From f3837ab7adbc1799a3c5648d34e3e27eb70709a6 Mon Sep 17 00:00:00 2001 From: Ira Weiny Date: Fri, 3 Feb 2023 20:06:32 -0800 Subject: [PATCH 1/4] highmem: Enhance is_kmap_addr() to check kmap_local_page() mappings is_kmap_addr() is only looking at the kmap() address range which may cause check_heap_object() to miss checking an overflow on a kmap_local_page() page. Add a check for the kmap_local_page() address range to is_kmap_addr(). Cc: Matthew Wilcox Cc: Al Viro Cc: "Fabio M. De Francesco" Cc: Thomas Gleixner Cc: Christoph Hellwig Cc: Andrew Morton Signed-off-by: Ira Weiny Acked-by: Andrew Morton Signed-off-by: Jens Wiklander --- include/linux/highmem-internal.h | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/include/linux/highmem-internal.h b/include/linux/highmem-internal.h index e098f38422af..a3028e400a9c 100644 --- a/include/linux/highmem-internal.h +++ b/include/linux/highmem-internal.h @@ -152,7 +152,10 @@ static inline void totalhigh_pages_add(long count) static inline bool is_kmap_addr(const void *x) { unsigned long addr = (unsigned long)x; - return addr >= PKMAP_ADDR(0) && addr < PKMAP_ADDR(LAST_PKMAP); + + return (addr >= PKMAP_ADDR(0) && addr < PKMAP_ADDR(LAST_PKMAP)) || + (addr >= __fix_to_virt(FIX_KMAP_END) && + addr < __fix_to_virt(FIX_KMAP_BEGIN)); } #else /* CONFIG_HIGHMEM */ From c83900393aa133d5fefdbf2ab3377c7fbeec0c07 Mon Sep 17 00:00:00 2001 From: Ira Weiny Date: Fri, 3 Feb 2023 20:06:33 -0800 Subject: [PATCH 2/4] tee: Remove vmalloc page support The kernel pages used by shm_get_kernel_pages() are allocated using GFP_KERNEL through the following call stack: trusted_instantiate() trusted_payload_alloc() -> GFP_KERNEL tee_shm_register_kernel_buf() register_shm_helper() shm_get_kernel_pages() Where is one of: trusted_key_unseal() trusted_key_get_random() trusted_key_seal() Remove the vmalloc page support from shm_get_kernel_pages(). Replace with a warn on once. Cc: Al Viro Cc: "Fabio M. De Francesco" Cc: Christoph Hellwig Cc: Linus Torvalds Reviewed-by: Jens Wiklander Signed-off-by: Ira Weiny Reviewed-by: Christoph Hellwig Reviewed-by: Sumit Garg Signed-off-by: Jens Wiklander --- drivers/tee/tee_shm.c | 36 ++++++++++++------------------------ 1 file changed, 12 insertions(+), 24 deletions(-) diff --git a/drivers/tee/tee_shm.c b/drivers/tee/tee_shm.c index 27295bda3e0b..527a6eabc03e 100644 --- a/drivers/tee/tee_shm.c +++ b/drivers/tee/tee_shm.c @@ -24,37 +24,25 @@ static void shm_put_kernel_pages(struct page **pages, size_t page_count) static int shm_get_kernel_pages(unsigned long start, size_t page_count, struct page **pages) { + struct kvec *kiov; size_t n; int rc; - if (is_vmalloc_addr((void *)start)) { - struct page *page; + if (WARN_ON_ONCE(is_vmalloc_addr((void *)start))) + return -EINVAL; - for (n = 0; n < page_count; n++) { - page = vmalloc_to_page((void *)(start + PAGE_SIZE * n)); - if (!page) - return -ENOMEM; + kiov = kcalloc(page_count, sizeof(*kiov), GFP_KERNEL); + if (!kiov) + return -ENOMEM; - get_page(page); - pages[n] = page; - } - rc = page_count; - } else { - struct kvec *kiov; - - kiov = kcalloc(page_count, sizeof(*kiov), GFP_KERNEL); - if (!kiov) - return -ENOMEM; - - for (n = 0; n < page_count; n++) { - kiov[n].iov_base = (void *)(start + n * PAGE_SIZE); - kiov[n].iov_len = PAGE_SIZE; - } - - rc = get_kernel_pages(kiov, page_count, 0, pages); - kfree(kiov); + for (n = 0; n < page_count; n++) { + kiov[n].iov_base = (void *)(start + n * PAGE_SIZE); + kiov[n].iov_len = PAGE_SIZE; } + rc = get_kernel_pages(kiov, page_count, 0, pages); + kfree(kiov); + return rc; } From 0249a75b365911f91b87935bc08a4795a6fa7dd0 Mon Sep 17 00:00:00 2001 From: Ira Weiny Date: Fri, 3 Feb 2023 20:06:34 -0800 Subject: [PATCH 3/4] tee: Remove call to get_kernel_pages() The kernel pages used by shm_get_kernel_pages() are allocated using GFP_KERNEL through the following call stack: trusted_instantiate() trusted_payload_alloc() -> GFP_KERNEL tee_shm_register_kernel_buf() register_shm_helper() shm_get_kernel_pages() Where is one of: trusted_key_unseal() trusted_key_get_random() trusted_key_seal() Because the pages can't be from highmem get_kernel_pages() boils down to a get_page() call. Remove the get_kernel_pages() call and open code the get_page(). In case a highmem page does slip through warn on once for a kmap'ed address. Cc: Jens Wiklander Cc: Al Viro Cc: "Fabio M. De Francesco" Cc: Christoph Hellwig Cc: Linus Torvalds Signed-off-by: Ira Weiny Reviewed-by: Christoph Hellwig Reviewed-by: Sumit Garg Signed-off-by: Jens Wiklander --- drivers/tee/tee_shm.c | 21 ++++++++------------- 1 file changed, 8 insertions(+), 13 deletions(-) diff --git a/drivers/tee/tee_shm.c b/drivers/tee/tee_shm.c index 527a6eabc03e..b1c6231defad 100644 --- a/drivers/tee/tee_shm.c +++ b/drivers/tee/tee_shm.c @@ -11,6 +11,7 @@ #include #include #include +#include #include "tee_private.h" static void shm_put_kernel_pages(struct page **pages, size_t page_count) @@ -24,26 +25,20 @@ static void shm_put_kernel_pages(struct page **pages, size_t page_count) static int shm_get_kernel_pages(unsigned long start, size_t page_count, struct page **pages) { - struct kvec *kiov; + struct page *page; size_t n; - int rc; - if (WARN_ON_ONCE(is_vmalloc_addr((void *)start))) + if (WARN_ON_ONCE(is_vmalloc_addr((void *)start) || + is_kmap_addr((void *)start))) return -EINVAL; - kiov = kcalloc(page_count, sizeof(*kiov), GFP_KERNEL); - if (!kiov) - return -ENOMEM; - + page = virt_to_page(start); for (n = 0; n < page_count; n++) { - kiov[n].iov_base = (void *)(start + n * PAGE_SIZE); - kiov[n].iov_len = PAGE_SIZE; + pages[n] = page + n; + get_page(pages[n]); } - rc = get_kernel_pages(kiov, page_count, 0, pages); - kfree(kiov); - - return rc; + return page_count; } static void release_registered_pages(struct tee_shm *shm) From 816477edfba6e7ab9411acec5f07cfa00e0882f7 Mon Sep 17 00:00:00 2001 From: Ira Weiny Date: Fri, 3 Feb 2023 20:06:35 -0800 Subject: [PATCH 4/4] mm: Remove get_kernel_pages() The only caller to get_kernel_pages() [shm_get_kernel_pages()] has been updated to not need it. Remove get_kernel_pages(). Cc: Mel Gorman Cc: Al Viro Cc: "Fabio M. De Francesco" Cc: Christoph Hellwig Cc: Andrew Morton Acked-by: John Hubbard Signed-off-by: Ira Weiny Acked-by: Andrew Morton Reviewed-by: Christoph Hellwig Reviewed-by: Sumit Garg Signed-off-by: Jens Wiklander --- include/linux/mm.h | 2 -- mm/swap.c | 30 ------------------------------ 2 files changed, 32 deletions(-) diff --git a/include/linux/mm.h b/include/linux/mm.h index 8f857163ac89..2041e6d4fa27 100644 --- a/include/linux/mm.h +++ b/include/linux/mm.h @@ -2095,8 +2095,6 @@ int __account_locked_vm(struct mm_struct *mm, unsigned long pages, bool inc, struct task_struct *task, bool bypass_rlim); struct kvec; -int get_kernel_pages(const struct kvec *iov, int nr_pages, int write, - struct page **pages); struct page *get_dump_page(unsigned long addr); bool folio_mark_dirty(struct folio *folio); diff --git a/mm/swap.c b/mm/swap.c index 70e2063ef43a..4c03ecab698e 100644 --- a/mm/swap.c +++ b/mm/swap.c @@ -158,36 +158,6 @@ void put_pages_list(struct list_head *pages) } EXPORT_SYMBOL(put_pages_list); -/* - * get_kernel_pages() - pin kernel pages in memory - * @kiov: An array of struct kvec structures - * @nr_segs: number of segments to pin - * @write: pinning for read/write, currently ignored - * @pages: array that receives pointers to the pages pinned. - * Should be at least nr_segs long. - * - * Returns number of pages pinned. This may be fewer than the number requested. - * If nr_segs is 0 or negative, returns 0. If no pages were pinned, returns 0. - * Each page returned must be released with a put_page() call when it is - * finished with. - */ -int get_kernel_pages(const struct kvec *kiov, int nr_segs, int write, - struct page **pages) -{ - int seg; - - for (seg = 0; seg < nr_segs; seg++) { - if (WARN_ON(kiov[seg].iov_len != PAGE_SIZE)) - return seg; - - pages[seg] = kmap_to_page(kiov[seg].iov_base); - get_page(pages[seg]); - } - - return seg; -} -EXPORT_SYMBOL_GPL(get_kernel_pages); - typedef void (*move_fn_t)(struct lruvec *lruvec, struct folio *folio); static void lru_add_fn(struct lruvec *lruvec, struct folio *folio)