| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <CAMi1Hd3WaUkip78K6ovcL87EAdYrWC-YJ3epKY62dXM5xLGTZw@mail.gmail.com>
Date: Sun, 1 Mar 2015 23:47:12 +0530
From: Amit Pundir <amit.pundir@...aro.org>
To: Andrey Ryabinin <a.ryabinin@...sung.com>
Cc: linux-kernel@...r.kernel.org, Dmitry Vyukov <dvyukov@...gle.com>,
Kostya Serebryany <kcc@...gle.com>,
Dmitry Chernenkov <dmitryc@...gle.com>,
Andrey Konovalov <adech.fo@...il.com>,
Yuri Gribov <tetra2005@...il.com>,
Konstantin Khlebnikov <koct9i@...il.com>,
sasha.levin@...cle.com, cl@...ux.com, iamjoonsoo.kim@....com,
dave.hansen@...el.com, andi@...stfloor.org, mingo@...e.hu,
Thomas Gleixner <tglx@...utronix.de>, hpa@...or.com,
penberg@...nel.org, rientjes@...gle.com,
gregkh@...uxfoundation.org,
Arve Hjønnevåg <arve@...roid.com>,
riandrews@...roid.com,
Serban Constantinescu <serban.constantinescu@....com>,
John Stultz <john.stultz@...aro.org>,
Sumit Semwal <sumit.semwal@...aro.org>,
devel@...verdev.osuosl.org
Subject: Re: [PATCH v2] android: binder: fix binder mmap failures
On 27 February 2015 at 23:14, Andrey Ryabinin <a.ryabinin@...sung.com> wrote:
> binder_update_page_range() initializes only addr and size
> fields in 'struct vm_struct tmp_area;' and passes it to
> map_vm_area().
>
> Before 71394fe50146 ("mm: vmalloc: add flag preventing guard hole allocation")
> this was because map_vm_area() didn't use any other fields
> in vm_struct except addr and size.
>
> Now get_vm_area_size() (used in map_vm_area()) reads vm_struct's
> flags to determine whether vm area has guard hole or not.
>
> binder_update_page_range() don't initialize flags field, so
> this causes following binder mmap failures:
> -----------[ cut here ]------------
> WARNING: CPU: 0 PID: 1971 at mm/vmalloc.c:130
> vmap_page_range_noflush+0x119/0x144()
> CPU: 0 PID: 1971 Comm: healthd Not tainted 4.0.0-rc1-00399-g7da3fdc-dirty #157
> Hardware name: ARM-Versatile Express
> [<c001246d>] (unwind_backtrace) from [<c000f7f9>] (show_stack+0x11/0x14)
> [<c000f7f9>] (show_stack) from [<c049a221>] (dump_stack+0x59/0x7c)
> [<c049a221>] (dump_stack) from [<c001cf21>] (warn_slowpath_common+0x55/0x84)
> [<c001cf21>] (warn_slowpath_common) from [<c001cfe3>]
> (warn_slowpath_null+0x17/0x1c)
> [<c001cfe3>] (warn_slowpath_null) from [<c00c66c5>]
> (vmap_page_range_noflush+0x119/0x144)
> [<c00c66c5>] (vmap_page_range_noflush) from [<c00c716b>] (map_vm_area+0x27/0x48)
> [<c00c716b>] (map_vm_area) from [<c038ddaf>]
> (binder_update_page_range+0x12f/0x27c)
> [<c038ddaf>] (binder_update_page_range) from [<c038e857>]
> (binder_mmap+0xbf/0x1ac)
> [<c038e857>] (binder_mmap) from [<c00c2dc7>] (mmap_region+0x2eb/0x4d4)
> [<c00c2dc7>] (mmap_region) from [<c00c3197>] (do_mmap_pgoff+0x1e7/0x250)
> [<c00c3197>] (do_mmap_pgoff) from [<c00b35b5>] (vm_mmap_pgoff+0x45/0x60)
> [<c00b35b5>] (vm_mmap_pgoff) from [<c00c1f39>] (SyS_mmap_pgoff+0x5d/0x80)
> [<c00c1f39>] (SyS_mmap_pgoff) from [<c000ce81>] (ret_fast_syscall+0x1/0x5c)
> ---[ end trace 48c2c4b9a1349e54 ]---
> binder: 1982: binder_alloc_buf failed to map page at f0e00000 in kernel
> binder: binder_mmap: 1982 b6bde000-b6cdc000 alloc small buf failed -12
>
> Use map_kernel_range_noflush() instead of map_vm_area() as this is better
> API for binder's purposes and it allows to get rid of 'vm_struct tmp_area' at all.
>
> Fixes: 71394fe50146 ("mm: vmalloc: add flag preventing guard hole allocation")
> Signed-off-by: Andrey Ryabinin <a.ryabinin@...sung.com>
> Reported-by: Amit Pundir <amit.pundir@...aro.org>
> ---
> Changes since v1:
> - fixed ret check after map_kernel_ranges_noflush().
>
> drivers/android/binder.c | 10 +++++-----
> 1 file changed, 5 insertions(+), 5 deletions(-)
>
> diff --git a/drivers/android/binder.c b/drivers/android/binder.c
> index 33b09b6..6607f3c 100644
> --- a/drivers/android/binder.c
> +++ b/drivers/android/binder.c
> @@ -551,7 +551,6 @@ static int binder_update_page_range(struct binder_proc *proc, int allocate,
> {
> void *page_addr;
> unsigned long user_page_addr;
> - struct vm_struct tmp_area;
> struct page **page;
> struct mm_struct *mm;
>
> @@ -600,10 +599,11 @@ static int binder_update_page_range(struct binder_proc *proc, int allocate,
> proc->pid, page_addr);
> goto err_alloc_page_failed;
> }
> - tmp_area.addr = page_addr;
> - tmp_area.size = PAGE_SIZE + PAGE_SIZE /* guard page? */;
> - ret = map_vm_area(&tmp_area, PAGE_KERNEL, page);
> - if (ret) {
> + ret = map_kernel_range_noflush((unsigned long)page_addr,
> + PAGE_SIZE, PAGE_KERNEL, page);
> + flush_cache_vmap((unsigned long)page_addr,
> + (unsigned long)page_addr + PAGE_SIZE);
> + if (ret != 1) {
> pr_err("%d: binder_alloc_buf failed to map page at %p in kernel\n",
> proc->pid, page_addr);
> goto err_map_kernel_failed;
> --
Works for me. Thanks.
Tested-by: Amit Pundir <amit.pundir@...aro.org>
> 2.3.0
>
> --
> To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
> the body of a message to majordomo@...r.kernel.org
> More majordomo info at http://vger.kernel.org/majordomo-info.html
> Please read the FAQ at http://www.tux.org/lkml/
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
Powered by blists - more mailing lists