linux-kernel - Re: linux-v3.9-rc3: BUG: Bad page map in process trinity-child6 pte:002f9045 pmd:29e421e1

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Tue, 26 Mar 2013 16:03:46 -0700 (PDT)
From:	Hugh Dickins <hughd@...gle.com>
To:	Toralf Foerster <toralf.foerster@....de>
cc:	richard -rw- weinberger <richard.weinberger@...il.com>,
	Andrew Morton <akpm@...ux-foundation.org>,
	user-mode-linux-user@...ts.sourceforge.net,
	Linux Kernel <linux-kernel@...r.kernel.org>, linux-mm@...ck.org
Subject: Re: linux-v3.9-rc3: BUG: Bad page map in process trinity-child6
 pte:002f9045 pmd:29e421e1

On Tue, 26 Mar 2013, Toralf Foerster wrote:
> On 03/25/2013 11:53 PM, Andrew Morton wrote:
> > On Fri, 22 Mar 2013 18:28:36 +0100 Toralf Foerster <toralf.foerster@....de> wrote:
> > 
> >> > Using trinity I often trigger under a user mode linux image with host kernel 3.8.4
> >> > and guest kernel linux-v3.9-rc3-244-g9217cbb the following :
> >> > (The UML guest is a 32bit stable Gentoo Linux)
> > I assume 3.8 is OK?
> > 
> With UML kernel 3.7.10 (host kernel still 3.8.4) I can trigger this
> issue too.
> Just to clarify it - here the bug appears in the UML kernel - the host
> kernel is ok (I can of course crash a host kernel too by trinity'ing an
> UML guest, but that's another thread - see [1])
> 
> 
> FWIW he trinity command is just a test of 1 syscall:
> 
> $> trinity --children 1 --victims /mnt/nfs/n22/victims -c mremap
> 
> 
> 
> [1] https://lkml.org/lkml/2013/3/24/174

I should think it's been like this for five years, or even more: maybe
you are the first person to try unmapping user address 0x100000 on UML;
though it's odd that you find it using mremap than the more common munmap. 

uml_setup_stubs() sets up the special vma with install_special_mapping(),
but instead of then faulting in the two pages concerned, it has preset
the ptes with init_stub_pte(), which did not increment page mapcount.

munmap() that area (or set up another mapping in that place), and
zap_pte_range() will decrement page mapcount negative, hence the
"Bad page" errors.  Whereas UML uses an arch_exit_mmap() hook to
clear the ptes at exit time, to avoid encountering such errors.

I think that adding VM_PFNMAP to those install_special_mapping() flags
would be enough to fix it (and avoid the need for the arch_exit_mmap(),
and let vm_insert_pfn() do the work of init_stub_pte()); but I'm not
certain that would be the approved way, and I may have missed problems
doing it like this (which would disallow get_user_pages(), e.g. ptrace,
on that area: which might or might not be a good thing, I don't know).

I'm saying this just by examination, I've not tried any of it at all.
Over to Richard.

Hugh
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/