Skip to content

Commit 41e71db

Browse files
author
Peter Zijlstra
committed
x86/mm: Fix pti_clone_pgtable() alignment assumption
Guenter reported dodgy crashes on an i386-nosmp build using GCC-11 that had the form of endless traps until entry stack exhaust and then #DF from the stack guard. It turned out that pti_clone_pgtable() had alignment assumptions on the start address, notably it hard assumes start is PMD aligned. This is true on x86_64, but very much not true on i386. These assumptions can cause the end condition to malfunction, leading to a 'short' clone. Guess what happens when the user mapping has a short copy of the entry text? Use the correct increment form for addr to avoid alignment assumptions. Fixes: 16a3fe6 ("x86/mm/pti: Clone kernel-image on PTE level for 32 bit") Reported-by: Guenter Roeck <[email protected]> Tested-by: Guenter Roeck <[email protected]> Suggested-by: Thomas Gleixner <[email protected]> Signed-off-by: Peter Zijlstra (Intel) <[email protected]> Link: https://lkml.kernel.org/r/[email protected]
1 parent bf51432 commit 41e71db

File tree

1 file changed

+3
-3
lines changed

1 file changed

+3
-3
lines changed

arch/x86/mm/pti.c

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -374,14 +374,14 @@ pti_clone_pgtable(unsigned long start, unsigned long end,
374374
*/
375375
*target_pmd = *pmd;
376376

377-
addr += PMD_SIZE;
377+
addr = round_up(addr + 1, PMD_SIZE);
378378

379379
} else if (level == PTI_CLONE_PTE) {
380380

381381
/* Walk the page-table down to the pte level */
382382
pte = pte_offset_kernel(pmd, addr);
383383
if (pte_none(*pte)) {
384-
addr += PAGE_SIZE;
384+
addr = round_up(addr + 1, PAGE_SIZE);
385385
continue;
386386
}
387387

@@ -401,7 +401,7 @@ pti_clone_pgtable(unsigned long start, unsigned long end,
401401
/* Clone the PTE */
402402
*target_pte = *pte;
403403

404-
addr += PAGE_SIZE;
404+
addr = round_up(addr + 1, PAGE_SIZE);
405405

406406
} else {
407407
BUG();

0 commit comments

Comments
 (0)