From: will.deacon@arm•com (Will Deacon)
To: linux-arm-kernel@lists•infradead.org
Subject: [PATCH] arm64: kernel: restrict /dev/mem read() calls to linear region
Date: Tue, 25 Apr 2017 17:46:46 +0100 [thread overview]
Message-ID: <20170425164644.GQ24484@arm.com> (raw)
In-Reply-To: <CAKv+Gu_j9GzO2_35Xutg4CbhdK7CekhYcOx0r+OCw_N5uGBWdA@mail.gmail.com>
On Wed, Apr 12, 2017 at 09:31:38AM +0100, Ard Biesheuvel wrote:
> On 12 April 2017 at 09:29, Alexander Graf <agraf@suse•de> wrote:
> >
> >
> > On 12.04.17 10:26, Ard Biesheuvel wrote:
> >>
> >> When running lscpu on an AArch64 system that has SMBIOS version 2.0
> >> tables, it will segfault in the following way:
> >>
> >> Unable to handle kernel paging request at virtual address
> >> ffff8000bfff0000
> >> pgd = ffff8000f9615000
> >> [ffff8000bfff0000] *pgd=0000000000000000
> >> Internal error: Oops: 96000007 [#1] PREEMPT SMP
> >> Modules linked in:
> >> CPU: 0 PID: 1284 Comm: lscpu Not tainted 4.11.0-rc3+ #103
> >> Hardware name: QEMU QEMU Virtual Machine, BIOS 0.0.0 02/06/2015
> >> task: ffff8000fa78e800 task.stack: ffff8000f9780000
> >> PC is at __arch_copy_to_user+0x90/0x220
> >> LR is at read_mem+0xcc/0x140
> >>
> >> This is caused by the fact that lspci issues a read() on /dev/mem at the
> >> offset where it expects to find the SMBIOS structure array. However, this
> >> region is classified as EFI_RUNTIME_SERVICE_DATA (as per the UEFI spec),
> >> and so it is omitted from the linear mapping.
> >>
> >> So let's restrict /dev/mem read/write access to those areas that are
> >> covered by the linear region.
> >>
> >> Reported-by: Alexander Graf <agraf@suse•de>
> >> Fixes: 4dffbfc48d65 ("arm64/efi: mark UEFI reserved regions as
> >> MEMBLOCK_NOMAP")
> >> Signed-off-by: Ard Biesheuvel <ard.biesheuvel@linaro•org>
> >> ---
> >> arch/arm64/mm/mmap.c | 9 +++------
> >> 1 file changed, 3 insertions(+), 6 deletions(-)
> >>
> >> diff --git a/arch/arm64/mm/mmap.c b/arch/arm64/mm/mmap.c
> >> index 7b0d55756eb1..2956240d17d7 100644
> >> --- a/arch/arm64/mm/mmap.c
> >> +++ b/arch/arm64/mm/mmap.c
> >> @@ -18,6 +18,7 @@
> >>
> >> #include <linux/elf.h>
> >> #include <linux/fs.h>
> >> +#include <linux/memblock.h>
> >> #include <linux/mm.h>
> >> #include <linux/mman.h>
> >> #include <linux/export.h>
> >> @@ -103,12 +104,8 @@ void arch_pick_mmap_layout(struct mm_struct *mm)
> >> */
> >> int valid_phys_addr_range(phys_addr_t addr, size_t size)
> >> {
> >> - if (addr < PHYS_OFFSET)
> >> - return 0;
> >> - if (addr + size > __pa(high_memory - 1) + 1)
> >> - return 0;
> >> -
> >> - return 1;
> >> + return memblock_is_map_memory(addr) &&
> >> + memblock_is_map_memory(addr + size - 1);
> >
> >
> > Is that safe? Are we guaranteed that size is less than one page? Otherwise,
> > someone could map a region that spans over a reserved one:
> >
> > [conv mem]
> > [reserved]
> > [conv mem]
> >
>
> Well, I will leave it to the maintainers to decide how elaborate they
> want this logic to become, given that read()ing from /dev/mem is
> something we are not eager to support in the first place.
>
> But indeed, if the start and end of the region are covered by the
> linear region, there could potentially be an uncovered hole in the
> middle.
I think it would be worth handling that case, even if it means we have to
walk over the memblocks which the region overlaps.
Will
next prev parent reply other threads:[~2017-04-25 16:46 UTC|newest]
Thread overview: 8+ messages / expand[flat|nested] mbox.gz Atom feed top
2017-04-12 8:26 [PATCH] arm64: kernel: restrict /dev/mem read() calls to linear region Ard Biesheuvel
2017-04-12 8:29 ` Alexander Graf
2017-04-12 8:31 ` Ard Biesheuvel
2017-04-25 16:46 ` Will Deacon [this message]
2017-04-12 8:33 ` Domenico Andreoli
2017-04-12 9:29 ` Russell King - ARM Linux
2017-04-12 9:37 ` Ard Biesheuvel
2017-04-12 12:44 ` Domenico Andreoli
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20170425164644.GQ24484@arm.com \
--to=will.deacon@arm$(echo .)com \
--cc=linux-arm-kernel@lists$(echo .)infradead.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox