linux-kernel - Re: /dev/mem and PCI memory = EFAULT (regression?)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Sat, 29 Oct 2016 02:47:42 +0300
From:   Stas Sergeev <stsp@...t.ru>
To:     Linus Torvalds <torvalds@...ux-foundation.org>
Cc:     Andy Lutomirski <luto@...capital.net>,
        Linux kernel <linux-kernel@...r.kernel.org>,
        dosemu-devel <dosemu-devel@...ts.sourceforge.net>,
        Bart Oldeman <bartoldeman@...rs.sourceforge.net>,
        "Eric W. Biederman" <ebiederm@...ssion.com>
Subject: Re: /dev/mem and PCI memory = EFAULT (regression?)

29.10.2016 02:26, Linus Torvalds пишет:
> On Fri, Oct 28, 2016 at 2:36 PM, Stas Sergeev <stsp@...t.ru> wrote:
>>>>> On Fri, Oct 28, 2016 at 2:03 PM, Stas Sergeev <stsp@...t.ru> wrote:
>> Hello.
>>
>> For the long time dosemu used /dev/mem for vga pass-through.
>> Now it appears /dev/mem has this check:
>> http://lxr.free-electrons.com/source/drivers/char/mem.c#L51
>> which prevents an accesses to PCI memory regions if the
>> "high_memory" points low enough. It seems "high_memory"
>> just points to the end of the physical ram, so depending on
>> the ram size you either can access PCI devices or you get
>> EFAULT.
>> Was it wrong to use /dev/mem for accessing the PCI devices?
>> How should I do that now?
> Has it ever worked for you?
Well, yes, even today: if the ram size is large enough to last
beyond the PCI space, then I am not getting EFAULT (i've yet
to check if the results are as expected, but at least no error
returned).
It is exactly that ram size envolvement made me think this
is a bug (and regression).

>   That code is ancient, going back in some
> form or another at least ten years.
Yes, indeed, I can see that on lxr now...

> So /dev/mem does not allow "read()/write()" on IO memory, and really
> hasn't in a long long time (maybe ever, quite frankly). It does allow
> it on regular RAM, but STRICT_DEV_MEM then disallows that too for
> security reasons (and realistically, everybody uses STRICT_DEV_MEM
> these days).
>
> What people do use /dev/mem for is to mmap() PCI memory, and then you
> can access it from user space. That's the traditional model that X.org
> used to do etc.
Yes, thanks, I was confused. mmap() is indeed unaffected,
only read and write are. So the only problem I have, is the test-case
I was trying, that does read/write and works depending on the
ram size (under qemu). But there is no any problem for dosemu.
Perhaps for consistency it would be good to make things independent
of the ram size, but then there is no real problem here.
So sorry for the noise!