Commit 58284a90 authored Nov 13, 2020 by Anshuman Khandual Committed by Will Deacon Nov 13, 2020

arm64/mm: Validate hotplug range before creating linear mapping



During memory hotplug process, the linear mapping should not be created for
a given memory range if that would fall outside the maximum allowed linear
range. Else it might cause memory corruption in the kernel virtual space.

Maximum linear mapping region is [PAGE_OFFSET..(PAGE_END -1)] accommodating
both its ends but excluding PAGE_END. Max physical range that can be mapped
inside this linear mapping range, must also be derived from its end points.

This ensures that arch_add_memory() validates memory hot add range for its
potential linear mapping requirements, before creating it with
__create_pgd_mapping().

Fixes: 4ab21506 ("arm64: Add memory hotplug support")
Signed-off-by: Anshuman Khandual <anshuman.khandual@arm.com>
Reviewed-by: Ard Biesheuvel <ardb@kernel.org>
Cc: Catalin Marinas <catalin.marinas@arm.com>
Cc: Will Deacon <will@kernel.org>
Cc: Mark Rutland <mark.rutland@arm.com>
Cc: Ard Biesheuvel <ardb@kernel.org>
Cc: Steven Price <steven.price@arm.com>
Cc: Robin Murphy <robin.murphy@arm.com>
Cc: David Hildenbrand <david@redhat.com>
Cc: Andrew Morton <akpm@linux-foundation.org>
Cc: linux-arm-kernel@lists.infradead.org
Cc: linux-kernel@vger.kernel.org
Link: https://lore.kernel.org/r/1605252614-761-1-git-send-email-anshuman.khandual@arm.com


Signed-off-by: Will Deacon <will@kernel.org>

parent 04e613de

arch/arm64/mm/mmu.c

+17 −0

Original line number	Diff line number	Diff line
		@@ -1444,11 +1444,28 @@ static void __remove_pgd_mapping(pgd_t *pgdir, unsigned long start, u64 size)
		free_empty_tables(start, end, PAGE_OFFSET, PAGE_END);
		}

		static bool inside_linear_region(u64 start, u64 size)
		{
		/*
		* Linear mapping region is the range [PAGE_OFFSET..(PAGE_END - 1)]
		* accommodating both its ends but excluding PAGE_END. Max physical
		* range which can be mapped inside this linear mapping range, must
		* also be derived from its end points.
		*/
		return start >= __pa(_PAGE_OFFSET(vabits_actual)) &&
		(start + size - 1) <= __pa(PAGE_END - 1);
		}

		int arch_add_memory(int nid, u64 start, u64 size,
		struct mhp_params *params)
		{
		int ret, flags = 0;

		if (!inside_linear_region(start, size)) {
		pr_err("[%llx %llx] is outside linear mapping region\n", start, start + size);
		return -EINVAL;
		}

		if (rodata_full \|\| debug_pagealloc_enabled())
		flags = NO_BLOCK_MAPPINGS \| NO_CONT_MAPPINGS;

Admin message