lkml.org 
[lkml]   [2019]   [May]   [6]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.19 95/99] x86/mm/KASLR: Fix the size of the direct mapping section
    Date
    From: Baoquan He <bhe@redhat.com>

    commit ec3937107ab43f3e8b2bc9dad95710043c462ff7 upstream.

    kernel_randomize_memory() uses __PHYSICAL_MASK_SHIFT to calculate
    the maximum amount of system RAM supported. The size of the direct
    mapping section is obtained from the smaller one of the below two
    values:

    (actual system RAM size + padding size) vs (max system RAM size supported)

    This calculation is wrong since commit

    b83ce5ee9147 ("x86/mm/64: Make __PHYSICAL_MASK_SHIFT always 52").

    In it, __PHYSICAL_MASK_SHIFT was changed to be 52, regardless of whether
    the kernel is using 4-level or 5-level page tables. Thus, it will always
    use 4 PB as the maximum amount of system RAM, even in 4-level paging
    mode where it should actually be 64 TB.

    Thus, the size of the direct mapping section will always
    be the sum of the actual system RAM size plus the padding size.

    Even when the amount of system RAM is 64 TB, the following layout will
    still be used. Obviously KALSR will be weakened significantly.

    |____|_______actual RAM_______|_padding_|______the rest_______|
    0 64TB ~120TB

    Instead, it should be like this:

    |____|_______actual RAM_______|_________the rest______________|
    0 64TB ~120TB

    The size of padding region is controlled by
    CONFIG_RANDOMIZE_MEMORY_PHYSICAL_PADDING, which is 10 TB by default.

    The above issue only exists when
    CONFIG_RANDOMIZE_MEMORY_PHYSICAL_PADDING is set to a non-zero value,
    which is the case when CONFIG_MEMORY_HOTPLUG is enabled. Otherwise,
    using __PHYSICAL_MASK_SHIFT doesn't affect KASLR.

    Fix it by replacing __PHYSICAL_MASK_SHIFT with MAX_PHYSMEM_BITS.

    [ bp: Massage commit message. ]

    Fixes: b83ce5ee9147 ("x86/mm/64: Make __PHYSICAL_MASK_SHIFT always 52")
    Signed-off-by: Baoquan He <bhe@redhat.com>
    Signed-off-by: Borislav Petkov <bp@suse.de>
    Reviewed-by: Thomas Garnier <thgarnie@google.com>
    Acked-by: Kirill A. Shutemov <kirill.shutemov@linux.intel.com>
    Cc: "H. Peter Anvin" <hpa@zytor.com>
    Cc: Andy Lutomirski <luto@kernel.org>
    Cc: Dave Hansen <dave.hansen@linux.intel.com>
    Cc: Ingo Molnar <mingo@kernel.org>
    Cc: Kees Cook <keescook@chromium.org>
    Cc: Peter Zijlstra <peterz@infradead.org>
    Cc: Thomas Gleixner <tglx@linutronix.de>
    Cc: frank.ramsay@hpe.com
    Cc: herbert@gondor.apana.org.au
    Cc: kirill@shutemov.name
    Cc: mike.travis@hpe.com
    Cc: thgarnie@google.com
    Cc: x86-ml <x86@kernel.org>
    Cc: yamada.masahiro@socionext.com
    Link: https://lkml.kernel.org/r/20190417083536.GE7065@MiWiFi-R3L-srv
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

    ---
    arch/x86/mm/kaslr.c | 2 +-
    1 file changed, 1 insertion(+), 1 deletion(-)

    --- a/arch/x86/mm/kaslr.c
    +++ b/arch/x86/mm/kaslr.c
    @@ -93,7 +93,7 @@ void __init kernel_randomize_memory(void
    if (!kaslr_memory_enabled())
    return;

    - kaslr_regions[0].size_tb = 1 << (__PHYSICAL_MASK_SHIFT - TB_SHIFT);
    + kaslr_regions[0].size_tb = 1 << (MAX_PHYSMEM_BITS - TB_SHIFT);
    kaslr_regions[1].size_tb = VMALLOC_SIZE_TB;

    /*

    \
     
     \ /
      Last update: 2019-05-06 16:59    [W:4.194 / U:0.012 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site