linux-kernel - [PATCH] i386 CPA fix - do not free reserved pages

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date:	Tue, 3 Jul 2007 13:33:24 -0400
From:	Mathieu Desnoyers <compudj@...stal.dyndns.org>
To:	Frederik Deweerdt <deweerdt@...e.fr>
Cc:	Alan Cox <alan@...rguk.ukuu.org.uk>, akpm@...l.org,
	linux-kernel@...r.kernel.org, Andi Kleen <ak@...e.de>
Subject: [PATCH] i386 CPA fix - do not free reserved pages

Right, there is a test missing, can you try this fix on top of my
x86_64 mm cpa cache flush fix ?


i386 CPA fix - do not free reserved pages

We have to use the same conditions found in change_page_attr in
global_tlb_flush regarding the conditions that leads to free the page.

Signed-off-by: Mathieu Desnoyers <mathieu.desnoyers@...ymtl.ca>
---
 arch/i386/mm/pageattr.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

Index: linux-2.6-lttng/arch/i386/mm/pageattr.c
===================================================================
--- linux-2.6-lttng.orig/arch/i386/mm/pageattr.c	2007-07-03 13:25:48.000000000 -0400
+++ linux-2.6-lttng/arch/i386/mm/pageattr.c	2007-07-03 13:28:34.000000000 -0400
@@ -247,7 +247,7 @@
 	list_for_each_entry_safe(pg, next, &l, lru) {
 		clear_bit(PG_arch_1, &pg->flags);
 		list_del(&pg->lru);
-		if (page_private(pg) != 0)
+		if (PageReserved(pg) || !cpu_has_pse || page_private(pg) != 0)
 			continue;
 		ClearPagePrivate(pg);
 		__free_page(pg);


* Frederik Deweerdt (deweerdt@...e.fr) wrote:
> On Tue, Jul 03, 2007 at 11:37:47AM -0400, Mathieu Desnoyers wrote:
> > Hi Alan,
> > 
> > I already sent a fix to Andrew and Andi for this (hrm, forget to CC
> > lkml on the original message):
> > 
> > 
> > x86_64 mm cpa cache flush fix
> > 
> > X86_64 and i386 cpa cache flush fix:
> > 
> > list_del the deferred list entries to poison their pointers.
> > clear the flag for every page put in the list.
> > 
> Hi Mathieu,
> 
> I've tried the patch on rc6-mm1, but it doesn't seem to fix the
> problem. From what I understood, the bad_page() is called on PG_reserved
> being set (flags:0x00000400), not the lru pointer being not NULL or
> PG_arch_1 being set.
> 
> Regards,
> Frederik
> 
> > Signed-off-by: Mathieu Desnoyers <mathieu.desnoyers@...ymtl.ca>
> > CC: Andi Kleen <ak@...e.de>
> [...]
> >  	flush_map(&l);
> >  	list_for_each_entry_safe(pg, next, &l, lru) {
> > +		clear_bit(PG_arch_1, &pg->flags);
> > +		list_del(&pg->lru);
> >  		if (page_private(pg) != 0)
> >  			continue;
> >  		ClearPagePrivate(pg);
> > -		clear_bit(PG_arch_1, &pg->flags);
> >  		__free_page(pg);
> >  	}
> >  }
> [...]
> > * Alan Cox (alan@...rguk.ukuu.org.uk) wrote:
> > > X86 32bit with lots of debug turned on I get this:
> [...]
> > > Bad page state in process 'swapper'
> > > page:c10000c0 flags:0x00000400 mapping:00000000 mapcount:0 count:0
> > > Trying to fix it up, but a reboot is needed
> > > Backtrace:
> > >  [<c024589c>] bad_page+0x6c/0x100
> > >  [<c024648d>] free_hot_cold_page+0x5d/0x140
> > >  [<c02116c2>] global_flush_tlb+0x112/0x130
> > >  [<c020102d>] init_post+0xd/0xe0
> > >  [<c047c876>] kernel_init+0x216/0x220
> > >  [<c0214c50>] schedule_tail+0x0/0xe0
> > >  [<c047c660>] kernel_init+0x0/0x220
> > >  [<c047c660>] kernel_init+0x0/0x220
> > >  [<c0204227>] kernel_thread_helper+0x7/0x10
> > >  =======================
> > > Hexdump:
> > > 000: 00 06 00 00 01 00 00 00 ff ff ff ff 0f 00 00 00
> > > 010: 00 00 00 00 00 00 00 00 78 00 00 c1 b8 00 00 c1
> > > 020: 00 06 00 00 01 00 00 00 ff ff ff ff a7 03 00 00
> > > 030: 00 00 00 00 00 00 00 00 98 00 00 c1 d8 00 00 c1
> > > 040: 00 04 00 00 00 00 00 00 ff ff ff ff 00 00 00 00
> > > 050: 00 00 00 00 00 00 00 00 b8 00 00 c1 f8 00 00 c1
> > > 060: 00 06 00 00 01 00 00 00 ff ff ff ff 00 04 00 00
> > > 070: 00 00 00 00 00 00 00 00 d8 00 00 c1 18 01 00 c1
> > > 080: 00 06 00 00 01 00 00 00 ff ff ff ff 9c 03 00 00
> > > 090: 00 00 00 00 00 00 00 00 f8 00 00 c1 38 01 00 c1
> > > 0a0: 00 06 00 00 01 00 00 00 ff ff ff ff 00 04 00 00
> > > 0b0: 00 00 00 00 00 00 00 00 18 01 00 c1 58 01 00 c1
> > > -
> > > To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
> > > the body of a message to majordomo@...r.kernel.org
> > > More majordomo info at  http://vger.kernel.org/majordomo-info.html
> > > Please read the FAQ at  http://www.tux.org/lkml/
> > > 
> > 
> > -- 
> > Mathieu Desnoyers
> > Computer Engineering Ph.D. Student, Ecole Polytechnique de Montreal
> > OpenPGP key fingerprint: 8CD5 52C3 8E3C 4140 715F  BA06 3F25 A8FE 3BAE 9A68
> > -
> > To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
> > the body of a message to majordomo@...r.kernel.org
> > More majordomo info at  http://vger.kernel.org/majordomo-info.html
> > Please read the FAQ at  http://www.tux.org/lkml/
> > 
> 

-- 
Mathieu Desnoyers
Computer Engineering Ph.D. Student, Ecole Polytechnique de Montreal
OpenPGP key fingerprint: 8CD5 52C3 8E3C 4140 715F  BA06 3F25 A8FE 3BAE 9A68
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/