linux-kernel - Re: [RFC PATCH] Fix: x86 unaligned _

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Wed, 24 Jun 2015 10:00:12 -0700
From:	Linus Torvalds <torvalds@...ux-foundation.org>
To:	Mathieu Desnoyers <mathieu.desnoyers@...icios.com>
Cc:	Thomas Gleixner <tglx@...utronix.de>,
	Linux Kernel Mailing List <linux-kernel@...r.kernel.org>,
	Ingo Molnar <mingo@...hat.com>,
	"H. Peter Anvin" <hpa@...or.com>,
	"the arch/x86 maintainers" <x86@...nel.org>
Subject: Re: [RFC PATCH] Fix: x86 unaligned __memcpy to/from virtual memory

On Wed, Jun 24, 2015 at 9:14 AM, Mathieu Desnoyers
<mathieu.desnoyers@...icios.com> wrote:
> When trying to change memory allocation from kmalloc to vmalloc to
> handle memory fragmentation for reallocation of a growing string within
> a kernel module, our testsuite started to trigger kernel OOPS. It
> triggers when the string is copied into a ring buffer using memcpy,
> piece-wise.

I hate your patch, just because it doesn't make sense. The "when
non-aligned, don't do movsq" might make sense for performance, but it
does *not* make sense for correctness.

Why would "rep movsq" trigger the oops, but memcpy_orig not? I think
the fundamental bug is something else.

I don't see *what* the bug is, though.

Very odd.

x86 people, can you see anything there? It does look like
vmalloc_fault() *should* have triggered, so why didn't it? The address
is definitely in the VMALLOC_START/END range, and the error code is
0000, so how come didn't vmalloc_fault() handle this?

> This points to arch/x86/lib/memcpy_64.S:__memcpy rep movsq instruction.
> This could be reproduced on my Lenovo x240 laptop (i7 CPU), and within a
> virtual machine running on a Intel(R) Xeon(R) CPU E5-2630 v3 host.
> Interestingly, with the VM having the rep_good flag (but not erms), the issue
> triggers. However, if the VM has both rep_good and erms flags, the issue does
> not trigger.

With ERMS, I think we end up using just "rep movsb" instead. But there
should be absolutely no difference in fault patterns.

I see the QEMU part, is this just regular kvm? Could you add a debug
printk to the vmalloc_fault() caller and then reproduce the oops? It
shouldn't trigger enough to be a horrible logging problem.

                  Linus
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/