mirror of
https://github.com/torvalds/linux
synced 2024-09-23 12:56:39 +00:00
742563777e
There are a couple of nasty truncation bugs lurking in the pageattr
code that can be triggered when mapping EFI regions, e.g. when we pass
a cpa->pgd pointer. Because cpa->numpages is a 32-bit value, shifting
left by PAGE_SHIFT will truncate the resultant address to 32-bits.
Viorel-Cătălin managed to trigger this bug on his Dell machine that
provides a ~5GB EFI region which requires 1236992 pages to be mapped.
When calling populate_pud() the end of the region gets calculated
incorrectly in the following buggy expression,
end = start + (cpa->numpages << PAGE_SHIFT);
And only 188416 pages are mapped. Next, populate_pud() gets invoked
for a second time because of the loop in __change_page_attr_set_clr(),
only this time no pages get mapped because shifting the remaining
number of pages (1048576) by PAGE_SHIFT is zero. At which point the
loop in __change_page_attr_set_clr() spins forever because we fail to
map progress.
Hitting this bug depends very much on the virtual address we pick to
map the large region at and how many pages we map on the initial run
through the loop. This explains why this issue was only recently hit
with the introduction of commit
|
||
|---|---|---|
| .. | ||
| kmemcheck | ||
| amdtopology.c | ||
| debug_pagetables.c | ||
| dump_pagetables.c | ||
| extable.c | ||
| fault.c | ||
| gup.c | ||
| highmem_32.c | ||
| hugetlbpage.c | ||
| init.c | ||
| init_32.c | ||
| init_64.c | ||
| iomap_32.c | ||
| ioremap.c | ||
| kasan_init_64.c | ||
| kmmio.c | ||
| Makefile | ||
| mm_internal.h | ||
| mmap.c | ||
| mmio-mod.c | ||
| mpx.c | ||
| numa.c | ||
| numa_32.c | ||
| numa_64.c | ||
| numa_emulation.c | ||
| numa_internal.h | ||
| pageattr-test.c | ||
| pageattr.c | ||
| pat.c | ||
| pat_internal.h | ||
| pat_rbtree.c | ||
| pf_in.c | ||
| pf_in.h | ||
| pgtable.c | ||
| pgtable_32.c | ||
| physaddr.c | ||
| physaddr.h | ||
| setup_nx.c | ||
| srat.c | ||
| testmmiotrace.c | ||
| tlb.c | ||