linux-kernel - Re: fuse, get_user_pages, flush_anon_page, aliasing caches and all that again

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20061231092318.GA1702@flint.arm.linux.org.uk>
Date:	Sun, 31 Dec 2006 09:23:18 +0000
From:	Russell King <rmk+lkml@....linux.org.uk>
To:	David Miller <davem@...emloft.net>
Cc:	torvalds@...l.org, miklos@...redi.hu, linux-kernel@...r.kernel.org,
	linux-arch@...r.kernel.org, akpm@...l.org
Subject: Re: fuse, get_user_pages, flush_anon_page, aliasing caches and all that again

On Sat, Dec 30, 2006 at 09:23:38PM -0800, David Miller wrote:
> From: Russell King <rmk+lkml@....linux.org.uk>
> Date: Sat, 30 Dec 2006 22:46:04 +0000
> 
> > iirc, flush_anon_page() was introduced to fix non-working fuse on parisc,
> > which occurs because fuse wants to use get_user_pages() to read data from
> > the current processes memory space.
> > 
> > get_user_pages() contains a call to flush_dcache_page(), whose behaviour
> > is defined for shared mappings.  Anonymous pages are unspecified.  It
> > appears that flush_anon_page() was introduced to correct this oversight.
> 
> Sparc64 flushes anonymous pages too when flush_dcache_page() is
> called on such pages.  It only tries to "defer" flushes for
> pages which have a non-NULL page_mapping().  For NULL page_mapping()
> we just flush immediately.

We do this on ARM - if page_mapping() is NULL, we flush the kernel
alias unconditionally.  However, we have no view where the user
mapping of that page is, which is where the problem is.  Cache lines
remain allocated for the user mapping and data contained within is
not visible via the kernel mapping.

> For the ptrace() cases we created the copy_{to,from}_user_page()
> interfaces.  So that when you access data inside of pages obtained via
> a get_user_pages() call, you are supposed to use those two interfaces
> so that everything works out right.
> 
> Therefore, FUSE probably could have been fixed by judicious use
> of copy_{to,from}_user_page() calls instead of adding this new
> ad-hoc flush_anon_page() thing.

It would've been nice to have had your view when the whole thing blew
up.

However, it's not only FUSE which is suffering - direct-IO also doesn't
work.  If my analysis is correct, only _two_ users of get_user_pages()
with the current process actually does the right thing and that's ptrace
and ELF core dumping.  All other users are buggy.

-- 
Russell King
 Linux kernel    2.6 ARM Linux   - http://www.arm.linux.org.uk/
 maintainer of:
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/