFN_BITS will be wrong: which may cause obj variable to overflow if PFN is HIGHMEM and referencing any page above the 4GB watermark. This commit exposes the BUG IF the architecture supports PAE AND does not explicitly set MAX_POSSIBLE_PHYSMEM_BITS to supported value. Link: https://bugs.linaro.org/show_bug.cgi?id=3765#c17 Signed-off-by: Rafael David Tinoco --- mm/zsmalloc.c | 18 ++++++++++++++++-- 1 file changed, 16 insertions(+), 2 deletions(-) diff --git a/mm/zsmalloc.c b/mm/zsmalloc.c index 9da65552e7ca..9c3ff8c2ccbc 100644 --- a/mm/zsmalloc.c +++ b/mm/zsmalloc.c @@ -119,6 +119,15 @@ #define OBJ_INDEX_BITS (BITS_PER_LONG - _PFN_BITS - OBJ_TAG_BITS) #define OBJ_INDEX_MASK ((_AC(1, UL) << OBJ_INDEX_BITS) - 1) +/* + * When using PAE, the obj encoding might overflow if arch does + * not re-define MAX_PHYSMEM_BITS, since zsmalloc uses HIGHMEM. + * This checks for a future bad page access, when de-coding obj. + */ +#define OBJ_OVERFLOW(_pfn) \ + (((unsigned long long) _pfn << (OBJ_INDEX_BITS + OBJ_TAG_BITS)) >= \ + ((_AC(1, ULL)) << MAX_POSSIBLE_PHYSMEM_BITS) ? 1 : 0) + #define FULLNESS_BITS 2 #define CLASS_BITS 8 #define ISOLATED_BITS 3 @@ -871,9 +880,14 @@ static void obj_to_location(unsigned long obj, struct page **page, */ static unsigned long location_to_obj(struct page *page, unsigned int obj_idx) { - unsigned long obj; + unsigned long obj, pfn; + + pfn = page_to_pfn(page); + + if (unlikely(OBJ_OVERFLOW(pfn))) + BUG(); - obj = page_to_pfn(page) << OBJ_INDEX_BITS; + obj = pfn << OBJ_INDEX_BITS; obj |= obj_idx & OBJ_INDEX_MASK; obj <<= OBJ_TAG_BITS;