mirror of
https://github.com/AuxXxilium/linux_dsm_epyc7002.git
synced 2024-12-19 05:49:40 +07:00
8adddf349f
Joel reported weird crashes using skiroot_defconfig, in his case we
jumped into an NX page:
kernel tried to execute exec-protected page (c000000002bff4f0) - exploit attempt? (uid: 0)
BUG: Unable to handle kernel instruction fetch
Faulting instruction address: 0xc000000002bff4f0
Looking at the disassembly, we had simply branched to that address:
c000000000c001bc 49fff335 bl c000000002bff4f0
But that didn't match the original kernel image:
c000000000c001bc 4bfff335 bl c000000000bff4f0 <kobject_get+0x8>
When STRICT_KERNEL_RWX is enabled, and we're using the radix MMU, we
call radix__change_memory_range() late in boot to change page
protections. We do that both to mark rodata read only and also to mark
init text no-execute. That involves walking the kernel page tables,
and clearing _PAGE_WRITE or _PAGE_EXEC respectively.
With radix we may use hugepages for the linear mapping, so the code in
radix__change_memory_range() uses eg. pmd_huge() to test if it has
found a huge mapping, and if so it stops the page table walk and
changes the PMD permissions.
However if the kernel is built without HUGETLBFS support, pmd_huge()
is just a #define that always returns 0. That causes the code in
radix__change_memory_range() to incorrectly interpret the PMD value as
a pointer to a PTE page rather than as a PTE at the PMD level.
We can see this using `dv` in xmon which also uses pmd_huge():
0:mon> dv c000000000000000
pgd @ 0xc000000001740000
pgdp @ 0xc000000001740000 = 0x80000000ffffb009
pudp @ 0xc0000000ffffb000 = 0x80000000ffffa009
pmdp @ 0xc0000000ffffa000 = 0xc00000000000018f <- this is a PTE
ptep @ 0xc000000000000100 = 0xa64bb17da64ab07d <- kernel text
The end result is we treat the value at 0xc000000000000100 as a PTE
and clear _PAGE_WRITE or _PAGE_EXEC, potentially corrupting the code
at that address.
In Joel's specific case we cleared the sign bit in the offset of the
branch, causing a backward branch to turn into a forward branch which
caused us to branch into a non-executable page. However the exact
nature of the crash depends on kernel version, compiler version, and
other factors.
We need to fix radix__change_memory_range() to not use accessors that
depend on HUGETLBFS, but we also have radix memory hotplug code that
uses pmd_huge() etc that will also need fixing. So for now just
disallow the broken combination of Radix with HUGETLBFS disabled.
The only defconfig we have that is affected is skiroot_defconfig, so
turn on HUGETLBFS there so that it still gets Radix.
Fixes: 566ca99af0 ("powerpc/mm/radix: Add dummy radix_enabled()")
Cc: stable@vger.kernel.org # v4.7+
Reported-by: Joel Stanley <joel@jms.id.au>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
302 lines
7.6 KiB
Plaintext
302 lines
7.6 KiB
Plaintext
CONFIG_PPC64=y
|
|
CONFIG_ALTIVEC=y
|
|
CONFIG_VSX=y
|
|
CONFIG_NR_CPUS=2048
|
|
CONFIG_CPU_LITTLE_ENDIAN=y
|
|
CONFIG_KERNEL_XZ=y
|
|
# CONFIG_SWAP is not set
|
|
CONFIG_SYSVIPC=y
|
|
CONFIG_POSIX_MQUEUE=y
|
|
# CONFIG_CROSS_MEMORY_ATTACH is not set
|
|
CONFIG_NO_HZ=y
|
|
CONFIG_HIGH_RES_TIMERS=y
|
|
# CONFIG_CPU_ISOLATION is not set
|
|
CONFIG_IKCONFIG=y
|
|
CONFIG_IKCONFIG_PROC=y
|
|
CONFIG_LOG_BUF_SHIFT=20
|
|
CONFIG_BLK_DEV_INITRD=y
|
|
# CONFIG_RD_GZIP is not set
|
|
# CONFIG_RD_BZIP2 is not set
|
|
# CONFIG_RD_LZMA is not set
|
|
# CONFIG_RD_LZO is not set
|
|
# CONFIG_RD_LZ4 is not set
|
|
CONFIG_CC_OPTIMIZE_FOR_SIZE=y
|
|
CONFIG_EXPERT=y
|
|
# CONFIG_SGETMASK_SYSCALL is not set
|
|
# CONFIG_SYSFS_SYSCALL is not set
|
|
# CONFIG_SHMEM is not set
|
|
# CONFIG_AIO is not set
|
|
CONFIG_PERF_EVENTS=y
|
|
# CONFIG_COMPAT_BRK is not set
|
|
CONFIG_SLAB_FREELIST_HARDENED=y
|
|
CONFIG_JUMP_LABEL=y
|
|
CONFIG_STRICT_KERNEL_RWX=y
|
|
CONFIG_MODULES=y
|
|
CONFIG_MODULE_UNLOAD=y
|
|
CONFIG_MODULE_SIG=y
|
|
CONFIG_MODULE_SIG_FORCE=y
|
|
CONFIG_MODULE_SIG_SHA512=y
|
|
CONFIG_PARTITION_ADVANCED=y
|
|
# CONFIG_MQ_IOSCHED_DEADLINE is not set
|
|
# CONFIG_MQ_IOSCHED_KYBER is not set
|
|
# CONFIG_PPC_VAS is not set
|
|
# CONFIG_PPC_PSERIES is not set
|
|
# CONFIG_PPC_OF_BOOT_TRAMPOLINE is not set
|
|
CONFIG_CPU_FREQ_DEFAULT_GOV_ONDEMAND=y
|
|
CONFIG_CPU_IDLE=y
|
|
CONFIG_HZ_100=y
|
|
CONFIG_KEXEC=y
|
|
CONFIG_IRQ_ALL_CPUS=y
|
|
CONFIG_NUMA=y
|
|
# CONFIG_COMPACTION is not set
|
|
# CONFIG_MIGRATION is not set
|
|
CONFIG_PPC_64K_PAGES=y
|
|
CONFIG_SCHED_SMT=y
|
|
CONFIG_CMDLINE_BOOL=y
|
|
CONFIG_CMDLINE="console=tty0 console=hvc0 ipr.fast_reboot=1 quiet"
|
|
# CONFIG_SECCOMP is not set
|
|
# CONFIG_PPC_MEM_KEYS is not set
|
|
CONFIG_NET=y
|
|
CONFIG_PACKET=y
|
|
CONFIG_UNIX=y
|
|
CONFIG_INET=y
|
|
CONFIG_IP_MULTICAST=y
|
|
CONFIG_NET_IPIP=y
|
|
CONFIG_SYN_COOKIES=y
|
|
# CONFIG_INET_XFRM_MODE_TRANSPORT is not set
|
|
# CONFIG_INET_XFRM_MODE_TUNNEL is not set
|
|
# CONFIG_INET_XFRM_MODE_BEET is not set
|
|
CONFIG_DNS_RESOLVER=y
|
|
# CONFIG_WIRELESS is not set
|
|
CONFIG_UEVENT_HELPER_PATH="/sbin/hotplug"
|
|
CONFIG_DEVTMPFS=y
|
|
CONFIG_DEVTMPFS_MOUNT=y
|
|
CONFIG_MTD=m
|
|
CONFIG_MTD_POWERNV_FLASH=m
|
|
CONFIG_BLK_DEV_LOOP=y
|
|
CONFIG_BLK_DEV_RAM=y
|
|
CONFIG_BLK_DEV_RAM_SIZE=65536
|
|
CONFIG_VIRTIO_BLK=m
|
|
CONFIG_BLK_DEV_NVME=m
|
|
CONFIG_NVME_MULTIPATH=y
|
|
CONFIG_EEPROM_AT24=m
|
|
# CONFIG_CXL is not set
|
|
# CONFIG_OCXL is not set
|
|
CONFIG_BLK_DEV_SD=m
|
|
CONFIG_BLK_DEV_SR=m
|
|
CONFIG_BLK_DEV_SR_VENDOR=y
|
|
CONFIG_CHR_DEV_SG=m
|
|
CONFIG_SCSI_CONSTANTS=y
|
|
CONFIG_SCSI_SCAN_ASYNC=y
|
|
CONFIG_SCSI_FC_ATTRS=y
|
|
CONFIG_SCSI_CXGB3_ISCSI=m
|
|
CONFIG_SCSI_CXGB4_ISCSI=m
|
|
CONFIG_SCSI_BNX2_ISCSI=m
|
|
CONFIG_SCSI_AACRAID=m
|
|
CONFIG_MEGARAID_NEWGEN=y
|
|
CONFIG_MEGARAID_MM=m
|
|
CONFIG_MEGARAID_MAILBOX=m
|
|
CONFIG_MEGARAID_SAS=m
|
|
CONFIG_SCSI_MPT2SAS=m
|
|
CONFIG_SCSI_IPR=m
|
|
# CONFIG_SCSI_IPR_TRACE is not set
|
|
# CONFIG_SCSI_IPR_DUMP is not set
|
|
CONFIG_SCSI_QLA_FC=m
|
|
CONFIG_SCSI_QLA_ISCSI=m
|
|
CONFIG_SCSI_LPFC=m
|
|
CONFIG_SCSI_VIRTIO=m
|
|
CONFIG_SCSI_DH=y
|
|
CONFIG_SCSI_DH_ALUA=m
|
|
CONFIG_ATA=y
|
|
CONFIG_SATA_AHCI=m
|
|
# CONFIG_ATA_SFF is not set
|
|
CONFIG_MD=y
|
|
CONFIG_BLK_DEV_MD=m
|
|
CONFIG_MD_LINEAR=m
|
|
CONFIG_MD_RAID0=m
|
|
CONFIG_MD_RAID1=m
|
|
CONFIG_MD_RAID10=m
|
|
CONFIG_MD_RAID456=m
|
|
CONFIG_MD_MULTIPATH=m
|
|
CONFIG_MD_FAULTY=m
|
|
CONFIG_BLK_DEV_DM=m
|
|
CONFIG_DM_CRYPT=m
|
|
CONFIG_DM_SNAPSHOT=m
|
|
CONFIG_DM_MIRROR=m
|
|
CONFIG_DM_ZERO=m
|
|
CONFIG_DM_MULTIPATH=m
|
|
# CONFIG_NET_VENDOR_3COM is not set
|
|
# CONFIG_NET_VENDOR_ADAPTEC is not set
|
|
# CONFIG_NET_VENDOR_AGERE is not set
|
|
# CONFIG_NET_VENDOR_ALACRITECH is not set
|
|
CONFIG_ACENIC=m
|
|
CONFIG_ACENIC_OMIT_TIGON_I=y
|
|
# CONFIG_NET_VENDOR_AMAZON is not set
|
|
# CONFIG_NET_VENDOR_AMD is not set
|
|
# CONFIG_NET_VENDOR_AQUANTIA is not set
|
|
# CONFIG_NET_VENDOR_ARC is not set
|
|
# CONFIG_NET_VENDOR_ATHEROS is not set
|
|
# CONFIG_NET_VENDOR_AURORA is not set
|
|
CONFIG_TIGON3=m
|
|
CONFIG_BNX2X=m
|
|
# CONFIG_NET_VENDOR_BROCADE is not set
|
|
# CONFIG_NET_VENDOR_CADENCE is not set
|
|
# CONFIG_NET_CADENCE is not set
|
|
# CONFIG_NET_VENDOR_CAVIUM is not set
|
|
CONFIG_CHELSIO_T1=m
|
|
# CONFIG_NET_VENDOR_CISCO is not set
|
|
# CONFIG_NET_VENDOR_CORTINA is not set
|
|
# CONFIG_NET_VENDOR_DEC is not set
|
|
# CONFIG_NET_VENDOR_DLINK is not set
|
|
CONFIG_BE2NET=m
|
|
# CONFIG_NET_VENDOR_EZCHIP is not set
|
|
# CONFIG_NET_VENDOR_HP is not set
|
|
# CONFIG_NET_VENDOR_HUAWEI is not set
|
|
CONFIG_E1000=m
|
|
CONFIG_E1000E=m
|
|
CONFIG_IGB=m
|
|
CONFIG_IXGB=m
|
|
CONFIG_IXGBE=m
|
|
CONFIG_I40E=m
|
|
CONFIG_S2IO=m
|
|
# CONFIG_NET_VENDOR_MARVELL is not set
|
|
CONFIG_MLX4_EN=m
|
|
# CONFIG_MLX4_CORE_GEN2 is not set
|
|
CONFIG_MLX5_CORE=m
|
|
# CONFIG_NET_VENDOR_MICREL is not set
|
|
# CONFIG_NET_VENDOR_MICROSEMI is not set
|
|
CONFIG_MYRI10GE=m
|
|
# CONFIG_NET_VENDOR_NATSEMI is not set
|
|
# CONFIG_NET_VENDOR_NETRONOME is not set
|
|
# CONFIG_NET_VENDOR_NI is not set
|
|
# CONFIG_NET_VENDOR_NVIDIA is not set
|
|
# CONFIG_NET_VENDOR_OKI is not set
|
|
# CONFIG_NET_VENDOR_PACKET_ENGINES is not set
|
|
CONFIG_QLGE=m
|
|
CONFIG_NETXEN_NIC=m
|
|
CONFIG_QED=m
|
|
CONFIG_QEDE=m
|
|
# CONFIG_NET_VENDOR_QUALCOMM is not set
|
|
# CONFIG_NET_VENDOR_RDC is not set
|
|
# CONFIG_NET_VENDOR_REALTEK is not set
|
|
# CONFIG_NET_VENDOR_RENESAS is not set
|
|
# CONFIG_NET_VENDOR_ROCKER is not set
|
|
# CONFIG_NET_VENDOR_SAMSUNG is not set
|
|
# CONFIG_NET_VENDOR_SEEQ is not set
|
|
CONFIG_SFC=m
|
|
# CONFIG_NET_VENDOR_SILAN is not set
|
|
# CONFIG_NET_VENDOR_SIS is not set
|
|
# CONFIG_NET_VENDOR_SMSC is not set
|
|
# CONFIG_NET_VENDOR_SOCIONEXT is not set
|
|
# CONFIG_NET_VENDOR_STMICRO is not set
|
|
# CONFIG_NET_VENDOR_SUN is not set
|
|
# CONFIG_NET_VENDOR_SYNOPSYS is not set
|
|
# CONFIG_NET_VENDOR_TEHUTI is not set
|
|
# CONFIG_NET_VENDOR_TI is not set
|
|
# CONFIG_NET_VENDOR_VIA is not set
|
|
# CONFIG_NET_VENDOR_WIZNET is not set
|
|
# CONFIG_NET_VENDOR_XILINX is not set
|
|
CONFIG_PHYLIB=y
|
|
# CONFIG_USB_NET_DRIVERS is not set
|
|
# CONFIG_WLAN is not set
|
|
CONFIG_INPUT_EVDEV=y
|
|
CONFIG_INPUT_MISC=y
|
|
# CONFIG_SERIO_SERPORT is not set
|
|
# CONFIG_DEVMEM is not set
|
|
CONFIG_SERIAL_8250=y
|
|
CONFIG_SERIAL_8250_CONSOLE=y
|
|
CONFIG_IPMI_HANDLER=y
|
|
CONFIG_IPMI_DEVICE_INTERFACE=y
|
|
CONFIG_IPMI_POWERNV=y
|
|
CONFIG_IPMI_WATCHDOG=y
|
|
CONFIG_HW_RANDOM=y
|
|
CONFIG_TCG_TPM=y
|
|
CONFIG_TCG_TIS_I2C_NUVOTON=y
|
|
CONFIG_I2C=y
|
|
# CONFIG_I2C_COMPAT is not set
|
|
CONFIG_I2C_CHARDEV=y
|
|
# CONFIG_I2C_HELPER_AUTO is not set
|
|
CONFIG_I2C_ALGOBIT=y
|
|
CONFIG_I2C_OPAL=m
|
|
CONFIG_PPS=y
|
|
CONFIG_SENSORS_IBMPOWERNV=m
|
|
CONFIG_DRM=m
|
|
CONFIG_DRM_AST=m
|
|
CONFIG_FB=y
|
|
CONFIG_FIRMWARE_EDID=y
|
|
# CONFIG_VGA_CONSOLE is not set
|
|
CONFIG_FRAMEBUFFER_CONSOLE=y
|
|
CONFIG_LOGO=y
|
|
# CONFIG_LOGO_LINUX_MONO is not set
|
|
# CONFIG_LOGO_LINUX_VGA16 is not set
|
|
CONFIG_HID_GENERIC=m
|
|
CONFIG_HID_A4TECH=y
|
|
CONFIG_HID_BELKIN=y
|
|
CONFIG_HID_CHERRY=y
|
|
CONFIG_HID_CHICONY=y
|
|
CONFIG_HID_CYPRESS=y
|
|
CONFIG_HID_EZKEY=y
|
|
CONFIG_HID_ITE=y
|
|
CONFIG_HID_KENSINGTON=y
|
|
CONFIG_HID_LOGITECH=y
|
|
CONFIG_HID_MICROSOFT=y
|
|
CONFIG_HID_MONTEREY=y
|
|
CONFIG_USB_HIDDEV=y
|
|
CONFIG_USB=m
|
|
CONFIG_USB_XHCI_HCD=m
|
|
CONFIG_USB_EHCI_HCD=m
|
|
# CONFIG_USB_EHCI_HCD_PPC_OF is not set
|
|
CONFIG_USB_OHCI_HCD=m
|
|
CONFIG_USB_STORAGE=m
|
|
CONFIG_RTC_CLASS=y
|
|
CONFIG_RTC_DRV_OPAL=m
|
|
CONFIG_RTC_DRV_GENERIC=m
|
|
CONFIG_VIRT_DRIVERS=y
|
|
CONFIG_VIRTIO_PCI=m
|
|
# CONFIG_IOMMU_SUPPORT is not set
|
|
CONFIG_EXT4_FS=m
|
|
CONFIG_EXT4_FS_POSIX_ACL=y
|
|
CONFIG_EXT4_FS_SECURITY=y
|
|
CONFIG_XFS_FS=m
|
|
CONFIG_XFS_POSIX_ACL=y
|
|
CONFIG_BTRFS_FS=m
|
|
CONFIG_BTRFS_FS_POSIX_ACL=y
|
|
CONFIG_ISO9660_FS=m
|
|
CONFIG_UDF_FS=m
|
|
CONFIG_MSDOS_FS=m
|
|
CONFIG_VFAT_FS=m
|
|
CONFIG_PROC_KCORE=y
|
|
CONFIG_HUGETLBFS=y
|
|
# CONFIG_MISC_FILESYSTEMS is not set
|
|
# CONFIG_NETWORK_FILESYSTEMS is not set
|
|
CONFIG_NLS=y
|
|
CONFIG_NLS_DEFAULT="utf8"
|
|
CONFIG_NLS_CODEPAGE_437=y
|
|
CONFIG_NLS_ASCII=y
|
|
CONFIG_NLS_ISO8859_1=y
|
|
CONFIG_NLS_UTF8=y
|
|
CONFIG_CRC16=y
|
|
CONFIG_CRC_ITU_T=y
|
|
CONFIG_LIBCRC32C=y
|
|
# CONFIG_XZ_DEC_X86 is not set
|
|
# CONFIG_XZ_DEC_IA64 is not set
|
|
# CONFIG_XZ_DEC_ARM is not set
|
|
# CONFIG_XZ_DEC_ARMTHUMB is not set
|
|
# CONFIG_XZ_DEC_SPARC is not set
|
|
CONFIG_PRINTK_TIME=y
|
|
CONFIG_MAGIC_SYSRQ=y
|
|
CONFIG_DEBUG_STACKOVERFLOW=y
|
|
CONFIG_SOFTLOCKUP_DETECTOR=y
|
|
CONFIG_BOOTPARAM_SOFTLOCKUP_PANIC=y
|
|
CONFIG_HARDLOCKUP_DETECTOR=y
|
|
CONFIG_BOOTPARAM_HARDLOCKUP_PANIC=y
|
|
CONFIG_WQ_WATCHDOG=y
|
|
# CONFIG_SCHED_DEBUG is not set
|
|
# CONFIG_FTRACE is not set
|
|
# CONFIG_RUNTIME_TESTING_MENU is not set
|
|
CONFIG_XMON=y
|
|
CONFIG_XMON_DEFAULT=y
|
|
CONFIG_ENCRYPTED_KEYS=y
|
|
# CONFIG_CRYPTO_ECHAINIV is not set
|
|
# CONFIG_CRYPTO_HW is not set
|