Skip to content

Commit

Permalink
RISC-V: Fix FIXMAP area corruption on RV32 systems
Browse files Browse the repository at this point in the history
Currently, various virtual memory areas of Linux RISC-V are organized
in increasing order of their virtual addresses is as follows:
1. User space area (This is lowest area and starts at 0x0)
2. FIXMAP area
3. VMALLOC area
4. Kernel area (This is highest area and starts at PAGE_OFFSET)

The maximum size of user space aread is represented by TASK_SIZE.

On RV32 systems, TASK_SIZE is defined as VMALLOC_START which causes the
user space area to overlap the FIXMAP area. This allows user space apps
to potentially corrupt the FIXMAP area and kernel OF APIs will crash
whenever they access corrupted FDT in the FIXMAP area.

On RV64 systems, TASK_SIZE is set to fixed 256GB and no other areas
happen to overlap so we don't see any FIXMAP area corruptions.

This patch fixes FIXMAP area corruption on RV32 systems by setting
TASK_SIZE to FIXADDR_START. We also move FIXADDR_TOP, FIXADDR_SIZE,
and FIXADDR_START defines to asm/pgtable.h so that we can avoid cyclic
header includes.

Signed-off-by: Anup Patel <anup.patel@wdc.com>
Tested-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Paul Walmsley <paul.walmsley@sifive.com>
  • Loading branch information
Anup Patel authored and Paul Walmsley committed Aug 28, 2019
1 parent a55aa89 commit a256f2e
Show file tree
Hide file tree
Showing 2 changed files with 10 additions and 6 deletions.
4 changes: 0 additions & 4 deletions arch/riscv/include/asm/fixmap.h
Original file line number Diff line number Diff line change
Expand Up @@ -30,10 +30,6 @@ enum fixed_addresses {
__end_of_fixed_addresses
};

#define FIXADDR_SIZE (__end_of_fixed_addresses * PAGE_SIZE)
#define FIXADDR_TOP (VMALLOC_START)
#define FIXADDR_START (FIXADDR_TOP - FIXADDR_SIZE)

#define FIXMAP_PAGE_IO PAGE_KERNEL

#define __early_set_fixmap __set_fixmap
Expand Down
12 changes: 10 additions & 2 deletions arch/riscv/include/asm/pgtable.h
Original file line number Diff line number Diff line change
Expand Up @@ -420,14 +420,22 @@ static inline void pgtable_cache_init(void)
#define VMALLOC_END (PAGE_OFFSET - 1)
#define VMALLOC_START (PAGE_OFFSET - VMALLOC_SIZE)

#define FIXADDR_TOP VMALLOC_START
#ifdef CONFIG_64BIT
#define FIXADDR_SIZE PMD_SIZE
#else
#define FIXADDR_SIZE PGDIR_SIZE
#endif
#define FIXADDR_START (FIXADDR_TOP - FIXADDR_SIZE)

/*
* Task size is 0x4000000000 for RV64 or 0xb800000 for RV32.
* Task size is 0x4000000000 for RV64 or 0x9fc00000 for RV32.
* Note that PGDIR_SIZE must evenly divide TASK_SIZE.
*/
#ifdef CONFIG_64BIT
#define TASK_SIZE (PGDIR_SIZE * PTRS_PER_PGD / 2)
#else
#define TASK_SIZE VMALLOC_START
#define TASK_SIZE FIXADDR_START
#endif

#include <asm-generic/pgtable.h>
Expand Down

0 comments on commit a256f2e

Please sign in to comment.