diff mbox series

5.4.y, 4.14.y, 4.19.y [PATCH] ACPI: tables: x86: Reserve memory occupied by ACPI tables

Message ID 18b4a9fc-800b-975b-8f6c-89d2b06dffb6@oracle.com
State New
Headers show
Series 5.4.y, 4.14.y, 4.19.y [PATCH] ACPI: tables: x86: Reserve memory occupied by ACPI tables | expand

Commit Message

George Kennedy April 30, 2021, 6:55 p.m. UTC 
commit 1a1c130ab7575498eed5bcf7220037ae09cd1f8a upstream.

Upstream commit 1a1c130ab7575498eed5bcf7220037ae09cd1f8a along with 
upstream commit 6998a8800d73116187aad542391ce3b2dd0f9e30 (ACPI: x86: 
Call acpi_boot_table_init() after acpi_table_upgrade() ) fixes the 
following issue.

Mounting an iSCSI volume during boot causes the following crash with a 
KASAN enabled kernel:

[   17.239703] iscsi: registered transport (iser)
[   17.241038] OPA Virtual Network Driver - v1.0
[   17.242833] iBFT detected.
[   17.243593] 


Thank you,
George
diff mbox series

Patch

==================================================================
[   17.243615] BUG: KASAN: use-after-free in ibft_init+0x134/0xab7
[   17.243615] Read of size 4 at addr ffff8880be451004 by task swapper/0/1
[   17.243615]
[   17.243615] CPU: 2 PID: 1 Comm: swapper/0 Not tainted 
4.19.190-rc1-1bd8f1c #1
[   17.243615] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), 
BIOS 0.0.0 02/06/2015
[   17.243615] Call Trace:
[   17.243615]  dump_stack+0xb3/0xf0
[   17.243615]  ? ibft_init+0x134/0xab7
[   17.243615]  print_address_description+0x71/0x239
[   17.243615]  ? ibft_init+0x134/0xab7
[   17.243615]  kasan_report.cold.6+0x242/0x2fe
[   17.243615]  __asan_report_load_n_noabort+0x14/0x20
[   17.243615]  ibft_init+0x134/0xab7
[   17.243615]  ? dcdrbu_init+0x1e6/0x225
[   17.243615]  ? ibft_check_initiator_for+0x14a/0x14a
[   17.243615]  ? ibft_check_initiator_for+0x14a/0x14a
[   17.243615]  do_one_initcall+0xb6/0x3a0
[   17.243615]  ? perf_trace_initcall_level+0x430/0x430
[   17.243615]  ? kasan_unpoison_shadow+0x35/0x50
[   17.243615]  kernel_init_freeable+0x54d/0x64d
[   17.243615]  ? start_kernel+0x7e9/0x7e9
[   17.243615]  ? __switch_to_asm+0x41/0x70
[   17.243615]  ? kasan_check_read+0x11/0x20
[   17.243615]  ? rest_init+0xdc/0xdc
[   17.243615]  kernel_init+0x16/0x180
[   17.243615]  ? rest_init+0xdc/0xdc
[   17.243615]  ret_from_fork+0x35/0x40
[   17.243615]
[   17.243615] The buggy address belongs to the page:
[   17.243615] page:ffffea0002f91440 count:0 mapcount:0 
mapping:0000000000000000 index:0x1
[   17.243615] flags: 0xfffffc0000000()
[   17.243615] raw: 000fffffc0000000 ffffea0002df9708 ffffea0002f91408 
0000000000000000
[   17.243615] raw: 0000000000000001 0000000000000000 00000000ffffffff 
0000000000000000
[   17.243615] page dumped because: kasan: bad access detected
[   17.243615]
[   17.243615] Memory state around the buggy address:
[   17.243615]  ffff8880be450f00: ff ff ff ff ff ff ff ff ff ff ff ff ff 
ff ff ff
[   17.243615]  ffff8880be450f80: ff ff ff ff ff ff ff ff ff ff ff ff ff 
ff ff ff
[   17.243615] >ffff8880be451000: ff ff ff ff ff ff ff ff ff ff ff ff ff 
ff ff ff
[   17.243615]                    ^
[   17.243615]  ffff8880be451080: ff ff ff ff ff ff ff ff ff ff ff ff ff 
ff ff ff
[   17.243615]  ffff8880be451100: ff ff ff ff ff ff ff ff ff ff ff ff ff 
ff ff ff
[   17.243615] 
==================================================================


Patch

commit 1a1c130ab7575498eed5bcf7220037ae09cd1f8a
Author: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Date:   Tue Mar 23 20:26:52 2021 +0100

     ACPI: tables: x86: Reserve memory occupied by ACPI tables

     The following problem has been reported by George Kennedy:

      Since commit 7fef431be9c9 ("mm/page_alloc: place pages to tail
      in __free_pages_core()") the following use after free occurs
      intermittently when ACPI tables are accessed.

      BUG: KASAN: use-after-free in ibft_init+0x134/0xc49
      Read of size 4 at addr ffff8880be453004 by task swapper/0/1
      CPU: 3 PID: 1 Comm: swapper/0 Not tainted 5.12.0-rc1-7a7fd0d #1
      Call Trace:
       dump_stack+0xf6/0x158
       print_address_description.constprop.9+0x41/0x60
       kasan_report.cold.14+0x7b/0xd4
       __asan_report_load_n_noabort+0xf/0x20
       ibft_init+0x134/0xc49
       do_one_initcall+0xc4/0x3e0
       kernel_init_freeable+0x5af/0x66b
       kernel_init+0x16/0x1d0
       ret_from_fork+0x22/0x30

      ACPI tables mapped via kmap() do not have their mapped pages
      reserved and the pages can be "stolen" by the buddy allocator.

     Apparently, on the affected system, the ACPI table in question is
     not located in "reserved" memory, like ACPI NVS or ACPI Data, that
     will not be used by the buddy allocator, so the memory occupied by
     that table has to be explicitly reserved to prevent the buddy
     allocator from using it.

     In order to address this problem, rearrange the initialization of the
     ACPI tables on x86 to locate the initial tables earlier and reserve
     the memory occupied by them.

     The other architectures using ACPI should not be affected by this
     change.

     Link: 
https://lore.kernel.org/linux-acpi/1614802160-29362-1-git-send-email-george.kennedy@oracle.com/ 

     Reported-by: George Kennedy <george.kennedy@oracle.com>
     Tested-by: George Kennedy <george.kennedy@oracle.com>
     Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
     Reviewed-by: Mike Rapoport <rppt@linux.ibm.com>
     Cc: 5.10+ <stable@vger.kernel.org> # 5.10+

diff --git a/arch/x86/kernel/acpi/boot.c b/arch/x86/kernel/acpi/boot.c
index 7bdc023..14cd318 100644
--- a/arch/x86/kernel/acpi/boot.c
+++ b/arch/x86/kernel/acpi/boot.c
@@ -1554,10 +1554,18 @@  void __init acpi_boot_table_init(void)
      /*
       * Initialize the ACPI boot-time table parser.
       */
-    if (acpi_table_init()) {
+    if (acpi_locate_initial_tables())
          disable_acpi();
-        return;
-    }
+    else
+        acpi_reserve_initial_tables();
+}
+
+int __init early_acpi_boot_init(void)
+{
+    if (acpi_disabled)
+        return 1;
+
+    acpi_table_init_complete();

      acpi_table_parse(ACPI_SIG_BOOT, acpi_parse_sbf);

@@ -1570,18 +1578,9 @@  void __init acpi_boot_table_init(void)
          } else {
              printk(KERN_WARNING PREFIX "Disabling ACPI support\n");
              disable_acpi();
-            return;
+            return 1;
          }
      }
-}
-
-int __init early_acpi_boot_init(void)
-{
-    /*
-     * If acpi_disabled, bail out
-     */
-    if (acpi_disabled)
-        return 1;

      /*
       * Process the Multiple APIC Description Table (MADT), if present
diff --git a/arch/x86/kernel/setup.c b/arch/x86/kernel/setup.c
index d883176..5ecd69a 100644
--- a/arch/x86/kernel/setup.c
+++ b/arch/x86/kernel/setup.c
@@ -1045,6 +1045,9 @@  void __init setup_arch(char **cmdline_p)

      cleanup_highmap();

+    /* Look for ACPI tables and reserve memory occupied by them. */
+    acpi_boot_table_init();
+
      memblock_set_current_limit(ISA_END_ADDRESS);
      e820__memblock_setup();

@@ -1136,11 +1139,6 @@  void __init setup_arch(char **cmdline_p)

      early_platform_quirks();

-    /*
-     * Parse the ACPI tables for possible boot-time SMP configuration.
-     */
-    acpi_boot_table_init();
-
      early_acpi_boot_init();

      initmem_init();
diff --git a/drivers/acpi/tables.c b/drivers/acpi/tables.c
index e48690a..9d58104 100644
--- a/drivers/acpi/tables.c
+++ b/drivers/acpi/tables.c
@@ -780,7 +780,7 @@  acpi_status acpi_os_table_override(struct 
acpi_table_header *existing_table,
  }

  /*
- * acpi_table_init()
+ * acpi_locate_initial_tables()
   *
   * find RSDP, find and checksum SDT/XSDT.
   * checksum all tables, print SDT/XSDT
@@ -788,7 +788,7 @@  acpi_status acpi_os_table_override(struct 
acpi_table_header *existing_table,
   * result: sdt_entry[] is initialized
   */

-int __init acpi_table_init(void)
+int __init acpi_locate_initial_tables(void)
  {
      acpi_status status;

@@ -803,9 +803,45 @@  int __init acpi_table_init(void)
      status = acpi_initialize_tables(initial_tables, ACPI_MAX_TABLES, 0);
      if (ACPI_FAILURE(status))
          return -EINVAL;
-    acpi_table_initrd_scan();

+    return 0;
+}
+
+void __init acpi_reserve_initial_tables(void)
+{
+    int i;
+
+    for (i = 0; i < ACPI_MAX_TABLES; i++) {
+        struct acpi_table_desc *table_desc = &initial_tables[i];
+        u64 start = table_desc->address;
+        u64 size = table_desc->length;
+
+        if (!start || !size)
+            break;
+
+        pr_info("Reserving %4s table memory at [mem 0x%llx-0x%llx]\n",
+            table_desc->signature.ascii, start, start + size - 1);
+
+        memblock_reserve(start, size);
+    }
+}
+
+void __init acpi_table_init_complete(void)
+{
+    acpi_table_initrd_scan();
      check_multiple_madt();
+}
+
+int __init acpi_table_init(void)
+{
+    int ret;
+
+    ret = acpi_locate_initial_tables();
+    if (ret)
+        return ret;
+
+    acpi_table_init_complete();
+
      return 0;
  }

diff --git a/include/linux/acpi.h b/include/linux/acpi.h
index fcdaab7..3bdcfc4 100644
--- a/include/linux/acpi.h
+++ b/include/linux/acpi.h
@@ -222,10 +222,14 @@  struct acpi_subtable_proc {
  void __acpi_unmap_table(void __iomem *map, unsigned long size);
  int early_acpi_boot_init(void);
  int acpi_boot_init (void);
+void acpi_boot_table_prepare (void);
  void acpi_boot_table_init (void);
  int acpi_mps_check (void);
  int acpi_numa_init (void);

+int acpi_locate_initial_tables (void);
+void acpi_reserve_initial_tables (void);
+void acpi_table_init_complete (void);
  int acpi_table_init (void);
  int acpi_table_parse(char *id, acpi_tbl_table_handler handler);
  int __init acpi_table_parse_entries(char *id, unsigned long table_size,
@@ -814,9 +818,12 @@  static inline int acpi_boot_init(void)
      return 0;
  }

+static inline void acpi_boot_table_prepare(void)
+{
+}
+
  static inline void acpi_boot_table_init(void)
  {
-    return;
  }

  static inline int acpi_mps_check(void)