linux-kernel - Re: [PATCH] [5/5] Avoid theoretical vmalloc fault loop

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Mon, 5 Jan 2009 22:47:56 +1100
From:	Nick Piggin <nickpiggin@...oo.com.au>
To:	Andi Kleen <andi@...stfloor.org>, stable@...nel.org
Cc:	akpm@...ux-foundation.org, x86@...nel.org,
	linux-kernel@...r.kernel.org
Subject: Re: [PATCH] [5/5] Avoid theoretical vmalloc fault loop

This should be a -stable patch too I think.

On Monday 05 January 2009 10:36:42 Andi Kleen wrote:
> Ajith Kumar noticed:
>
> I was going through the vmalloc fault handling for x86_64 and am unclear
> about the following lines in the vmalloc_fault() function.
>
> pgd = pgd_offset(current->mm ?: &init_mm, address);
> pgd_ref = pgd_offset_k(address);
>
> Here the intention is to get the pgd corresponding to the current
> process and sync it up with the pgd in init_mm(obtained from
> pgd_offset_k). However, for kernel threads current->mm is NULL and hence
> pgd = pgd_offset(init_mm, address) = pgd_ref which means the fault
> handler returns without setting the pgd entry in the MM structure in
> the context of which the kernel thread has faulted. This could lead to
> never-ending faults and busy looping of kernel threads like pdflush.
> So, shouldn't the pgd = pgd_offset(current->mm ?: &init_mm, address);
> be
> pgd = pgd_offset(current->active_mm ?: &init_mm, address);
>
> AK: We can use active_mm unconditionally because it should
> be always set. Do that.
>
> Signed-off-by: Andi Kleen <ak@...ux.intel.com>
>
> ---
>  arch/x86/mm/fault.c |    2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
>
> Index: linux-2.6.28-test/arch/x86/mm/fault.c
> ===================================================================
> --- linux-2.6.28-test.orig/arch/x86/mm/fault.c	2008-10-24
> 13:34:41.000000000 +0200 +++
> linux-2.6.28-test/arch/x86/mm/fault.c	2009-01-02 16:01:11.000000000 +0100
> @@ -533,7 +533,7 @@
>  	   happen within a race in page table update. In the later
>  	   case just flush. */
>
> -	pgd = pgd_offset(current->mm ?: &init_mm, address);
> +	pgd = pgd_offset(current->active_mm, address);
>  	pgd_ref = pgd_offset_k(address);
>  	if (pgd_none(*pgd_ref))
>  		return -1;
> --
> To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
> the body of a message to majordomo@...r.kernel.org
> More majordomo info at  http://vger.kernel.org/majordomo-info.html
> Please read the FAQ at  http://www.tux.org/lkml/


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/