linux-kernel - Re: 2.6.24-rc5-mm1: problems with cat /proc/kpageflags

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <200712172005.38483.m.kozlowski@tuxland.pl>
Date:	Mon, 17 Dec 2007 20:05:37 +0100
From:	Mariusz Kozlowski <m.kozlowski@...land.pl>
To:	Matt Mackall <mpm@...enic.com>
Cc:	Andrew Morton <akpm@...ux-foundation.org>,
	linux-kernel@...r.kernel.org, sparclinux@...r.kernel.org,
	davem@...emloft.net
Subject: Re: 2.6.24-rc5-mm1: problems with cat /proc/kpageflags

Hello,

> > cat /proc/kpagecount on the other hand - with the change in line 710
> > - locks the box. Sysrq works, changing consoles works, but there is
> > no "BUG: soft lockup ..." message. After a while the box becomes
> > totaly unresponsive - even caps lock doesn't work, no responses to
> > ping.
> 
> Well I'm baffled. There's basically two things in that function that
> do anything interesting: pfn_to_page and put_user. access_ok is
> "return 1" on Sparc64. atomic_read is a simple read.
>
> My usual approach at this point would be to litter it with printks and
> see where its hanging.

Ok. Maybe this will help. Don't know how to compare that to the results from yesterday
(test with ppage = NULL) - maybe I f.... something up. This time I added a bunch
of printks and got these results:

This is from 'cat /proc/kpageflags' (after this the box is locked):

    01
    pfn:0, src:0, KPMSIZE:8
    23458
    ppage:0000000200000000, pfn:1

and the relevant code:

static ssize_t kpageflags_read(struct file *file, char __user *buf,
			     size_t count, loff_t *ppos)
{

	u64 __user *out = (u64 __user *)buf;
	struct page *ppage;
	unsigned long src = *ppos;
	unsigned long pfn;
	ssize_t ret = 0;
	u64 kflags, uflags;

printk("0");

	if (!access_ok(VERIFY_WRITE, buf, count))
		return -EFAULT;

printk("1");
	pfn = src / KPMSIZE;
printk("\npfn:%u, src:%u, KPMSIZE:%d\n", pfn, src, KPMSIZE);
	count = min_t(unsigned long, count, (max_pfn * KPMSIZE) - src);

printk("2");
	if (src & KPMMASK || count & KPMMASK)
		return -EIO;

printk("3");
	while (count > 0) {
printk("4");
	ppage = pfn_to_page(pfn++);
printk("5");
		if (!ppage) {
printk("6");
			kflags = 0;
printk("7");
		} else {
printk("8");
printk("\nppage:%p, pfn:%u\n", ppage, pfn);
			kflags = ppage->flags; // <---------------- something bad happens
printk("9");
		}

printk("a");



This is from 'cat /proc/kpagecount' (after this the box is locked)

    01
    pfn:0, src:0, KPMSIZE:8
    23567a
    ppage:0000000200000000, pfn:1

and this is the relevant code:

static ssize_t kpagecount_read(struct file *file, char __user *buf,
			     size_t count, loff_t *ppos)
{

	u64 __user *out = (u64 __user *)buf;
	struct page *ppage;
	unsigned long src = *ppos;
	unsigned long pfn;
	ssize_t ret = 0;
	u64 pcount;
printk("0");
	if (!access_ok(VERIFY_WRITE, buf, count))
		return -EFAULT;

printk("1");
	pfn = src / KPMSIZE;
printk("\npfn:%u, src:%u, KPMSIZE:%d\n", pfn, src, KPMSIZE);

printk("2");
	count = min_t(size_t, count, (max_pfn * KPMSIZE) - src);
printk("3");
	if (src & KPMMASK || count & KPMMASK) {

printk("4");
		return -EIO;
	}
printk("5");
	while (count > 0) {
printk("6");
		ppage = pfn_to_page(pfn++);
printk("7");
		if (!ppage) {
printk("8");
			pcount = 0;
		} else {
printk("a");
printk("\nppage:%p, pfn:%u\n", ppage, pfn);
			pcount = atomic_read(&ppage->_count); // <---------------- something bad happens
printk("b");
		}


Regards,

	Mariusz
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/