search

OP-TEE / optee_os

Trusted side of the TEE
Other
1.59k stars 1.07k forks source link

core: mm: fix mobj_tee_ram_rw initialization #7088

Closed jenswi-linaro closed 1 week ago

jenswi-linaro commented 3 weeks ago

Until this patch, for CFG_CORE_RWDATA_NOEXEC=n and CFG_CORE_ASLR=y there's an error in mobj_init() when the length of the combined TEE_RAM_RWX is calculated.

The relocatable address VCORE_UNPG_RW_PA is mixed with the absolute address TEE_RAM_START. Relocated addresses only changes with CFG_CORE_ASLR=y so before ASLR this expression was correct.

The combined TEE_RAM_RWX is only used with CFG_CORE_RWDATA_NOEXEC=n so that is also a perquisite for the error. The calculated length field is usually not more wrong than code depending on mobj_tee_ram_rw/mobj_tee_ram_rx still works. So the error wasn't visible until length checks for phys_to_virt() was introduced with the commit c2e4eb43b7b7 ("core_mmu: fix phys_to_virt() to check length").

Fix this by using VCORE_START_VA instead of TEE_RAM_START since the former is a relocated address.

Fixes: c2e4eb43b7b7 ("core_mmu: fix phys_to_virt() to check length") Fixes: 170e9084a84f ("core: add support for CFG_CORE_ASLR")

jenswi-linaro commented 1 week ago

Ping?

jforissier commented 1 week ago

s/perquisite/prerequisite/ in commit description.

Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>

jenswi-linaro commented 1 week ago

Tags applied and comment addressed.