Thomas Gleixner ea72ce5da2 x86/kaslr: Expose and use the end of the physical memory address space ... iounmap() on x86 occasionally fails to unmap because the provided valid ioremap address is not below high_memory. It turned out that this happens due to KASLR. KASLR uses the full address space between PAGE_OFFSET and vaddr_end to randomize the starting points of the direct map, vmalloc and vmemmap regions. It thereby limits the size of the direct map by using the installed memory size plus an extra configurable margin for hot-plug memory. This limitation is done to gain more randomization space because otherwise only the holes between the direct map, vmalloc, vmemmap and vaddr_end would be usable for randomizing. The limited direct map size is not exposed to the rest of the kernel, so the memory hot-plug and resource management related code paths still operate under the assumption that the available address space can be determined with MAX_PHYSMEM_BITS. request_free_mem_region() allocates from (1 << MAX_PHYSMEM_BITS) - 1 downwards. That means the first allocation happens past the end of the direct map and if unlucky this address is in the vmalloc space, which causes high_memory to become greater than VMALLOC_START and consequently causes iounmap() to fail for valid ioremap addresses. MAX_PHYSMEM_BITS cannot be changed for that because the randomization does not align with address bit boundaries and there are other places which actually require to know the maximum number of address bits. All remaining usage sites of MAX_PHYSMEM_BITS have been analyzed and found to be correct. Cure this by exposing the end of the direct map via PHYSMEM_END and use that for the memory hot-plug and resource management related places instead of relying on MAX_PHYSMEM_BITS. In the KASLR case PHYSMEM_END maps to a variable which is initialized by the KASLR initialization and otherwise it is based on MAX_PHYSMEM_BITS as before. To prevent future hickups add a check into add_pages() to catch callers trying to add memory above PHYSMEM_END. Fixes: 0483e1fa6e ("x86/mm: Implement ASLR for kernel memory regions") Reported-by: Max Ramanouski <max8rr8@gmail.com> Reported-by: Alistair Popple <apopple@nvidia.com> Signed-off-by: Thomas Gleixner <tglx@linutronix.de> Tested-By: Max Ramanouski <max8rr8@gmail.com> Tested-by: Alistair Popple <apopple@nvidia.com> Reviewed-by: Dan Williams <dan.j.williams@intel.com> Reviewed-by: Alistair Popple <apopple@nvidia.com> Reviewed-by: Kees Cook <kees@kernel.org> Cc: stable@vger.kernel.org Link: https://lore.kernel.org/all/87ed6soy3z.ffs@tglx		2024-08-20 13:44:57 +02:00
..
damon	mm: provide mm_struct and address to huge_ptep_get()	2024-07-12 15:52:15 -07:00
kasan	kasan: fix bad call to unpoison_slab_object	2024-06-24 20:52:09 -07:00
kfence	mm: remove CONFIG_MEMCG_KMEM	2024-07-10 12:14:54 -07:00
kmsan	kmsan: do not pass NULL pointers as 0	2024-07-03 19:30:26 -07:00
backing-dev.c	writeback: support retrieving per group debug writeback stats of bdi	2024-05-05 17:53:51 -07:00
balloon_compaction.c	mm: remove MIGRATE_SYNC_NO_COPY mode	2024-07-03 19:30:00 -07:00
bootmem_info.c	bootmem: use kmemleak_free_part_phys in put_page_bootmem	2023-10-25 16:47:13 -07:00
cma.c	mm/cma: drop incorrect alignment check in cma_init_reserved_mem	2024-04-25 20:56:42 -07:00
cma.h	mm/cma: add sysfs file 'release_pages_success'	2024-02-22 10:24:57 -08:00
cma_debug.c	mm/cma_debug: show complete cma name in debugfs directories	2022-09-11 20:25:50 -07:00
cma_sysfs.c	mm/cma: add sysfs file 'release_pages_success'	2024-02-22 10:24:57 -08:00
compaction.c	sysctl: treewide: constify the ctl_table argument of proc_handlers	2024-07-24 20:59:29 +02:00
debug.c	mm/debug: print only page mapcount (excluding folio entire mapcount) in __dump_folio()	2024-05-05 17:53:31 -07:00
debug_page_alloc.c	mm: page_alloc: consolidate free page accounting	2024-04-25 20:56:04 -07:00
debug_page_ref.c
debug_vm_pgtable.c	mm/debug_vm_pgtable: drop RANDOM_ORVALUE trick	2024-06-15 10:43:08 -07:00
dmapool.c	mm/mempool/dmapool: remove CONFIG_DEBUG_SLAB ifdefs	2023-12-05 11:17:58 +01:00
dmapool_test.c	mm/dmapool: add MODULE_DESCRIPTION()	2024-07-03 19:29:58 -07:00
early_ioremap.c	mm/early_ioremap.c: improve the execution efficiency of early_ioremap_setup()	2023-06-09 16:25:56 -07:00
execmem.c	mm/execmem, arch: convert remaining overrides of module_alloc to execmem	2024-05-14 00:31:43 -07:00
fadvise.c	mm: remove unnecessary pagevec includes	2023-06-23 16:59:31 -07:00
fail_page_alloc.c	mm, page_alloc: put should_fail_alloc_page() back behing CONFIG_FAIL_PAGE_ALLOC	2024-07-17 21:05:18 -07:00
failslab.c	mm, slab: put should_failslab() back behind CONFIG_SHOULD_FAILSLAB	2024-07-17 21:05:18 -07:00
filemap.c	- 875fa64577da ("mm/hugetlb_vmemmap: fix race with speculative PFN	2024-07-21 17:15:46 -07:00
folio-compat.c	mm: remove page_mapping()	2024-07-03 19:29:59 -07:00
gup.c	mm: remove CONFIG_ARCH_HAS_HUGEPD	2024-07-12 15:52:19 -07:00
gup_test.c	Merge mm-hotfixes-stable into mm-stable to pick up depended-upon changes.	2023-06-23 16:58:19 -07:00
gup_test.h	mm/gup_test: start/stop/read functionality for PIN LONGTERM test	2022-11-08 17:37:15 -08:00
highmem.c	mm/highmem: make nr_free_highpages() return "unsigned long"	2024-07-03 19:30:06 -07:00
hmm.c	mm: provide mm_struct and address to huge_ptep_get()	2024-07-12 15:52:15 -07:00
huge_memory.c	mm/huge_memory: avoid PMD-size page cache if needed	2024-07-26 14:33:09 -07:00
hugetlb.c	sysctl: treewide: constify the ctl_table argument of proc_handlers	2024-07-24 20:59:29 +02:00
hugetlb_cgroup.c	mm/hugetlb_cgroup: switch to the new cftypes	2024-07-03 19:30:10 -07:00
hugetlb_vmemmap.c	Merge branch 'mm-hotfixes-stable' into mm-stable to pick up "mm: fix	2024-07-06 11:44:41 -07:00
hugetlb_vmemmap.h	mm: hugetlb_vmemmap: fix reference to nonexistent file	2023-10-25 16:47:14 -07:00
hwpoison-inject.c	mm/hwpoison: add MODULE_DESCRIPTION()	2024-07-03 19:29:58 -07:00
init-mm.c	mm: Deprecate pasid field	2023-12-12 10:11:32 +01:00
internal.h	Merge branch 'mm-hotfixes-stable' into mm-stable to pick up "mm: fix	2024-07-06 11:44:41 -07:00
interval_tree.c
io-mapping.c
ioremap.c	mm: ioremap: remove unneeded ioremap_allowed and iounmap_allowed	2023-08-18 10:12:36 -07:00
Kconfig	- 875fa64577da ("mm/hugetlb_vmemmap: fix race with speculative PFN	2024-07-21 17:15:46 -07:00
Kconfig.debug	mm/slub: unify all sl[au]b parameters with "slab_$param"	2024-01-22 10:31:08 +01:00
khugepaged.c	- 875fa64577da ("mm/hugetlb_vmemmap: fix race with speculative PFN	2024-07-21 17:15:46 -07:00
kmemleak.c	mm/kmemleak: replace strncpy() with strscpy()	2024-07-17 21:05:18 -07:00
ksm.c	Random number generator updates for Linux 6.11-rc1.	2024-07-24 10:29:50 -07:00
list_lru.c	mm: list_lru: fix UAF for memory cgroup	2024-08-07 18:33:56 -07:00
maccess.c	mm: Fix copy_from_user_nofault().	2023-04-12 17:36:23 -07:00
madvise.c	Random number generator updates for Linux 6.11-rc1.	2024-07-24 10:29:50 -07:00
Makefile	mm: memcg: put cgroup v1-specific code under a config option	2024-07-04 18:05:54 -07:00
mapping_dirty_helpers.c	mm: fix clean_record_shared_mapping_range kernel-doc	2023-08-24 16:20:30 -07:00
memblock.c	memblock: updates for 6.11-rc1	2024-07-18 14:48:11 -07:00
memcontrol-v1.c	mm: memcg1: convert charge move flags to unsigned long long	2024-07-17 21:05:19 -07:00
memcontrol-v1.h	mm: memcg: gather memcg1-specific fields initialization in memcg1_memcg_init()	2024-07-04 18:05:56 -07:00
memcontrol.c	memcg: protect concurrent access to mem_cgroup_idr	2024-08-07 18:33:56 -07:00
memfd.c	mm/gup: introduce memfd_pin_folios() for pinning memfd folios	2024-07-12 15:52:09 -07:00
memory-failure.c	mm/memory-failure: remove obsolete MF_MSG_DIFFERENT_COMPOUND	2024-07-12 15:52:22 -07:00
memory-tiers.c	memory tier: consolidate the initialization of memory tiers	2024-07-12 15:52:20 -07:00
memory.c	mm: fix old/young bit handling in the faulting path	2024-07-26 14:33:09 -07:00
memory_hotplug.c	x86/kaslr: Expose and use the end of the physical memory address space	2024-08-20 13:44:57 +02:00
mempolicy.c	Random number generator updates for Linux 6.11-rc1.	2024-07-24 10:29:50 -07:00
mempool.c	mm: fix xyz_noprof functions calling profiled functions	2024-06-05 19:19:26 -07:00
memremap.c	mm: convert put_devmap_managed_page_refs() to put_devmap_managed_folio_refs()	2024-05-05 17:53:49 -07:00
memtest.c	memtest: use {READ,WRITE}_ONCE in memory scanning	2024-03-13 12:12:21 -07:00
migrate.c	- 875fa64577da ("mm/hugetlb_vmemmap: fix race with speculative PFN	2024-07-21 17:15:46 -07:00
migrate_device.c	mm: extend rmap flags arguments for folio_add_new_anon_rmap	2024-07-03 19:30:18 -07:00
mincore.c	mm: provide mm_struct and address to huge_ptep_get()	2024-07-12 15:52:15 -07:00
mlock.c	Random number generator updates for Linux 6.11-rc1.	2024-07-24 10:29:50 -07:00
mm_init.c	- 875fa64577da ("mm/hugetlb_vmemmap: fix race with speculative PFN	2024-07-21 17:15:46 -07:00
mm_slot.h	mm: introduce common struct mm_slot	2022-10-03 14:02:43 -07:00
mmap.c	Random number generator updates for Linux 6.11-rc1.	2024-07-24 10:29:50 -07:00
mmap_lock.c	mm: mmap_lock: replace get_memcg_path_buf() with on-stack buffer	2024-07-03 19:30:26 -07:00
mmu_gather.c	mm/mmu_gather: improve cond_resched() handling with large folios and expensive page freeing	2024-02-22 15:27:17 -08:00
mmu_notifier.c	mmu_notifier: remove the .change_pte() callback	2024-04-11 13:18:36 -04:00
mmzone.c	zswap: shrink zswap pool based on memory pressure	2023-12-12 10:57:02 -08:00
mprotect.c	mm: introduce pmd|pte_needs_soft_dirty_wp helpers for softdirty write-protect	2024-07-03 19:30:07 -07:00
mremap.c	mm: remove page_mkclean()	2024-07-03 19:30:17 -07:00
mseal.c	mseal: add mseal syscall	2024-05-23 19:40:26 -07:00
msync.c	mm/msync: use vma_find() instead of vma linked list	2022-09-26 19:46:25 -07:00
nommu.c	The usual shower of singleton fixes and minor series all over MM,	2024-05-19 09:21:03 -07:00
oom_kill.c	memory: remove the now superfluous sentinel element from ctl_table array	2024-04-25 20:56:32 -07:00
page-writeback.c	sysctl: treewide: constify the ctl_table argument of proc_handlers	2024-07-24 20:59:29 +02:00
page_alloc.c	mm/page_alloc: fix pcp->count race between drain_pages_zone() vs __rmqueue_pcplist()	2024-07-26 14:33:09 -07:00
page_counter.c	mm/page_counter: move calculating protection values to page_counter	2024-07-12 15:52:20 -07:00
page_ext.c	mm: report per-page metadata information	2024-07-03 19:30:09 -07:00
page_idle.c	mm: page_idle: convert page idle to use a folio	2023-01-18 17:12:52 -08:00
page_io.c	mm: ignore data-race in __swap_writepage	2024-07-17 21:05:18 -07:00
page_isolation.c	mm: page_isolation: prepare for hygienic freelists	2024-04-25 20:56:04 -07:00
page_owner.c	mm/page-owner: use gfp_nested_mask() instead of open coded masking	2024-05-19 14:40:44 -07:00
page_poison.c	mm/page_poison: replace kmap_atomic() with kmap_local_page()	2023-12-10 16:51:50 -08:00
page_reporting.c	mm, treewide: rename MAX_ORDER to MAX_PAGE_ORDER	2024-01-08 15:27:15 -08:00
page_reporting.h
page_table_check.c	mm/page_table_check: fix crash on ZONE_DEVICE	2024-06-15 10:43:04 -07:00
page_vma_mapped.c	mm: make page_mapped_in_vma conditional on CONFIG_MEMORY_FAILURE	2024-05-05 17:53:45 -07:00
pagewalk.c	mm: remove CONFIG_ARCH_HAS_HUGEPD	2024-07-12 15:52:19 -07:00
percpu-internal.h	mm: remove CONFIG_MEMCG_KMEM	2024-07-10 12:14:54 -07:00
percpu-km.c
percpu-stats.c	mm: use vmalloc_array and vcalloc for array allocations	2022-03-08 09:30:46 -05:00
percpu-vm.c	percpu: clean up all mappings when pcpu_map_pages() fails	2024-04-25 20:55:49 -07:00
percpu.c	mm: remove CONFIG_MEMCG_KMEM	2024-07-10 12:14:54 -07:00
pgalloc-track.h
pgtable-generic.c	mm: fix race between __split_huge_pmd_locked() and GUP-fast	2024-05-07 10:37:00 -07:00
process_vm_access.c	mm: fix process_vm_rw page counts	2023-12-10 16:51:39 -08:00
ptdump.c	mm: ptdump: add check_wx_pages debugfs attribute	2024-02-22 10:24:47 -08:00
readahead.c	Merge branch 'mm-hotfixes-stable' into mm-stable to pick up "mm: fix	2024-07-06 11:44:41 -07:00
rmap.c	Random number generator updates for Linux 6.11-rc1.	2024-07-24 10:29:50 -07:00
rodata_test.c	mm/rodata_test: use PAGE_ALIGNED() helper	2022-10-03 14:03:05 -07:00
secretmem.c	mm/secretmem: use a folio in secretmem_fault()	2023-08-21 13:38:02 -07:00
shmem.c	mm: shmem: fix incorrect aligned index when checking conflicts	2024-08-07 18:33:56 -07:00
shmem_quota.c	tmpfs: fix race on handling dquot rbtree	2024-03-26 11:07:23 -07:00
show_mem.c	lib: add memory allocations report in show_mem()	2024-04-25 20:55:57 -07:00
shrinker.c	mm: shrinker: use kvzalloc_node() from expand_one_shrinker_info()	2024-01-05 09:58:32 -08:00
shrinker_debug.c	mm: shrinker: convert shrinker_rwsem to mutex	2023-10-04 10:32:26 -07:00
shuffle.c	mm/shuffle: convert module_param_call to module_param_cb	2022-10-03 14:03:07 -07:00
shuffle.h	mm, treewide: rename MAX_ORDER to MAX_PAGE_ORDER	2024-01-08 15:27:15 -08:00
slab.h	- 875fa64577da ("mm/hugetlb_vmemmap: fix race with speculative PFN	2024-07-21 17:15:46 -07:00
slab_common.c	- 875fa64577da ("mm/hugetlb_vmemmap: fix race with speculative PFN	2024-07-21 17:15:46 -07:00
slub.c	mm, slub: do not call do_slab_free for kfence object	2024-07-30 11:50:00 +02:00
sparse-vmemmap.c	mm: report per-page metadata information	2024-07-03 19:30:09 -07:00
sparse.c	x86/kaslr: Expose and use the end of the physical memory address space	2024-08-20 13:44:57 +02:00
swap.c	mm/gup: clear the LRU flag of a page before adding to LRU batch	2024-07-17 21:08:54 -07:00
swap.h	mm: swap: remove 'synchronous' argument to swap_read_folio()	2024-07-03 19:30:06 -07:00
swap_cgroup.c	mm: memcontrol: don't allocate cgroup swap arrays when memcg is disabled	2022-10-03 14:03:36 -07:00
swap_slots.c	mm: swap: update get_swap_pages() to take folio order	2024-04-25 20:56:37 -07:00
swap_state.c	mm: swap_state: use folio_alloc_mpol() in __read_swap_cache_async()	2024-07-12 15:52:22 -07:00
swapfile.c	mm: use folio_add_new_anon_rmap() if folio_test_anon(folio)==false	2024-07-03 19:30:18 -07:00
truncate.c	- 875fa64577da ("mm/hugetlb_vmemmap: fix race with speculative PFN	2024-07-21 17:15:46 -07:00
usercopy.c	mm: Fix copy_from_user_nofault().	2023-04-12 17:36:23 -07:00
userfaultfd.c	mm: provide mm_struct and address to huge_ptep_get()	2024-07-12 15:52:15 -07:00
util.c	sysctl: treewide: constify the ctl_table argument of proc_handlers	2024-07-24 20:59:29 +02:00
vmalloc.c	Merge branch 'mm-hotfixes-stable' into mm-stable to pick up "mm: fix	2024-07-06 11:44:41 -07:00
vmpressure.c	eventfd: simplify eventfd_signal()	2023-11-28 14:08:38 +01:00
vmscan.c	Random number generator updates for Linux 6.11-rc1.	2024-07-24 10:29:50 -07:00
vmstat.c	sysctl: treewide: constify the ctl_table argument of proc_handlers	2024-07-24 20:59:29 +02:00
workingset.c	cachestat: do not flush stats in recency check	2024-07-03 22:40:37 -07:00
z3fold.c	mm: zpool: return pool size in pages	2024-04-25 20:55:48 -07:00
zbud.c	mm: zpool: return pool size in pages	2024-04-25 20:55:48 -07:00
zpool.c	mm: zpool: return pool size in pages	2024-04-25 20:55:48 -07:00
zsmalloc.c	minmax: make generic MIN() and MAX() macros available everywhere	2024-07-28 15:49:18 -07:00
zswap.c	mm/zswap: fix a white space issue	2024-07-17 21:08:55 -07:00