Re: [PATCH 1/1] ACPI: fix acpi table use after free

2021-03-22 Thread Rafael J. Wysocki
On Sat, Mar 20, 2021 at 9:25 AM Mike Rapoport wrote: > > On Thu, Mar 18, 2021 at 04:22:37PM +0100, Rafael J. Wysocki wrote: > > On Thu, Mar 18, 2021 at 11:50 AM Rafael J. Wysocki > > wrote: > > > > > > On Thu, Mar 18, 2021 at 8:25 AM Mike Rapoport wrote: > > > > > > > > On Wed, Mar 17, 2021 at

Re: [PATCH 1/1] ACPI: fix acpi table use after free

2021-03-20 Thread Mike Rapoport
On Thu, Mar 18, 2021 at 04:22:37PM +0100, Rafael J. Wysocki wrote: > On Thu, Mar 18, 2021 at 11:50 AM Rafael J. Wysocki wrote: > > > > On Thu, Mar 18, 2021 at 8:25 AM Mike Rapoport wrote: > > > > > > On Wed, Mar 17, 2021 at 09:14:37PM +0100, Rafael J. Wysocki wrote: > > > > On Monday, March 15, 2

Re: [PATCH 1/1] ACPI: fix acpi table use after free

2021-03-18 Thread Rafael J. Wysocki
On Wed, Mar 17, 2021 at 11:28 PM George Kennedy wrote: > > > > On 3/17/2021 4:14 PM, Rafael J. Wysocki wrote: > > On Monday, March 15, 2021 5:19:29 PM CET Rafael J. Wysocki wrote: > >> On Sun, Mar 14, 2021 at 8:00 PM Mike Rapoport wrote: > >>> On Thu, Mar 11, 2021 at 04:36:31PM +0100, Rafael J. W

Re: [PATCH 1/1] ACPI: fix acpi table use after free

2021-03-18 Thread Rafael J. Wysocki
On Thu, Mar 18, 2021 at 11:50 AM Rafael J. Wysocki wrote: > > On Thu, Mar 18, 2021 at 8:25 AM Mike Rapoport wrote: > > > > On Wed, Mar 17, 2021 at 09:14:37PM +0100, Rafael J. Wysocki wrote: > > > On Monday, March 15, 2021 5:19:29 PM CET Rafael J. Wysocki wrote: > > > > On Sun, Mar 14, 2021 at 8:0

Re: [PATCH 1/1] ACPI: fix acpi table use after free

2021-03-18 Thread Rafael J. Wysocki
On Thu, Mar 18, 2021 at 8:25 AM Mike Rapoport wrote: > > On Wed, Mar 17, 2021 at 09:14:37PM +0100, Rafael J. Wysocki wrote: > > On Monday, March 15, 2021 5:19:29 PM CET Rafael J. Wysocki wrote: > > > On Sun, Mar 14, 2021 at 8:00 PM Mike Rapoport wrote: > > > > > > > > On Thu, Mar 11, 2021 at 04:3

Re: [PATCH 1/1] ACPI: fix acpi table use after free

2021-03-18 Thread Mike Rapoport
On Wed, Mar 17, 2021 at 09:14:37PM +0100, Rafael J. Wysocki wrote: > On Monday, March 15, 2021 5:19:29 PM CET Rafael J. Wysocki wrote: > > On Sun, Mar 14, 2021 at 8:00 PM Mike Rapoport wrote: > > > > > > On Thu, Mar 11, 2021 at 04:36:31PM +0100, Rafael J. Wysocki wrote: > > > > On Wed, Mar 10, 202

Re: [PATCH 1/1] ACPI: fix acpi table use after free

2021-03-17 Thread George Kennedy
On 3/17/2021 4:14 PM, Rafael J. Wysocki wrote: On Monday, March 15, 2021 5:19:29 PM CET Rafael J. Wysocki wrote: On Sun, Mar 14, 2021 at 8:00 PM Mike Rapoport wrote: On Thu, Mar 11, 2021 at 04:36:31PM +0100, Rafael J. Wysocki wrote: On Wed, Mar 10, 2021 at 8:47 PM David Hildenbrand wrote:

Re: [PATCH 1/1] ACPI: fix acpi table use after free

2021-03-17 Thread Rafael J. Wysocki
On Monday, March 15, 2021 5:19:29 PM CET Rafael J. Wysocki wrote: > On Sun, Mar 14, 2021 at 8:00 PM Mike Rapoport wrote: > > > > On Thu, Mar 11, 2021 at 04:36:31PM +0100, Rafael J. Wysocki wrote: > > > On Wed, Mar 10, 2021 at 8:47 PM David Hildenbrand > > > wrote: > > > > > > > > > > There is so

Re: [PATCH 1/1] ACPI: fix acpi table use after free

2021-03-15 Thread Rafael J. Wysocki
On Mon, Mar 15, 2021 at 5:19 PM Rafael J. Wysocki wrote: > > On Sun, Mar 14, 2021 at 8:00 PM Mike Rapoport wrote: > > > > On Thu, Mar 11, 2021 at 04:36:31PM +0100, Rafael J. Wysocki wrote: > > > On Wed, Mar 10, 2021 at 8:47 PM David Hildenbrand > > > wrote: > > > > > > > > > > There is some car

Re: [PATCH 1/1] ACPI: fix acpi table use after free

2021-03-15 Thread Rafael J. Wysocki
On Sun, Mar 14, 2021 at 8:00 PM Mike Rapoport wrote: > > On Thu, Mar 11, 2021 at 04:36:31PM +0100, Rafael J. Wysocki wrote: > > On Wed, Mar 10, 2021 at 8:47 PM David Hildenbrand wrote: > > > > > > > > There is some care that should be taken to make sure we get the order > > > > right, but I don't

Re: [PATCH 1/1] ACPI: fix acpi table use after free

2021-03-14 Thread Mike Rapoport
On Thu, Mar 11, 2021 at 04:36:31PM +0100, Rafael J. Wysocki wrote: > On Wed, Mar 10, 2021 at 8:47 PM David Hildenbrand wrote: > > > > > > There is some care that should be taken to make sure we get the order > > > right, but I don't see a fundamental issue here. > > Me neither. > > > > If I unde

Re: [PATCH 1/1] ACPI: fix acpi table use after free

2021-03-11 Thread Rafael J. Wysocki
On Wed, Mar 10, 2021 at 8:47 PM David Hildenbrand wrote: > > > The same could be reproduced via zone shuffling with a little luck. > > But nobody does that in practice. > > >> > >> Dan will most certainly object. And I don't know what makes you speak in > >> absolute words here.

Re: [PATCH 1/1] ACPI: fix acpi table use after free

2021-03-10 Thread David Hildenbrand
The same could be reproduced via zone shuffling with a little luck. But nobody does that in practice. Dan will most certainly object. And I don't know what makes you speak in absolute words here. This would be relatively straightforward to address if ACPICA was not involved in it, but unfor

Re: [PATCH 1/1] ACPI: fix acpi table use after free

2021-03-10 Thread Mike Rapoport
On Wed, Mar 10, 2021 at 08:10:42PM +0100, David Hildenbrand wrote: > > > > > Memory gets allocated and used in a different order, which seems to have > > > > exposed (yet another) latent BUG. > > > > > > Well, you can call it that, or you can say that things worked under > > > certain assumptions

Re: [PATCH 1/1] ACPI: fix acpi table use after free

2021-03-10 Thread David Hildenbrand
Memory gets allocated and used in a different order, which seems to have exposed (yet another) latent BUG. Well, you can call it that, or you can say that things worked under certain assumptions regarding the memory allocation order which are not met any more. The same could be reproduced v

Re: [PATCH 1/1] ACPI: fix acpi table use after free

2021-03-10 Thread Rafael J. Wysocki
On Wed, Mar 10, 2021 at 7:39 PM Rafael J. Wysocki wrote: > > On Fri, Mar 5, 2021 at 2:40 PM David Hildenbrand wrote: > > > > >> The ibft table, for example, is mapped in via acpi_map() and kmap(). The > > >> page for the ibft table is not reserved, so it can end up on the > > >> freelist. > > >

Re: [PATCH 1/1] ACPI: fix acpi table use after free

2021-03-10 Thread Rafael J. Wysocki
On Fri, Mar 5, 2021 at 2:40 PM David Hildenbrand wrote: > > >> The ibft table, for example, is mapped in via acpi_map() and kmap(). The > >> page for the ibft table is not reserved, so it can end up on the freelist. > > > > You appear to be saying that it is not sufficient to kmap() a page in > >

Re: [PATCH 1/1] ACPI: fix acpi table use after free

2021-03-09 Thread Mike Rapoport
On Tue, Mar 09, 2021 at 07:29:51PM +0100, Rafael J. Wysocki wrote: > On Tue, Mar 9, 2021 at 6:54 PM Mike Rapoport wrote: > > > > On Sun, Mar 07, 2021 at 09:46:22AM +0200, Mike Rapoport wrote: > > > Hello Rafael, > > > > > > On Fri, Mar 05, 2021 at 02:30:07PM +0100, Rafael J. Wysocki wrote: > > > >

Re: [PATCH 1/1] ACPI: fix acpi table use after free

2021-03-09 Thread Rafael J. Wysocki
On Tue, Mar 9, 2021 at 6:54 PM Mike Rapoport wrote: > > On Sun, Mar 07, 2021 at 09:46:22AM +0200, Mike Rapoport wrote: > > Hello Rafael, > > > > On Fri, Mar 05, 2021 at 02:30:07PM +0100, Rafael J. Wysocki wrote: > > > On Fri, Mar 5, 2021 at 12:14 AM George Kennedy > > > wrote: > > > > > > > The

Re: [PATCH 1/1] ACPI: fix acpi table use after free

2021-03-09 Thread Mike Rapoport
On Sun, Mar 07, 2021 at 09:46:22AM +0200, Mike Rapoport wrote: > Hello Rafael, > > On Fri, Mar 05, 2021 at 02:30:07PM +0100, Rafael J. Wysocki wrote: > > On Fri, Mar 5, 2021 at 12:14 AM George Kennedy > > wrote: > > > > > The ibft table, for example, is mapped in via acpi_map() and kmap(). The >

Re: [PATCH 1/1] ACPI: fix acpi table use after free

2021-03-06 Thread Mike Rapoport
Hello Rafael, On Fri, Mar 05, 2021 at 02:30:07PM +0100, Rafael J. Wysocki wrote: > On Fri, Mar 5, 2021 at 12:14 AM George Kennedy > wrote: > > > The ibft table, for example, is mapped in via acpi_map() and kmap(). The > > page for the ibft table is not reserved, so it can end up on the freelist.

Re: [PATCH 1/1] ACPI: fix acpi table use after free

2021-03-05 Thread George Kennedy
On 3/5/2021 8:40 AM, David Hildenbrand wrote: The ibft table, for example, is mapped in via acpi_map() and kmap(). The page for the ibft table is not reserved, so it can end up on the freelist. You appear to be saying that it is not sufficient to kmap() a page in order to use it safely.  It

Re: [PATCH 1/1] ACPI: fix acpi table use after free

2021-03-05 Thread David Hildenbrand
The ibft table, for example, is mapped in via acpi_map() and kmap(). The page for the ibft table is not reserved, so it can end up on the freelist. You appear to be saying that it is not sufficient to kmap() a page in order to use it safely. It is also necessary to reserve it upfront, for examp

Re: [PATCH 1/1] ACPI: fix acpi table use after free

2021-03-05 Thread Rafael J. Wysocki
On Fri, Mar 5, 2021 at 12:14 AM George Kennedy wrote: > > Hello Rafael, > > On 3/4/2021 7:14 AM, Rafael J. Wysocki wrote: > > On Thu, Mar 4, 2021 at 2:22 AM George Kennedy > > wrote: > >> Since commit 7fef431be9c9 ("mm/page_alloc: place pages to tail > >> in __free_pages_core()") the following u

Re: [PATCH 1/1] ACPI: fix acpi table use after free

2021-03-04 Thread George Kennedy
Hello Rafael, On 3/4/2021 7:14 AM, Rafael J. Wysocki wrote: On Thu, Mar 4, 2021 at 2:22 AM George Kennedy wrote: Since commit 7fef431be9c9 ("mm/page_alloc: place pages to tail in __free_pages_core()") the following use after free occurs intermittently when acpi tables are accessed. BUG: KASAN

Re: [PATCH 1/1] ACPI: fix acpi table use after free

2021-03-04 Thread Rafael J. Wysocki
On Thu, Mar 4, 2021 at 2:22 AM George Kennedy wrote: > > Since commit 7fef431be9c9 ("mm/page_alloc: place pages to tail > in __free_pages_core()") the following use after free occurs > intermittently when acpi tables are accessed. > > BUG: KASAN: use-after-free in ibft_init+0x134/0xc49 > Read of s

[PATCH 1/1] ACPI: fix acpi table use after free

2021-03-03 Thread George Kennedy
Since commit 7fef431be9c9 ("mm/page_alloc: place pages to tail in __free_pages_core()") the following use after free occurs intermittently when acpi tables are accessed. BUG: KASAN: use-after-free in ibft_init+0x134/0xc49 Read of size 4 at addr 8880be453004 by task swapper/0/1 CPU: 3 PID: 1 Co