linux-kernel - Re: [patch] x86: fix PTE corruption issue while mapping RAM using /dev/mem

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20090112235135.GA22722@elte.hu>
Date:	Tue, 13 Jan 2009 00:51:35 +0100
From:	Ingo Molnar <mingo@...e.hu>
To:	Suresh Siddha <suresh.b.siddha@...el.com>
Cc:	hpa@...or.com, tglx@...utronix.de, linux-kernel@...r.kernel.org,
	venkatesh.pallipadi@...el.com, Daniel.Beschorner@...ton.com,
	pageexec@...email.hu, stable@...nel.org
Subject: Re: [patch] x86: fix PTE corruption issue while mapping RAM using
	/dev/mem


* Suresh Siddha <suresh.b.siddha@...el.com> wrote:

> From: Suresh Siddha <suresh.b.siddha@...el.com>
> Subject: x86: fix PTE corruption issue while mapping RAM using /dev/mem 
> 
> Beschorner Daniel reported:
> > hwinfo problem since 2.6.28, showing this in the oops:
> > 	Corrupted page table at address 7fd04de3ec00
> 
> PaX Team reported a regression with this commit:
> 
> >	commit 9542ada803198e6eba29d3289abb39ea82047b92
> >	Author: Suresh Siddha <suresh.b.siddha@...el.com>
> >	Date:   Wed Sep 24 08:53:33 2008 -0700
> >
> >	    x86: track memtype for RAM in page struct
> 
> This commit breaks mapping any RAM page through /dev/mem, as the
> reserve_memtype() was not initializing the return attribute type and as such
> corrupting the PTE entry that was setup with the return attribute type.
> 
> Because of this bug, application mapping this RAM page through /dev/mem
> will die with "Corrupted page table at address xxxx" message in the kernel
> log and also the kernel identity mapping which maps the underlying RAM
> page gets converted to UC.
> 
> Fix this by initializing the return attribute type before calling
> reserve_ram_pages_type()
> 
> Reported-by: PaX Team <pageexec@...email.hu>
> Reported-and-tested-by: Beschorner Daniel <Daniel.Beschorner@...ton.com>
> Tested-and-Acked-by: PaX Team <pageexec@...email.hu>
> Signed-off-by: Suresh Siddha <suresh.b.siddha@...el.com>
> Signed-off-by: Venkatesh Pallipadi <venkatesh.pallipadi@...el.com>
> Cc: <stable@...nel.org>
> ---

applied to tip/x86/urgent, thanks Suresh!

note that the patch caused some conflicts (there were other changes in 
pat.c) - i merged it up manually but could you please check the final 
commit in tip/master whether it's all OK?

	Ingo
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/