linux-kernel - Re: Regression in v4.0.0-rc1 with Android Binder

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <alpine.DEB.2.10.1502261859210.24302@chino.kir.corp.google.com>
Date:	Thu, 26 Feb 2015 19:01:28 -0800 (PST)
From:	David Rientjes <rientjes@...gle.com>
To:	Arve Hjønnevåg <arve@...roid.com>
cc:	Amit Pundir <amit.pundir@...aro.org>,
	LKML <linux-kernel@...r.kernel.org>, a.ryabinin@...sung.com,
	dvyukov@...gle.com, kcc@...gle.com, dmitryc@...gle.com,
	adech.fo@...il.com, tetra2005@...il.com, koct9i@...il.com,
	sasha.levin@...cle.com, cl@...ux.com, iamjoonsoo.kim@....com,
	dave.hansen@...el.com, andi@...stfloor.org,
	Ingo Molnar <mingo@...e.hu>,
	Thomas Gleixner <tglx@...utronix.de>,
	"H. Peter Anvin" <hpa@...or.com>, penberg@...nel.org,
	Greg KH <gregkh@...uxfoundation.org>,
	Riley Andrews <riandrews@...roid.com>,
	Serban Constantinescu <serban.constantinescu@....com>,
	John Stultz <john.stultz@...aro.org>,
	Sumit Semwal <sumit.semwal@...aro.org>
Subject: Re: Regression in v4.0.0-rc1 with Android Binder

On Thu, 26 Feb 2015, Arve Hjønnevåg wrote:

> > ----------8<----------
> > --- a/drivers/android/binder.c
> > +++ b/drivers/android/binder.c
> > @@ -601,6 +601,7 @@ static int binder_update_page_range(struct
> > binder_proc *proc, int allocate,
> >                         goto err_alloc_page_failed;
> >                 }
> >                 tmp_area.addr = page_addr;
> > +               tmp_area.flags &= ~VM_NO_GUARD;
> 
> This variable is not initialized, so I would expect this to add a
> warning. Setting it to VM_NO_GUARD and removing, " + PAGE_SIZE /*
> guard page? */" fromt he next line would be better. However, the "new"
> map_kernel_range_noflush api seems like a better api to use for this,
> since it removes the need to create a dummy vm_struct at all.
> 

Yeah, this is what you want to do and it's a bug in commit 71394fe50146 
("mm: vmalloc: add flag preventing guard hole allocation") that started to 
look at tmp_area.size without fixing up any of the callers when 
tmp_area.addr and tmp_area.size were only important in the past.  It 
shouldn't take much work to make this use map_kernel_range_noflush().

> >                 tmp_area.size = PAGE_SIZE + PAGE_SIZE /* guard page? */;
> >                 ret = map_vm_area(&tmp_area, PAGE_KERNEL, page);
> >                 if (ret) {
> > ---------->8----------