Reproduced this on an arm64 machine (Neoverse N1 / Ampere with PAN
enabled).
Minimal steps:
1. mmap a PCI BAR / physical resource through sysfs (or VFIO).
2. open("/proc/self/mem", O_RDONLY).
3. pread() from that mapped address.
Result: instant kernel panic with ESR 0x9600000f (level 3 permission
fault).
Tracing into generic_access_phys():
maddr = ioremap_prot(phys_addr, PAGE_SIZE, pgprot_val(vma->vm_page_prot));
Because it passes vma->vm_page_prot directly, the kernel mapping
inherits the PTE_USER bit (bit 6 in the faulting pte 0160000010000fd3).
When PAN is active (+PAN in pstate), EL1 kernel loads from pages with
PTE_USER are forbidden by the MMU. As soon as __memcpy_fromio hits 'ldr
x5, [x4]', the hardware faults immediately.
generic_access_phys() needs to strip PTE_USER (or use PAGE_KERNEL_IO)
before ioremap_prot() so the kernel mapping is EL1-accessible
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2109501
Title:
Kernel crash on reading PCI mapped memory via /proc/self/mem
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2109501/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
