linux-kernel - Re: [PATCH v2] arm: cmpxchg syscall should data abort if page not write

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <alpine.LFD.2.00.1103171344270.26889@xanadu.home>
Date:	Thu, 17 Mar 2011 13:57:25 -0400 (EDT)
From:	Nicolas Pitre <nicolas.pitre@...aro.org>
To:	Ashwin Chaugule <ashbertslists@...il.com>
cc:	Po-Yu Chuang <ratbert.chuang@...il.com>,
	Russell King - ARM Linux <linux@....linux.org.uk>,
	Po-Yu Chuang <ratbert@...aday-tech.com>, tony@...mide.com,
	lkml <linux-kernel@...r.kernel.org>, joe@...ches.com,
	linux-arm-kernel@...ts.infradead.org
Subject: Re: [PATCH v2] arm: cmpxchg syscall should data abort if page not
 write

On Thu, 17 Mar 2011, Ashwin Chaugule wrote:

> On Thu, Mar 17, 2011 at 1:01 PM, Nicolas Pitre <nicolas.pitre@...aro.org> wrote:
> > On Tue, 15 Mar 2011, Po-Yu Chuang wrote:
> >
> >> From: Po-Yu Chuang <ratbert@...aday-tech.com>
> >>
> >> If the page to cmpxchg is user mode read only (not write),
> >> we should simulate a data abort first.
> >>
> >> Signed-off-by: Po-Yu Chuang <ratbert@...aday-tech.com>
> >
> > Acked-by: Nicolas Pitre <nicolas.pitre@...aro.org>
> >
> >> ---
> >> v2:
> >> remove !pte_young() check
> >>
> >>  arch/arm/kernel/traps.c |    2 +-
> >>  1 files changed, 1 insertions(+), 1 deletions(-)
> >>
> >> diff --git a/arch/arm/kernel/traps.c b/arch/arm/kernel/traps.c
> >> index 446aee9..eac7c05 100644
> >> --- a/arch/arm/kernel/traps.c
> >> +++ b/arch/arm/kernel/traps.c
> >> @@ -563,7 +563,7 @@ asmlinkage int arm_syscall(int no, struct pt_regs *regs)
> >>               if (!pmd_present(*pmd))
> >>                       goto bad_access;
> >>               pte = pte_offset_map_lock(mm, pmd, addr, &ptl);
> >> -             if (!pte_present(*pte) || !pte_dirty(*pte)) {
> >> +             if (!pte_present(*pte) || !pte_write(*pte) || !pte_dirty(*pte)) {
> >>                       pte_unmap_unlock(pte, ptl);
> >>                       goto bad_access;
> >>               }
> >> --
> >> 1.6.3.3
> >>
> 
> 
> Just beginning to understand the subtleties involved, so please
> correct me if I'm wrong.
> Wont this patch also fix the problem that was brought up with futexes
> on ARM SMP ?

Nope.  The code being fixed here was suptly broken so it needs fixing.  
However this code is almost never used, if at all, as it is a fall-back 
solution for when all the better alternatives are not available for some 
reasons (and I'm still wondering what those reasons are for Po-Yu Chuang 
to actually use that code).  In practice this bug should have affected 
no one.

If you have SMP then this code is definitively not what you should be 
using.


Nicolas