Messages in this thread | | | Subject | Re: [PATCH] mm, kasan: don't poison boot memory | From | George Kennedy <> | Date | Wed, 24 Feb 2021 09:22:59 -0500 |
| |
On 2/24/2021 5:37 AM, Mike Rapoport wrote: > On Tue, Feb 23, 2021 at 04:46:28PM -0500, George Kennedy wrote: >> Mike, >> >> Still no luck. >> >> [ 30.193723] iscsi: registered transport (iser) >> [ 30.195970] iBFT detected. >> [ 30.196571] BUG: unable to handle page fault for address: ffffffffff240004 > Hmm, we cannot set ibft_addr to early pointer to the ACPI table. > Let's try something more disruptive and move the reservation back to > iscsi_ibft_find.c. > > diff --git a/arch/x86/kernel/acpi/boot.c b/arch/x86/kernel/acpi/boot.c > index 7bdc0239a943..c118dd54a747 100644 > --- a/arch/x86/kernel/acpi/boot.c > +++ b/arch/x86/kernel/acpi/boot.c > @@ -1551,6 +1551,7 @@ void __init acpi_boot_table_init(void) > if (acpi_disabled) > return; > > +#if 0 > /* > * Initialize the ACPI boot-time table parser. > */ > @@ -1558,6 +1559,7 @@ void __init acpi_boot_table_init(void) > disable_acpi(); > return; > } > +#endif > > acpi_table_parse(ACPI_SIG_BOOT, acpi_parse_sbf); > > diff --git a/arch/x86/kernel/setup.c b/arch/x86/kernel/setup.c > index d883176ef2ce..c615ce96c9a2 100644 > --- a/arch/x86/kernel/setup.c > +++ b/arch/x86/kernel/setup.c > @@ -570,16 +570,6 @@ void __init reserve_standard_io_resources(void) > > } > > -static __init void reserve_ibft_region(void) > -{ > - unsigned long addr, size = 0; > - > - addr = find_ibft_region(&size); > - > - if (size) > - memblock_reserve(addr, size); > -} > - > static bool __init snb_gfx_workaround_needed(void) > { > #ifdef CONFIG_PCI > @@ -1032,6 +1022,12 @@ void __init setup_arch(char **cmdline_p) > */ > find_smp_config(); > > + /* > + * Initialize the ACPI boot-time table parser. > + */ > + if (acpi_table_init()) > + disable_acpi(); > + > reserve_ibft_region(); > > early_alloc_pgt_buf(); > diff --git a/drivers/firmware/iscsi_ibft_find.c b/drivers/firmware/iscsi_ibft_find.c > index 64bb94523281..01be513843d6 100644 > --- a/drivers/firmware/iscsi_ibft_find.c > +++ b/drivers/firmware/iscsi_ibft_find.c > @@ -47,7 +47,25 @@ static const struct { > #define VGA_MEM 0xA0000 /* VGA buffer */ > #define VGA_SIZE 0x20000 /* 128kB */ > > -static int __init find_ibft_in_mem(void) > +static void __init *acpi_find_ibft_region(void) > +{ > + int i; > + struct acpi_table_header *table = NULL; > + acpi_status status; > + > + if (acpi_disabled) > + return NULL; > + > + for (i = 0; i < ARRAY_SIZE(ibft_signs) && !ibft_addr; i++) { > + status = acpi_get_table(ibft_signs[i].sign, 0, &table); > + if (ACPI_SUCCESS(status)) > + return table; > + } > + > + return NULL; > +} > + > +static void __init *find_ibft_in_mem(void) > { > unsigned long pos; > unsigned int len = 0; > @@ -70,35 +88,44 @@ static int __init find_ibft_in_mem(void) > /* if the length of the table extends past 1M, > * the table cannot be valid. */ > if (pos + len <= (IBFT_END-1)) { > - ibft_addr = (struct acpi_table_ibft *)virt; > pr_info("iBFT found at 0x%lx.\n", pos); > - goto done; > + return virt; > } > } > } > } > -done: > - return len; > + > + return NULL; > } > + > +static void __init *find_ibft(void) > +{ > + /* iBFT 1.03 section 1.4.3.1 mandates that UEFI machines will > + * only use ACPI for this */ > + if (!efi_enabled(EFI_BOOT)) > + return find_ibft_in_mem(); > + else > + return acpi_find_ibft_region(); > +} > + > /* > * Routine used to find the iSCSI Boot Format Table. The logical > * kernel address is set in the ibft_addr global variable. > */ > -unsigned long __init find_ibft_region(unsigned long *sizep) > +void __init reserve_ibft_region(void) > { > - ibft_addr = NULL; > + struct acpi_table_ibft *table; > + unsigned long size; > > - /* iBFT 1.03 section 1.4.3.1 mandates that UEFI machines will > - * only use ACPI for this */ > + table = find_ibft(); > + if (!table) > + return; > > - if (!efi_enabled(EFI_BOOT)) > - find_ibft_in_mem(); > - > - if (ibft_addr) { > - *sizep = PAGE_ALIGN(ibft_addr->header.length); > - return (u64)virt_to_phys(ibft_addr); > - } > + size = PAGE_ALIGN(table->header.length); > + memblock_reserve(virt_to_phys(table), size); > > - *sizep = 0; > - return 0; > + if (efi_enabled(EFI_BOOT)) > + acpi_put_table(&table->header); > + else > + ibft_addr = table; > } > diff --git a/include/linux/iscsi_ibft.h b/include/linux/iscsi_ibft.h > index b7b45ca82bea..da813c891990 100644 > --- a/include/linux/iscsi_ibft.h > +++ b/include/linux/iscsi_ibft.h > @@ -26,13 +26,9 @@ extern struct acpi_table_ibft *ibft_addr; > * mapped address is set in the ibft_addr variable. > */ > #ifdef CONFIG_ISCSI_IBFT_FIND > -unsigned long find_ibft_region(unsigned long *sizep); > +void reserve_ibft_region(void); > #else > -static inline unsigned long find_ibft_region(unsigned long *sizep) > -{ > - *sizep = 0; > - return 0; > -} > +static inline void reserve_ibft_region(void) {} > #endif > > #endif /* ISCSI_IBFT_H */
Still no luck Mike,
We're back to the original problem where the only thing that worked was to run "SetPageReserved(page)" before calling "kmap(page)". The page is being "freed" before ibft_init() is called as a result of the recent buddy page freeing changes.
[ 30.385207] iscsi: registered transport (iser) [ 30.387462] iBFT detected. [ 30.388042] ================================================================== [ 30.388119] BUG: KASAN: use-after-free in ibft_init+0x134/0xc33 [ 30.388119] Read of size 4 at addr ffff8880be453004 by task swapper/0/1 [ 30.388119] [ 30.388119] CPU: 0 PID: 1 Comm: swapper/0 Not tainted 5.11.0-f9593a0 #11 [ 30.388119] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 0.0.0 02/06/2015 [ 30.388119] Call Trace: [ 30.388119] dump_stack+0xdb/0x120 [ 30.388119] ? ibft_init+0x134/0xc33 [ 30.388119] print_address_description.constprop.7+0x41/0x60 [ 30.388119] ? ibft_init+0x134/0xc33 [ 30.388119] ? ibft_init+0x134/0xc33 [ 30.388119] kasan_report.cold.10+0x78/0xd1 [ 30.388119] ? ibft_init+0x134/0xc33 [ 30.388119] __asan_report_load_n_noabort+0xf/0x20 [ 30.388119] ibft_init+0x134/0xc33 [ 30.388119] ? write_comp_data+0x2f/0x90 [ 30.388119] ? ibft_check_initiator_for+0x159/0x159 [ 30.388119] ? write_comp_data+0x2f/0x90 [ 30.388119] ? ibft_check_initiator_for+0x159/0x159 [ 30.388119] do_one_initcall+0xc4/0x3e0 [ 30.388119] ? perf_trace_initcall_level+0x3e0/0x3e0 [ 30.388119] ? unpoison_range+0x14/0x40 [ 30.388119] ? ____kasan_kmalloc.constprop.5+0x8f/0xc0 [ 30.388119] ? kernel_init_freeable+0x420/0x652
George
>
| |