linux-kernel - [patches] VM-related fixes

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20120305063707.GH23916@ZenIV.linux.org.uk>
Date:	Mon, 5 Mar 2012 06:37:07 +0000
From:	Al Viro <viro@...IV.linux.org.uk>
To:	Linus Torvalds <torvalds@...ux-foundation.org>
Cc:	linux-kernel@...r.kernel.org, arve@...roid.com, airlied@...ux.ie,
	carsteno@...ibm.com, steiner@....com
Subject: [patches] VM-related fixes

	I'd been crawling through VMA-related code for the last couple
of weeks; the obvious parts of fallout are in followups and IMO they
need to go into -stable as well; there's more, including some bugs I
don't know what to do about and patches that need more testing...

* aout handling needs to do setup_arg_pages() _before_ it does any mmap();
otherwise we might easily end up with bprm->vma freed by the time we
get to setup_arg_pages().  Sure, long-term we want setup_new_exec()
merged with setup_arg_pages(), but not this late in the cycle...

* anonymous shared mapping should *not* get VM_GROWS{UP,DOWN}, or we'll
end up with very unpleasant things happening.

* __unmap_hugepage_range() calls flush_tlb_range() without ->mmap_sem,
which means that we need ->page_table_lock.  Call it before dropping
->page_table_lock, not after that...

[unsolved] binder is insane, even more than usual for drivers/staging.
It stores a reference to mm at open() time, then it stores a reference to
vma at mmap() time, then it cheerfully works with that ->vma assuming that
->mmap_sem on stored reference to ->mm would suffice.  Guess what happens
if somebody opens it and then forks and does mmap in child?  Moreover, if
we fork() and have child exit(), we get ->close() called on each VMA we'd
copied into child.  Since they have stored reference to vma invalidated by
->close(), that has unpleasant side effects, to put it mildly.  And yes,
I realize that android userland probably doesn't do anything of that kind;
fat lot of good it does us...

[unsolved] a bunch of ->fault() instances are doing things that need
->mmap_sem exclusive; e.g. vm_insert_page() is called by xip_file_fault(),
drivers/misc/sgi-gru/grumain.c:gru_fault() does remap_pfn_range().
drivers/gpu/drm/gma500/framebuffer.c:psbfb_vm_fault() does
        vma->vm_page_prot = pgprot_noncached(vma->vm_page_prot);
and drivers/gpu/drm/ttm/ttm_bo_vm.c:ttm_bo_vm_fault() does very similar
things, same for spufs ->fault() instances.
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/