mirror of
https://github.com/torvalds/linux.git
synced 2024-11-30 16:11:38 +00:00
260364d112
The semantics of pfn_valid() is to check presence of the memory map for a
PFN and not whether a PFN is covered by the linear map. The memory map
may be present for NOMAP memory regions, but they won't be mapped in the
linear mapping. Accessing such regions via __va() when they are
memremap()'ed will cause a crash.
On v5.4.y the crash happens on qemu-arm with UEFI [1]:
<1>[ 0.084476] 8<--- cut here ---
<1>[ 0.084595] Unable to handle kernel paging request at virtual address dfb76000
<1>[ 0.084938] pgd = (ptrval)
<1>[ 0.085038] [dfb76000] *pgd=5f7fe801, *pte=00000000, *ppte=00000000
...
<4>[ 0.093923] [<c0ed6ce8>] (memcpy) from [<c16a06f8>] (dmi_setup+0x60/0x418)
<4>[ 0.094204] [<c16a06f8>] (dmi_setup) from [<c16a38d4>] (arm_dmi_init+0x8/0x10)
<4>[ 0.094408] [<c16a38d4>] (arm_dmi_init) from [<c0302e9c>] (do_one_initcall+0x50/0x228)
<4>[ 0.094619] [<c0302e9c>] (do_one_initcall) from [<c16011e4>] (kernel_init_freeable+0x15c/0x1f8)
<4>[ 0.094841] [<c16011e4>] (kernel_init_freeable) from [<c0f028cc>] (kernel_init+0x8/0x10c)
<4>[ 0.095057] [<c0f028cc>] (kernel_init) from [<c03010e8>] (ret_from_fork+0x14/0x2c)
On kernels v5.10.y and newer the same crash won't reproduce on ARM because
commit b10d6bca87 ("arch, drivers: replace for_each_membock() with
for_each_mem_range()") changed the way memory regions are registered in
the resource tree, but that merely covers up the problem.
On ARM64 memory resources registered in yet another way and there the
issue of wrong usage of pfn_valid() to ensure availability of the linear
map is also covered.
Implement arch_memremap_can_ram_remap() on ARM and ARM64 to prevent access
to NOMAP regions via the linear mapping in memremap().
Link: https://lore.kernel.org/all/Yl65zxGgFzF1Okac@sirena.org.uk
Link: https://lkml.kernel.org/r/20220426060107.7618-1-rppt@kernel.org
Signed-off-by: Mike Rapoport <rppt@linux.ibm.com>
Reported-by: "kernelci.org bot" <bot@kernelci.org>
Tested-by: Mark Brown <broonie@kernel.org>
Reviewed-by: Ard Biesheuvel <ardb@kernel.org>
Acked-by: Catalin Marinas <catalin.marinas@arm.com>
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Cc: Mark Brown <broonie@kernel.org>
Cc: Mark-PK Tsai <mark-pk.tsai@mediatek.com>
Cc: Russell King <linux@armlinux.org.uk>
Cc: Tony Lindgren <tony@atomide.com>
Cc: Will Deacon <will@kernel.org>
Cc: <stable@vger.kernel.org> [5.4+]
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
110 lines
2.5 KiB
C
110 lines
2.5 KiB
C
// SPDX-License-Identifier: GPL-2.0-only
|
|
/*
|
|
* Based on arch/arm/mm/ioremap.c
|
|
*
|
|
* (C) Copyright 1995 1996 Linus Torvalds
|
|
* Hacked for ARM by Phil Blundell <philb@gnu.org>
|
|
* Hacked to allow all architectures to build, and various cleanups
|
|
* by Russell King
|
|
* Copyright (C) 2012 ARM Ltd.
|
|
*/
|
|
|
|
#include <linux/export.h>
|
|
#include <linux/mm.h>
|
|
#include <linux/vmalloc.h>
|
|
#include <linux/io.h>
|
|
|
|
#include <asm/fixmap.h>
|
|
#include <asm/tlbflush.h>
|
|
|
|
static void __iomem *__ioremap_caller(phys_addr_t phys_addr, size_t size,
|
|
pgprot_t prot, void *caller)
|
|
{
|
|
unsigned long last_addr;
|
|
unsigned long offset = phys_addr & ~PAGE_MASK;
|
|
int err;
|
|
unsigned long addr;
|
|
struct vm_struct *area;
|
|
|
|
/*
|
|
* Page align the mapping address and size, taking account of any
|
|
* offset.
|
|
*/
|
|
phys_addr &= PAGE_MASK;
|
|
size = PAGE_ALIGN(size + offset);
|
|
|
|
/*
|
|
* Don't allow wraparound, zero size or outside PHYS_MASK.
|
|
*/
|
|
last_addr = phys_addr + size - 1;
|
|
if (!size || last_addr < phys_addr || (last_addr & ~PHYS_MASK))
|
|
return NULL;
|
|
|
|
/*
|
|
* Don't allow RAM to be mapped.
|
|
*/
|
|
if (WARN_ON(pfn_is_map_memory(__phys_to_pfn(phys_addr))))
|
|
return NULL;
|
|
|
|
area = get_vm_area_caller(size, VM_IOREMAP, caller);
|
|
if (!area)
|
|
return NULL;
|
|
addr = (unsigned long)area->addr;
|
|
area->phys_addr = phys_addr;
|
|
|
|
err = ioremap_page_range(addr, addr + size, phys_addr, prot);
|
|
if (err) {
|
|
vunmap((void *)addr);
|
|
return NULL;
|
|
}
|
|
|
|
return (void __iomem *)(offset + addr);
|
|
}
|
|
|
|
void __iomem *__ioremap(phys_addr_t phys_addr, size_t size, pgprot_t prot)
|
|
{
|
|
return __ioremap_caller(phys_addr, size, prot,
|
|
__builtin_return_address(0));
|
|
}
|
|
EXPORT_SYMBOL(__ioremap);
|
|
|
|
void iounmap(volatile void __iomem *io_addr)
|
|
{
|
|
unsigned long addr = (unsigned long)io_addr & PAGE_MASK;
|
|
|
|
/*
|
|
* We could get an address outside vmalloc range in case
|
|
* of ioremap_cache() reusing a RAM mapping.
|
|
*/
|
|
if (is_vmalloc_addr((void *)addr))
|
|
vunmap((void *)addr);
|
|
}
|
|
EXPORT_SYMBOL(iounmap);
|
|
|
|
void __iomem *ioremap_cache(phys_addr_t phys_addr, size_t size)
|
|
{
|
|
/* For normal memory we already have a cacheable mapping. */
|
|
if (pfn_is_map_memory(__phys_to_pfn(phys_addr)))
|
|
return (void __iomem *)__phys_to_virt(phys_addr);
|
|
|
|
return __ioremap_caller(phys_addr, size, __pgprot(PROT_NORMAL),
|
|
__builtin_return_address(0));
|
|
}
|
|
EXPORT_SYMBOL(ioremap_cache);
|
|
|
|
/*
|
|
* Must be called after early_fixmap_init
|
|
*/
|
|
void __init early_ioremap_init(void)
|
|
{
|
|
early_ioremap_setup();
|
|
}
|
|
|
|
bool arch_memremap_can_ram_remap(resource_size_t offset, size_t size,
|
|
unsigned long flags)
|
|
{
|
|
unsigned long pfn = PHYS_PFN(offset);
|
|
|
|
return pfn_is_map_memory(pfn);
|
|
}
|