linux/arch/powerpc/configs
Michael Ellerman 8adddf349f powerpc/mm/radix: Make Radix require HUGETLB_PAGE
Joel reported weird crashes using skiroot_defconfig, in his case we
jumped into an NX page:

  kernel tried to execute exec-protected page (c000000002bff4f0) - exploit attempt? (uid: 0)
  BUG: Unable to handle kernel instruction fetch
  Faulting instruction address: 0xc000000002bff4f0

Looking at the disassembly, we had simply branched to that address:

  c000000000c001bc  49fff335    bl     c000000002bff4f0

But that didn't match the original kernel image:

  c000000000c001bc  4bfff335    bl     c000000000bff4f0 <kobject_get+0x8>

When STRICT_KERNEL_RWX is enabled, and we're using the radix MMU, we
call radix__change_memory_range() late in boot to change page
protections. We do that both to mark rodata read only and also to mark
init text no-execute. That involves walking the kernel page tables,
and clearing _PAGE_WRITE or _PAGE_EXEC respectively.

With radix we may use hugepages for the linear mapping, so the code in
radix__change_memory_range() uses eg. pmd_huge() to test if it has
found a huge mapping, and if so it stops the page table walk and
changes the PMD permissions.

However if the kernel is built without HUGETLBFS support, pmd_huge()
is just a #define that always returns 0. That causes the code in
radix__change_memory_range() to incorrectly interpret the PMD value as
a pointer to a PTE page rather than as a PTE at the PMD level.

We can see this using `dv` in xmon which also uses pmd_huge():

  0:mon> dv c000000000000000
  pgd  @ 0xc000000001740000
  pgdp @ 0xc000000001740000 = 0x80000000ffffb009
  pudp @ 0xc0000000ffffb000 = 0x80000000ffffa009
  pmdp @ 0xc0000000ffffa000 = 0xc00000000000018f   <- this is a PTE
  ptep @ 0xc000000000000100 = 0xa64bb17da64ab07d   <- kernel text

The end result is we treat the value at 0xc000000000000100 as a PTE
and clear _PAGE_WRITE or _PAGE_EXEC, potentially corrupting the code
at that address.

In Joel's specific case we cleared the sign bit in the offset of the
branch, causing a backward branch to turn into a forward branch which
caused us to branch into a non-executable page. However the exact
nature of the crash depends on kernel version, compiler version, and
other factors.

We need to fix radix__change_memory_range() to not use accessors that
depend on HUGETLBFS, but we also have radix memory hotplug code that
uses pmd_huge() etc that will also need fixing. So for now just
disallow the broken combination of Radix with HUGETLBFS disabled.

The only defconfig we have that is affected is skiroot_defconfig, so
turn on HUGETLBFS there so that it still gets Radix.

Fixes: 566ca99af0 ("powerpc/mm/radix: Add dummy radix_enabled()")
Cc: stable@vger.kernel.org # v4.7+
Reported-by: Joel Stanley <joel@jms.id.au>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
2019-04-17 18:50:26 +10:00
..
40x powerpc/configs: Drop no longer needed CONFIG_DEVKMEM 2017-08-28 22:10:03 +10:00
44x firmware: Drop FIRMWARE_IN_KERNEL Kconfig option 2018-01-25 12:46:30 +01:00
52xx powerpc/configs: Update for CONFIG_FIXED_PHY being selected by CONFIG_OF_MDIO 2017-08-28 22:10:04 +10:00
83xx powerpc: remove retired sbc834x support 2018-05-03 22:32:30 +10:00
85xx powerpc/configs: Update for CONFIG_INPUT_MOUSEDEV=n 2017-08-28 22:10:17 +10:00
85xx-32bit.config powerpc/85xx: Use kconfig fragments 2015-08-07 22:59:19 -05:00
85xx-64bit.config powerpc/85xx: Use kconfig fragments 2015-08-07 22:59:19 -05:00
85xx-hw.config EDAC: Remove EDAC_MM_EDAC 2017-04-10 17:14:41 +02:00
85xx-smp.config powerpc/85xx: Use kconfig fragments 2015-08-07 22:59:19 -05:00
86xx-hw.config powerpc/86xx: Add support for Emerson/Artesyn MVME7100 2016-07-08 20:01:27 -05:00
86xx-smp.config powerpc/86xx: Switch to kconfig fragments approach 2016-03-11 19:19:12 -06:00
adder875_defconfig powerpc/configs: Update for symbol movement only 2017-08-28 22:10:00 +10:00
altivec.config powerpc/85xx: Use kconfig fragments 2015-08-07 22:59:19 -05:00
amigaone_defconfig powerpc/configs: Drop no longer needed CONFIG_SCSI 2017-08-28 22:10:15 +10:00
be.config powerpc/configs: Add a powernv_be_defconfig 2017-07-31 16:56:37 +10:00
book3s_32.config powerpc: Add ppc32_allmodconfig defconfig target 2018-07-24 22:03:15 +10:00
cell_defconfig powerpc/configs: Drop no longer needed CONFIG_IPV6 2017-08-28 22:10:14 +10:00
chrp32_defconfig powerpc/configs: Drop unneeded CONFIG_CRYPTO_ANSI_CPRNG 2017-08-28 22:10:01 +10:00
corenet_basic_defconfig powerpc/85xx: Use kconfig fragments 2015-08-07 22:59:19 -05:00
dpaa.config powerpc/configs/dpaa: enable the Cortina PHY driver 2018-08-08 17:13:45 -05:00
ep88xc_defconfig powerpc/configs: Update for symbol movement only 2017-08-28 22:10:00 +10:00
ep8248e_defconfig powerpc/configs: Drop unneeded CONFIG_CRYPTO_ANSI_CPRNG 2017-08-28 22:10:01 +10:00
fsl-emb-nonhw.config powerpc/configs/85xx: Enable CONFIG_DEBUG_KERNEL 2018-12-21 22:07:54 -06:00
g5_defconfig powerpc/configs: Don't enable PPC_EARLY_DEBUG in defconfigs 2018-12-20 22:21:20 +11:00
gamecube_defconfig powerpc/configs: Update for CONFIG_SND changes 2017-09-20 13:30:09 +10:00
guest.config powerpc/configs: Add KVM guest defconfig 2018-11-26 22:33:37 +11:00
holly_defconfig powerpc/configs: Update for CONFIG_INPUT_MOUSEDEV=n 2017-08-28 22:10:17 +10:00
le.config powerpc/configs: Replace pseries_le_defconfig with a Makefile target using merge_config 2015-06-02 16:54:49 +10:00
linkstation_defconfig powerpc/configs: Update for CONFIG_NF_CT_PROTO_(SCTP|UDPLITE)=y 2017-08-28 22:10:04 +10:00
maple_defconfig powerpc/configs: Don't enable PPC_EARLY_DEBUG in defconfigs 2018-12-20 22:21:20 +11:00
mgcoge_defconfig powerpc/configs: Update for CONFIG_FIXED_PHY being selected by CONFIG_OF_MDIO 2017-08-28 22:10:04 +10:00
mpc83xx_defconfig powerpc/configs: Update for CONFIG_INPUT_MOUSEDEV=n 2017-08-28 22:10:17 +10:00
mpc85xx_basic_defconfig powerpc/85xx: Enable TWR_P102x in mpc85xx_basic_defconfig 2015-12-22 18:23:21 -06:00
mpc86xx_basic_defconfig powerpc/configs: Update for symbol movement only 2017-08-28 22:10:00 +10:00
mpc512x_defconfig configs: get rid of obsolete CONFIG_ENABLE_WARN_DEPRECATED 2019-03-07 18:32:02 -08:00
mpc866_ads_defconfig powerpc/8xx: Remove CPU6 ERRATA Workaround 2018-01-16 23:47:12 +11:00
mpc885_ads_defconfig powerpc/configs: Update for symbol movement only 2017-08-28 22:10:00 +10:00
mpc5200_defconfig powerpc/configs/mpc5200: Drop no longer needed CONFIG_FB 2017-08-28 22:10:18 +10:00
mpc7448_hpc2_defconfig powerpc/configs: Update for CONFIG_INPUT_MOUSEDEV=n 2017-08-28 22:10:17 +10:00
mpc8272_ads_defconfig powerpc/configs: Drop unneeded CONFIG_CRYPTO_ANSI_CPRNG 2017-08-28 22:10:01 +10:00
mvme5100_defconfig powerpc/configs: Update for CONFIG_NF_CT_PROTO_(SCTP|UDPLITE)=y 2017-08-28 22:10:04 +10:00
pasemi_defconfig powerpc/configs: Update for CONFIG_SND changes 2017-09-20 13:30:09 +10:00
pmac32_defconfig powerpc/configs: Don't enable PPC_EARLY_DEBUG in defconfigs 2018-12-20 22:21:20 +11:00
powernv_defconfig powerpc/config: Enable CONFIG_PRINTK_TIME 2018-10-03 15:40:06 +10:00
ppc6xx_defconfig configs: get rid of obsolete CONFIG_ENABLE_WARN_DEPRECATED 2019-03-07 18:32:02 -08:00
ppc40x_defconfig powerpc/configs: Add PPC4xx_OCM to ppc40x_defconfig 2018-12-30 14:00:47 +11:00
ppc44x_defconfig powerpc/configs: Drop removed CONFIG_LOGFS 2017-08-28 22:10:17 +10:00
ppc64_defconfig powerpc/configs: Don't enable PPC_EARLY_DEBUG in defconfigs 2018-12-20 22:21:20 +11:00
ppc64e_defconfig powerpc/configs: Update for CONFIG_SND changes 2017-09-20 13:30:09 +10:00
pq2fads_defconfig powerpc/configs: Drop unneeded CONFIG_CRYPTO_ANSI_CPRNG 2017-08-28 22:10:01 +10:00
ps3_defconfig powerpc/config: Enable CONFIG_PRINTK_TIME 2018-10-03 15:40:06 +10:00
pseries_defconfig powerpc/configs: Remove unnecessary ftrace symbols 2018-11-26 22:33:37 +11:00
skiroot_defconfig powerpc/mm/radix: Make Radix require HUGETLB_PAGE 2019-04-17 18:50:26 +10:00
storcenter_defconfig powerpc: convert storcenter_defconfig to use libata PATA drivers 2016-11-14 20:09:32 +11:00
tqm8xx_defconfig powerpc/configs: Update for CONFIG_FIXED_PHY being selected by CONFIG_OF_MDIO 2017-08-28 22:10:04 +10:00
wii_defconfig ssb: Remove SSB_WARN_ON, SSB_BUG_ON and SSB_DEBUG 2018-08-09 18:47:47 +03:00