lkml.org 
[lkml]   [2019]   [Jun]   [25]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: [PATCH] x86/boot/64: Fix crash if kernel images crosses page table boundary
On Tue, Jun 25, 2019 at 09:04:39PM +0200, Thomas Gleixner wrote:
> On Thu, 20 Jun 2019, Kirill A. Shutemov wrote:
> > @@ -190,18 +190,18 @@ unsigned long __head __startup_64(unsigned long physaddr,
> > pgd[i + 0] = (pgdval_t)p4d + pgtable_flags;
> > pgd[i + 1] = (pgdval_t)p4d + pgtable_flags;
> >
> > - i = (physaddr >> P4D_SHIFT) % PTRS_PER_P4D;
> > - p4d[i + 0] = (pgdval_t)pud + pgtable_flags;
> > - p4d[i + 1] = (pgdval_t)pud + pgtable_flags;
> > + i = physaddr >> P4D_SHIFT;
> > + p4d[(i + 0) % PTRS_PER_P4D] = (pgdval_t)pud + pgtable_flags;
> > + p4d[(i + 1) % PTRS_PER_P4D] = (pgdval_t)pud + pgtable_flags;
> > } else {
> > i = (physaddr >> PGDIR_SHIFT) % PTRS_PER_PGD;
> > pgd[i + 0] = (pgdval_t)pud + pgtable_flags;
> > pgd[i + 1] = (pgdval_t)pud + pgtable_flags;
> > }
> >
> > - i = (physaddr >> PUD_SHIFT) % PTRS_PER_PUD;
> > - pud[i + 0] = (pudval_t)pmd + pgtable_flags;
> > - pud[i + 1] = (pudval_t)pmd + pgtable_flags;
> > + i = physaddr >> PUD_SHIFT;
> > + pud[(i + 0) % PTRS_PER_PUD] = (pudval_t)pmd + pgtable_flags;
> > + pud[(i + 1) % PTRS_PER_PUD] = (pudval_t)pmd + pgtable_flags;
> >
> > pmd_entry = __PAGE_KERNEL_LARGE_EXEC & ~_PAGE_GLOBAL;
> > /* Filter out unsupported __PAGE_KERNEL_* bits: */
> > @@ -211,8 +211,8 @@ unsigned long __head __startup_64(unsigned long physaddr,
> > pmd_entry += physaddr;
> >
> > for (i = 0; i < DIV_ROUND_UP(_end - _text, PMD_SIZE); i++) {
> > - int idx = i + (physaddr >> PMD_SHIFT) % PTRS_PER_PMD;
> > - pmd[idx] = pmd_entry + i * PMD_SIZE;
> > + int idx = i + (physaddr >> PMD_SHIFT);;
>
> double semicolon

Will fix.

> > + pmd[idx % PTRS_PER_PMD] = pmd_entry + i * PMD_SIZE;
>
> This part is functionally equivivalent. So what's the value of this change?

Precedence of operators were broken

idx = i + (physaddr >> PMD_SHIFT) % PTRS_PER_PMD;

reads by compiler as

idx = i + ((physaddr >> PMD_SHIFT) % PTRS_PER_PMD);

not as

idx = (i + (physaddr >> PMD_SHIFT)) % PTRS_PER_PMD;

Therefore 'idx' can become >= PTRS_PER_PMD.

--
Kirill A. Shutemov

\
 
 \ /
  Last update: 2019-06-25 21:31    [W:0.064 / U:15.204 seconds]
©2003-2018 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site