Page MenuHomeFreeBSD

pmap: Keep PTI page table pages busy always
ClosedPublic

Authored by markj on Jun 13 2022, 2:12 PM.
Tags
None
Referenced Files
Unknown Object (File)
Thu, Sep 26, 4:13 AM
Unknown Object (File)
Wed, Sep 25, 12:58 PM
Unknown Object (File)
Wed, Sep 25, 7:02 AM
Unknown Object (File)
Tue, Sep 24, 10:26 PM
Unknown Object (File)
Tue, Sep 24, 7:42 AM
Unknown Object (File)
Tue, Sep 24, 6:37 AM
Unknown Object (File)
Tue, Sep 24, 2:36 AM
Unknown Object (File)
Mon, Sep 23, 4:16 PM
Subscribers

Details

Summary

vm_page_free() expects the page to be busied since it belongs to an
object. However, PTI PTPs are never busy, so if a page allocation
failure occurs while mapping user-accessible KVA regions, we panic.

This was effectively an omission from commit
e9ceb9dd110e04fc19729b4e9fb1c8bfbb8398a3. So just keep PTI page table
pages busy.

Reported by: syzkaller

Diff Detail

Repository
rG FreeBSD src repository
Lint
Lint Not Applicable
Unit
Tests Not Applicable

Event Timeline

markj requested review of this revision.Jun 13 2022, 2:12 PM
This revision is now accepted and ready to land.Jun 13 2022, 4:08 PM

Hmm, actually this change might need to go a bit further: pmap_pti_free_page() should use vm_page_xbusy_claim(), at least in principle.

  • Claim xbusy before freeing PTI page table pages.
  • Remove some redundant assertions about ref_count, vm_page_unwire_noq() provides the same assertion.
This revision now requires review to proceed.Jun 14 2022, 2:06 PM
This revision is now accepted and ready to land.Jun 14 2022, 5:34 PM
This revision was automatically updated to reflect the committed changes.