lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date:   Thu, 7 Sep 2017 13:51:46 -0700
From:   Davidlohr Bueso <dave@...olabs.net>
To:     Laurent Dufour <laurent.du4@...e.fr>
Cc:     benh@...nel.crashing.org, mpe@...erman.id.au,
        linuxppc-dev@...ts.ozlabs.org, linux-kernel@...r.kernel.org
Subject: Re: [PATCH] powerpc/mm: Fix missing mmap_sem release

On Thu, 07 Sep 2017, Laurent Dufour wrote:

>The commit b5c8f0fd595d ("powerpc/mm: Rework mm_fault_error()") reviewed
>the way the error path is managed in __do_page_fault() but it was a bit too
>agressive when handling a case by returning without releasing the mmap_sem.
>
>By the way, replacing current->mm->mmap_sem by mm->mmap_sem as mm is set to
>current->mm.
>
>Fixes: b5c8f0fd595d ("powerpc/mm: Rework mm_fault_error()")
>Cc: Benjamin Herrenschmidt <benh@...nel.crashing.org>
>Signed-off-by: Laurent Dufour <laurent.du4@...e.fr>
>---
> arch/powerpc/mm/fault.c | 3 ++-
> 1 file changed, 2 insertions(+), 1 deletion(-)
>
>diff --git a/arch/powerpc/mm/fault.c b/arch/powerpc/mm/fault.c
>index 4797d08581ce..f799ccf37d27 100644
>--- a/arch/powerpc/mm/fault.c
>+++ b/arch/powerpc/mm/fault.c

But... here:

	/*
	 * If we need to retry the mmap_sem has already been released,
	 * and if there is a fatal signal pending there is no guarantee
	 * that we made any progress. Handle this case first.
	 */

>@@ -521,10 +521,11 @@ static int __do_page_fault(struct pt_regs *regs, unsigned long address,
> 		 * User mode? Just return to handle the fatal exception otherwise
> 		 * return to bad_page_fault
> 		 */
>+		up_read(&mm->mmap_sem);
> 		return is_user ? 0 : SIGBUS;
> 	}

Per the above comment, for that case handle_mm_fault()
has already released mmap_sem. The same occurs in x86,
for example.

Thanks,
Davidlohr

Powered by blists - more mailing lists

Powered by Openwall GNU/*/Linux Powered by OpenVZ