From ebc1a034fb753b8c429d578e97183fc6bf4804d4 Mon Sep 17 00:00:00 2001 From: Augustin Cavalier Date: Tue, 28 May 2024 19:15:59 -0400 Subject: [PATCH] kernel/vm: Prevent access to kernel args physical ranges after page init. MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Otherwise, vm_allocate_early_physical_page could try to use them to allocate more physical pages, which isn't legal as page state management is now the responsibility of the vm_page system. Discovered while working on re-activating the guarded heap. In that case, at least, the illegally allocated pages were caught by the memory manager trying to convert them into areas, but they weren't marked WIRED and so tripped asserts. Change-Id: I39af70bf8a652511bb65fe2154bba16d4ba5c924 Reviewed-on: https://review.haiku-os.org/c/haiku/+/7699 Reviewed-by: waddlesplash Reviewed-by: Axel Dörfler --- src/system/kernel/vm/vm.cpp | 10 +++++++++- src/system/kernel/vm/vm_page.cpp | 4 ++++ 2 files changed, 13 insertions(+), 1 deletion(-) diff --git a/src/system/kernel/vm/vm.cpp b/src/system/kernel/vm/vm.cpp index bf86415edd..f5093a5134 100644 --- a/src/system/kernel/vm/vm.cpp +++ b/src/system/kernel/vm/vm.cpp @@ -4234,6 +4234,11 @@ is_page_in_physical_memory_range(kernel_args* args, phys_addr_t address) page_num_t vm_allocate_early_physical_page(kernel_args* args) { + if (args->num_physical_allocated_ranges == 0) { + panic("early physical page allocations no longer possible!"); + return 0; + } + for (uint32 i = 0; i < args->num_physical_allocated_ranges; i++) { phys_addr_t nextPage; @@ -4306,9 +4311,12 @@ vm_allocate_early(kernel_args* args, size_t virtualSize, size_t physicalSize, //dprintf("vm_allocate_early: paddr 0x%lx\n", physicalAddress); - arch_vm_translation_map_early_map(args, virtualBase + i * B_PAGE_SIZE, + status_t status = arch_vm_translation_map_early_map(args, + virtualBase + i * B_PAGE_SIZE, physicalAddress * B_PAGE_SIZE, attributes, &vm_allocate_early_physical_page); + if (status != B_OK) + panic("error mapping early page!"); } return virtualBase; diff --git a/src/system/kernel/vm/vm_page.cpp b/src/system/kernel/vm/vm_page.cpp index 842d3f8bfb..e4cae65cad 100644 --- a/src/system/kernel/vm/vm_page.cpp +++ b/src/system/kernel/vm/vm_page.cpp @@ -3374,6 +3374,10 @@ vm_page_init(kernel_args *args) args->physical_allocated_range[i].size / B_PAGE_SIZE, true); } + // prevent future accesses to the kernel args ranges + args->num_physical_memory_ranges = 0; + args->num_physical_allocated_ranges = 0; + // The target of actually free pages. This must be at least the system // reserve, but should be a few more pages, so we don't have to extract // a cached page with each allocation.