linux-kernel - Re: [patch 071/149] ARM: 6166/1: Proper prefetch abort handling on pre-ARMv6

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20100701225911.GC10481@shutemov.name>
Date:	Fri, 2 Jul 2010 01:59:11 +0300
From:	"Kirill A. Shutemov" <kirill@...temov.name>
To:	Russell King <rmk@....linux.org.uk>, g@...temov.name
Cc:	Greg KH <gregkh@...e.de>, linux-kernel@...r.kernel.org,
	stable@...nel.org, stable-review@...nel.org,
	torvalds@...ux-foundation.org, akpm@...ux-foundation.org,
	alan@...rguk.ukuu.org.uk, Anfei Zhou <anfei.zhou@...il.com>
Subject: Re: [patch 071/149] ARM: 6166/1: Proper prefetch abort handling on
 pre-ARMv6

On Thu, Jul 01, 2010 at 11:48:37PM +0100, Russell King wrote:
> On Fri, Jul 02, 2010 at 01:25:41AM +0300, Kirill A. Shutemov wrote:
> > On Thu, Jul 01, 2010 at 03:17:28PM -0700, Greg KH wrote:
> > > We (well, I) like to keep the commit log identical to what is upstream
> > > just to make things easier all around.  Otherwise people start asking
> > > for spelling fixes, clarifications, and all sorts of other stuff (like
> > > this.)
> > 
> > Ok, fair enough.
> > 
> > I asked for it because I was confused by this commit message while
> > investigate (the same) problem on ARMv7 CPU.
> 
> You shouldn't get anywhere near this on ARMv7, because we know the cause
> of the prefetch abort on those CPUs.
> 
> On pre-ARMv6 CPUs, we always treat all prefetch aborts as a translation
> faults.  The problem which this commit addresses occurs when userspace
> tries to execute code above TASK_SIZE - we're sent into a loop of prefetch
> aborts (because we are unable to determine that it is a permission fault.)
> 
> ARMv6 and ARMv7 CPUs have an instruction fault status register, which
> tells us why the abort happened.  On these CPUs, permission faults go
> nowhere near the translation fault handler.

I know it. I was involved in writing this code.
 
> One possibility is that for some reason you're using the legacy prefetch
> abort code or pre-IFSR code, which will always tell the kernel that its
> a translation fault - and in this case, this patch would improve the
> situation.  What kernel version are you using?

2.6.32

> The commit message is accurate for the kernel version to which it was
> originally applied.

Simple testcase:

#include <stdio.h>
#include <unistd.h>
#include <sys/types.h>
#include <sys/stat.h>
#include <fcntl.h>

int main(int argc, char **argv)
{
	int fd;
	void (*p)(void);

	fd = open("/dev/urandom", O_RDONLY);
	read(0, &p, sizeof(p));
	printf("p: %p\n", p);
	p();
	return 0;
}

If you run this test in loop on kernel without the patch you'll finally
get hung instead SIGSEGV.

It seems the patch fixes more than it was written for. :)

-- 
 Kirill A. Shutemov
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/