linux-kernel - Re: 2.6.24-rc8-mm1: powerpc oopses

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <1200613194.3839.22.camel@cinder.waste.org>
Date:	Thu, 17 Jan 2008 17:39:54 -0600
From:	Matt Mackall <mpm@...enic.com>
To:	Andrew Morton <akpm@...ux-foundation.org>
Cc:	Mariusz Kozlowski <m.kozlowski@...land.pl>,
	linux-kernel@...r.kernel.org, paulus@...ba.org,
	linuxppc-dev@...abs.org
Subject: Re: 2.6.24-rc8-mm1: powerpc oopses


On Thu, 2008-01-17 at 14:51 -0800, Andrew Morton wrote:
> > proc_loop: /proc/3731/task/3731/pagemap
> > kernel: BUG: sleeping function called from invalid context at fs/proc/task_mmu.c:554
> > kernel: in_atomic():1, irqs_disabled():0
> > kernel: Call Trace:
> > kernel: [cf1cddf0] [c000840c] show_stack+0x3c/0x194 (unreliable)
> > kernel: [cf1cde20] [c002b2ec] __might_sleep+0xf4/0x108
> > kernel: [cf1cde30] [c00d2d54] add_to_pagemap+0x40/0x11c
> > kernel: [cf1cde50] [c00d2f44] pagemap_pte_range+0xa8/0x10c
> > kernel: [cf1cde70] [c0081b30] walk_page_range+0x148/0x23c
> > kernel: [cf1cdeb0] [c00d3104] pagemap_read+0x15c/0x244
> > kernel: [cf1cdef0] [c0092144] vfs_read+0xc4/0x16c
> > kernel: [cf1cdf10] [c009261c] sys_read+0x4c/0x90
> > kernel: [cf1cdf40] [c001328c] ret_from_syscall+0x0/0x40
> 
> It's not really an oops - it's a warning.  add_to_pagemap() is doing a
> put_user() inside pagemap_pte_range->pte_offset_map->kmap_atomic.
> 
> A known bug, I'm afraid.
> 
> How to fix?
> 
> - double-buffer the data to be copied to userspace or
> 
> - take a local copy of the pte page then work on that instead or
> 
> - play copy_to_user_inatomic() tricks.

Hmm, this fell off my radar. How about something like this as a minimal
fix (untested as -mm is a complete doorstop for me at the moment)?

diff -r 5595adaea70f fs/proc/task_mmu.c
--- a/fs/proc/task_mmu.c	Thu Jan 17 13:26:54 2008 -0600
+++ b/fs/proc/task_mmu.c	Thu Jan 17 17:29:21 2008 -0600
@@ -582,20 +583,26 @@
 {
 	struct pagemapread *pm = private;
 	pte_t *pte;
-	int err = 0;
+	int offset = 0, err = 0;
 
 	pte = pte_offset_map(pmd, addr);
-	for (; addr != end; pte++, addr += PAGE_SIZE) {
+	for (; addr != end; offset++, addr += PAGE_SIZE) {
 		u64 pfn = PM_NOT_PRESENT;
-		if (is_swap_pte(*pte))
-			pfn = swap_pte_to_pagemap_entry(*pte);
-		else if (pte_present(*pte))
-			pfn = pte_pfn(*pte);
+		if (is_swap_pte(pte[offset]))
+			pfn = swap_pte_to_pagemap_entry(pte[offset]);
+		else if (pte_present(pte[offset]))
+			pfn = pte_pfn(pte[offset]);
+#ifdef CONFIG_HIGHPTE
+		pte_unmap(pte);
 		err = add_to_pagemap(addr, pfn, pm);
+		pte = pte_offset_map(pmd, addr);
+#else
+		err = add_to_pagemap(addr, pfn, pm);
+#endif
 		if (err)
 			return err;
 	}
-	pte_unmap(pte - 1);
+	pte_unmap(pte);
 
 	cond_resched();
 

-- 
Mathematics is the supreme nostalgia of our time.

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/