Re: [PATCH] mm, kasan: don't poison boot memory
From: George Kennedy
Date: Wed Feb 24 2021 - 10:15:15 EST
On 2/24/2021 5:37 AM, Mike Rapoport wrote:
On Tue, Feb 23, 2021 at 04:46:28PM -0500, George Kennedy wrote:
Mike,
Still no luck.
[ 30.193723] iscsi: registered transport (iser)
[ 30.195970] iBFT detected.
[ 30.196571] BUG: unable to handle page fault for address: ffffffffff240004
Hmm, we cannot set ibft_addr to early pointer to the ACPI table.
Let's try something more disruptive and move the reservation back to
iscsi_ibft_find.c.
diff --git a/arch/x86/kernel/acpi/boot.c b/arch/x86/kernel/acpi/boot.c
index 7bdc0239a943..c118dd54a747 100644
--- a/arch/x86/kernel/acpi/boot.c
+++ b/arch/x86/kernel/acpi/boot.c
@@ -1551,6 +1551,7 @@ void __init acpi_boot_table_init(void)
if (acpi_disabled)
return;
+#if 0
/*
* Initialize the ACPI boot-time table parser.
*/
@@ -1558,6 +1559,7 @@ void __init acpi_boot_table_init(void)
disable_acpi();
return;
}
+#endif
acpi_table_parse(ACPI_SIG_BOOT, acpi_parse_sbf);
diff --git a/arch/x86/kernel/setup.c b/arch/x86/kernel/setup.c
index d883176ef2ce..c615ce96c9a2 100644
--- a/arch/x86/kernel/setup.c
+++ b/arch/x86/kernel/setup.c
@@ -570,16 +570,6 @@ void __init reserve_standard_io_resources(void)
}
-static __init void reserve_ibft_region(void)
-{
- unsigned long addr, size = 0;
-
- addr = find_ibft_region(&size);
-
- if (size)
- memblock_reserve(addr, size);
-}
-
static bool __init snb_gfx_workaround_needed(void)
{
#ifdef CONFIG_PCI
@@ -1032,6 +1022,12 @@ void __init setup_arch(char **cmdline_p)
*/
find_smp_config();
+ /*
+ * Initialize the ACPI boot-time table parser.
+ */
+ if (acpi_table_init())
+ disable_acpi();
+
reserve_ibft_region();
early_alloc_pgt_buf();
diff --git a/drivers/firmware/iscsi_ibft_find.c b/drivers/firmware/iscsi_ibft_find.c
index 64bb94523281..01be513843d6 100644
--- a/drivers/firmware/iscsi_ibft_find.c
+++ b/drivers/firmware/iscsi_ibft_find.c
@@ -47,7 +47,25 @@ static const struct {
#define VGA_MEM 0xA0000 /* VGA buffer */
#define VGA_SIZE 0x20000 /* 128kB */
-static int __init find_ibft_in_mem(void)
+static void __init *acpi_find_ibft_region(void)
+{
+ int i;
+ struct acpi_table_header *table = NULL;
+ acpi_status status;
+
+ if (acpi_disabled)
+ return NULL;
+
+ for (i = 0; i < ARRAY_SIZE(ibft_signs) && !ibft_addr; i++) {
+ status = acpi_get_table(ibft_signs[i].sign, 0, &table);
+ if (ACPI_SUCCESS(status))
+ return table;
+ }
+
+ return NULL;
+}
+
+static void __init *find_ibft_in_mem(void)
{
unsigned long pos;
unsigned int len = 0;
@@ -70,35 +88,44 @@ static int __init find_ibft_in_mem(void)
/* if the length of the table extends past 1M,
* the table cannot be valid. */
if (pos + len <= (IBFT_END-1)) {
- ibft_addr = (struct acpi_table_ibft *)virt;
pr_info("iBFT found at 0x%lx.\n", pos);
- goto done;
+ return virt;
}
}
}
}
-done:
- return len;
+
+ return NULL;
}
+
+static void __init *find_ibft(void)
+{
+ /* iBFT 1.03 section 1.4.3.1 mandates that UEFI machines will
+ * only use ACPI for this */
+ if (!efi_enabled(EFI_BOOT))
+ return find_ibft_in_mem();
+ else
+ return acpi_find_ibft_region();
+}
+
/*
* Routine used to find the iSCSI Boot Format Table. The logical
* kernel address is set in the ibft_addr global variable.
*/
-unsigned long __init find_ibft_region(unsigned long *sizep)
+void __init reserve_ibft_region(void)
{
- ibft_addr = NULL;
+ struct acpi_table_ibft *table;
+ unsigned long size;
- /* iBFT 1.03 section 1.4.3.1 mandates that UEFI machines will
- * only use ACPI for this */
+ table = find_ibft();
+ if (!table)
+ return;
- if (!efi_enabled(EFI_BOOT))
- find_ibft_in_mem();
-
- if (ibft_addr) {
- *sizep = PAGE_ALIGN(ibft_addr->header.length);
- return (u64)virt_to_phys(ibft_addr);
- }
+ size = PAGE_ALIGN(table->header.length);
+ memblock_reserve(virt_to_phys(table), size);
- *sizep = 0;
- return 0;
+ if (efi_enabled(EFI_BOOT))
+ acpi_put_table(&table->header);
+ else
+ ibft_addr = table;
}
diff --git a/include/linux/iscsi_ibft.h b/include/linux/iscsi_ibft.h
index b7b45ca82bea..da813c891990 100644
--- a/include/linux/iscsi_ibft.h
+++ b/include/linux/iscsi_ibft.h
@@ -26,13 +26,9 @@ extern struct acpi_table_ibft *ibft_addr;
* mapped address is set in the ibft_addr variable.
*/
#ifdef CONFIG_ISCSI_IBFT_FIND
-unsigned long find_ibft_region(unsigned long *sizep);
+void reserve_ibft_region(void);
#else
-static inline unsigned long find_ibft_region(unsigned long *sizep)
-{
- *sizep = 0;
- return 0;
-}
+static inline void reserve_ibft_region(void) {}
#endif
#endif /* ISCSI_IBFT_H */
Still no luck Mike,
We're back to the original problem where the only thing that worked was
to run "SetPageReserved(page)" before calling "kmap(page)". The page is
being "freed" before ibft_init() is called as a result of the recent
buddy page freeing changes.
[ 30.385207] iscsi: registered transport (iser)
[ 30.387462] iBFT detected.
[ 30.388042]
==================================================================
[ 30.388119] BUG: KASAN: use-after-free in ibft_init+0x134/0xc33
[ 30.388119] Read of size 4 at addr ffff8880be453004 by task swapper/0/1
[ 30.388119]
[ 30.388119] CPU: 0 PID: 1 Comm: swapper/0 Not tainted 5.11.0-f9593a0 #11
[ 30.388119] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996),
BIOS 0.0.0 02/06/2015
[ 30.388119] Call Trace:
[ 30.388119] dump_stack+0xdb/0x120
[ 30.388119] ? ibft_init+0x134/0xc33
[ 30.388119] print_address_description.constprop.7+0x41/0x60
[ 30.388119] ? ibft_init+0x134/0xc33
[ 30.388119] ? ibft_init+0x134/0xc33
[ 30.388119] kasan_report.cold.10+0x78/0xd1
[ 30.388119] ? ibft_init+0x134/0xc33
[ 30.388119] __asan_report_load_n_noabort+0xf/0x20
[ 30.388119] ibft_init+0x134/0xc33
[ 30.388119] ? write_comp_data+0x2f/0x90
[ 30.388119] ? ibft_check_initiator_for+0x159/0x159
[ 30.388119] ? write_comp_data+0x2f/0x90
[ 30.388119] ? ibft_check_initiator_for+0x159/0x159
[ 30.388119] do_one_initcall+0xc4/0x3e0
[ 30.388119] ? perf_trace_initcall_level+0x3e0/0x3e0
[ 30.388119] ? unpoison_range+0x14/0x40
[ 30.388119] ? ____kasan_kmalloc.constprop.5+0x8f/0xc0
[ 30.388119] ? kernel_init_freeable+0x420/0x652
George