lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite for Android: free password hash cracker in your pocket
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-Id: <20090104233642.745CF3E6653@basil.firstfloor.org>
Date:	Mon,  5 Jan 2009 00:36:42 +0100 (CET)
From:	Andi Kleen <andi@...stfloor.org>
To:	akpm@...ux-foundation.org, x86@...nel.org,
	linux-kernel@...r.kernel.org
Subject: [PATCH] [5/5] Avoid theoretical vmalloc fault loop


Ajith Kumar noticed:

I was going through the vmalloc fault handling for x86_64 and am unclear
about the following lines in the vmalloc_fault() function.

pgd = pgd_offset(current->mm ?: &init_mm, address);
pgd_ref = pgd_offset_k(address);

Here the intention is to get the pgd corresponding to the current
process and sync it up with the pgd in init_mm(obtained from
pgd_offset_k). However, for kernel threads current->mm is NULL and hence
pgd = pgd_offset(init_mm, address) = pgd_ref which means the fault
handler returns without setting the pgd entry in the MM structure in
the context of which the kernel thread has faulted. This could lead to
never-ending faults and busy looping of kernel threads like pdflush.
So, shouldn't the pgd = pgd_offset(current->mm ?: &init_mm, address);
be
pgd = pgd_offset(current->active_mm ?: &init_mm, address);

AK: We can use active_mm unconditionally because it should
be always set. Do that.

Signed-off-by: Andi Kleen <ak@...ux.intel.com>

---
 arch/x86/mm/fault.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

Index: linux-2.6.28-test/arch/x86/mm/fault.c
===================================================================
--- linux-2.6.28-test.orig/arch/x86/mm/fault.c	2008-10-24 13:34:41.000000000 +0200
+++ linux-2.6.28-test/arch/x86/mm/fault.c	2009-01-02 16:01:11.000000000 +0100
@@ -533,7 +533,7 @@
 	   happen within a race in page table update. In the later
 	   case just flush. */
 
-	pgd = pgd_offset(current->mm ?: &init_mm, address);
+	pgd = pgd_offset(current->active_mm, address);
 	pgd_ref = pgd_offset_k(address);
 	if (pgd_none(*pgd_ref))
 		return -1;
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

Powered by blists - more mailing lists

Powered by Openwall GNU/*/Linux Powered by OpenVZ