linux-kernel - Re: One (possible) x86 get_user

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Thu, 27 Jan 2011 14:56:58 +0100
From:	Peter Zijlstra <a.p.zijlstra@...llo.nl>
To:	Xiaowei Yang <xiaowei.yang@...wei.com>
Cc:	Nick Piggin <npiggin@...nel.dk>, Jan Beulich <JBeulich@...ell.com>,
	Kenneth Lee <liguozhu@...wei.com>, wangzhenguo@...wei.com,
	linqaingmin <linqiangmin@...wei.com>, fanhenglong@...wei.com,
	Wu Fengguang <fengguang.wu@...el.com>,
	linux-kernel@...r.kernel.org, Kaushik Barde <kbarde@...wei.com>
Subject: Re: One (possible) x86 get_user_pages bug

On Thu, 2011-01-27 at 21:05 +0800, Xiaowei Yang wrote:
> 
> However, from the comments embedded in gup.c, it seems deliberate to 
> avoid the lock in the fast path. The question is: if so, how to avoid 
> the above scenario? 

Something like the below comes to mind... but I must say I haven't fully
considered the problem yet..

---
 arch/x86/mm/gup.c |    9 +++++----
 1 files changed, 5 insertions(+), 4 deletions(-)

diff --git a/arch/x86/mm/gup.c b/arch/x86/mm/gup.c
index dbe34b9..6527933 100644
--- a/arch/x86/mm/gup.c
+++ b/arch/x86/mm/gup.c
@@ -89,10 +89,11 @@ static noinline int gup_pte_range(pmd_t pmd, unsigned long addr,
 		}
 		VM_BUG_ON(!pfn_valid(pte_pfn(pte)));
 		page = pte_page(pte);
-		get_page(page);
-		SetPageReferenced(page);
-		pages[*nr] = page;
-		(*nr)++;
+		if (get_page_unless_zero(page)) {
+			SetPageReferenced(page);
+			pages[*nr] = page;
+			(*nr)++;
+		}
 
 	} while (ptep++, addr += PAGE_SIZE, addr != end);
 	pte_unmap(ptep - 1);

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/