[PATCH 1/2] x86/mm/pti: Check unaligned address for pmd clone in pti_clone_pagetable()

[Lai Jiangshan]

From: Lai Jiangshan <laijs@xxxxxxxxxxxxxxxxx>

The commit 825d0b73cd752("x86/mm/pti: Handle unaligned address gracefully
in pti_clone_pagetable()") handles unaligned address well for unmapped
PUD/PMD etc. But unaligned address for pmd_large() or PTI_CLONE_PMD is also
needed to be aware.

For example, when pti_clone_pagetable(start, end, PTI_CLONE_PTE) is
called with @start=@pmd_aligned_addr+100*PAGE_SIZE,
@bug_addr=@pmd_aligned_addr+x*PMD_SIZE and  @end is larger than
@bug_addr+PMD_SIZE+PAGE_SIZE.

So @bug_addr is pmd aligned. If @bug_addr is mapped as large page
and @bug_addr+PMD_SIZE is not large page. It is easy to see that
[@bug_addr+PMD_SIZE, @bug_addr+PMD_SIZE+PAGE_SIZE) is not cloned.
(In the code, @addr=@bug_addr+100*PAGE_SIZE is handled as large page,
and is advanced to @bug_addr+100*PAGE_SIZE+PMD_SIZE which is not
large page mapped and 100 pages is skipped without cloned)

Similar for PTI_CLONE_PMD when @bug_addr+100*PAGE_SIZE+PMD_SIZE
is larger than @end even @bug_addr is not large page.
In the case several pages after @bug_addr+PMD_SIZE is not cloned.

We also use addr = round_up(addr+1, PAGE_SIZE) in another branch for
consistent coding without fixing anything since the addresses are
at least PAGE_ALIGNED.

No real bug is found, this patch is just for the sake of robustness.

Signed-off-by: Lai Jiangshan <laijs@xxxxxxxxxxxxxxxxx>
---
 arch/x86/mm/pti.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/arch/x86/mm/pti.c b/arch/x86/mm/pti.c
index 1aab92930569..a229320515da 100644
--- a/arch/x86/mm/pti.c
+++ b/arch/x86/mm/pti.c
@@ -374,7 +374,7 @@ pti_clone_pgtable(unsigned long start, unsigned long end,
 			 */
 			*target_pmd = *pmd;
 
-			addr += PMD_SIZE;
+			addr = round_up(addr + 1, PMD_SIZE);
 
 		} else if (level == PTI_CLONE_PTE) {
 
@@ -401,7 +401,7 @@ pti_clone_pgtable(unsigned long start, unsigned long end,
 			/* Clone the PTE */
 			*target_pte = *pte;
 
-			addr += PAGE_SIZE;
+			addr = round_up(addr + 1, PAGE_SIZE);
 
 		} else {
 			BUG();
-- 
2.19.1.6.gb485710b