• Mike Rapoport's avatar
    arm[64]/memremap: don't abuse pfn_valid() to ensure presence of linear map · 260364d1
    Mike Rapoport authored
    The semantics of pfn_valid() is to check presence of the memory map for a
    PFN and not whether a PFN is covered by the linear map.  The memory map
    may be present for NOMAP memory regions, but they won't be mapped in the
    linear mapping.  Accessing such regions via __va() when they are
    memremap()'ed will cause a crash.
    
    On v5.4.y the crash happens on qemu-arm with UEFI [1]:
    
    <1>[    0.084476] 8<--- cut here ---
    <1>[    0.084595] Unable to handle kernel paging request at virtual address dfb76000
    <1>[    0.084938] pgd = (ptrval)
    <1>[    0.085038] [dfb76000] *pgd=5f7fe801, *pte=00000000, *ppte=00000000
    
    ...
    
    <4>[    0.093923] [<c0ed6ce8>] (memcpy) from [<c16a06f8>] (dmi_setup+0x60/0x418)
    <4>[    0.094204] [<c16a06f8>] (dmi_setup) from [<c16a38d4>] (arm_dmi_init+0x8/0x10)
    <4>[    0.094408] [<c16a38d4>] (arm_dmi_init) from [<c0302e9c>] (do_one_initcall+0x50/0x228)
    <4>[    0.094619] [<c0302e9c>] (do_one_initcall) from [<c16011e4>] (kernel_init_freeable+0x15c/0x1f8)
    <4>[    0.094841] [<c16011e4>] (kernel_init_freeable) from [<c0f028cc>] (kernel_init+0x8/0x10c)
    <4>[    0.095057] [<c0f028cc>] (kernel_init) from [<c03010e8>] (ret_from_fork+0x14/0x2c)
    
    On kernels v5.10.y and newer the same crash won't reproduce on ARM because
    commit b10d6bca ("arch, drivers: replace for_each_membock() with
    for_each_mem_range()") changed the way memory regions are registered in
    the resource tree, but that merely covers up the problem.
    
    On ARM64 memory resources registered in yet another way and there the
    issue of wrong usage of pfn_valid() to ensure availability of the linear
    map is also covered.
    
    Implement arch_memremap_can_ram_remap() on ARM and ARM64 to prevent access
    to NOMAP regions via the linear mapping in memremap().
    
    Link: https://lore.kernel.org/all/Yl65zxGgFzF1Okac@sirena.org.uk
    Link: https://lkml.kernel.org/r/20220426060107.7618-1-rppt@kernel.orgSigned-off-by: default avatarMike Rapoport <rppt@linux.ibm.com>
    Reported-by: default avatar"kernelci.org bot" <bot@kernelci.org>
    Tested-by: default avatarMark Brown <broonie@kernel.org>
    Reviewed-by: default avatarArd Biesheuvel <ardb@kernel.org>
    Acked-by: default avatarCatalin Marinas <catalin.marinas@arm.com>
    Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    Cc: Mark Brown <broonie@kernel.org>
    Cc: Mark-PK Tsai <mark-pk.tsai@mediatek.com>
    Cc: Russell King <linux@armlinux.org.uk>
    Cc: Tony Lindgren <tony@atomide.com>
    Cc: Will Deacon <will@kernel.org>
    Cc: <stable@vger.kernel.org>	[5.4+]
    Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
    260364d1
ioremap.c 12.5 KB