linux-kernel - Re: Unmapping of UIO logical memory causing a trace

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Wed, 12 Aug 2015 13:25:53 +0530
From:	Ankit Jindal <ajindal@....com>
To:	Greg Kroah-Hartman <gregkh@...uxfoundation.org>
Cc:	linux-kernel@...r.kernel.org, "Hans J. Koch" <hjk@...sjkoch.de>,
	Pranavkumar Sawargaonkar <psawargaonkar@....com>,
	Jitendra Kanitkar <jkanitkar@....com>,
	Tushar Jagad <tjagad@....com>
Subject: Re: Unmapping of UIO logical memory causing a trace

Hi Greg,

On Wed, Aug 12, 2015 at 3:15 AM, Greg Kroah-Hartman
<gregkh@...uxfoundation.org> wrote:
> On Tue, Aug 11, 2015 at 04:39:08PM +0530, Ankit Jindal wrote:
>> Hi,
>>
>> We have observed an issue where kmalloc of a small sized memory causes
>> an occasional trace when unmapping the mmaped memory via UIO framework
>> This trace is coming when kernel sees a negative value in
>> page->_mapcount. Trace is pasted at the end of the mail.
>>
>> After debugging this issue further, we realized following sequence
>> occurs when kmalloc is used to allocate small memory using slub
>> allocator:
>> 1. Frozen bit (msb) of the page from which memory has been allocated
>> is set (which is an union with _mapcount).
>> 2. If there are free objects in the the same page then this frozen bit
>> remains set even after kernel boots completely.
>> 3. When user space calls unmap of this memory, vma_unmap_single()
>> treats the _mapcount as a negative (as frozen bit is set), causing a
>> trace.
>>
>> We are not sure whether exposing kernel memory of size
>> less than PAGE_SIZE via UIO is a valid use case ? In case this is an invalid
>> use case then shouldn't the UIO framework restrict mapping of non
>> PAGE_SIZE aligned memory and size not in order of PAGE_SIZE.
>
> We've had a few discussions about this in the past, and one proposed
> patch which had to be reverted because it broke some working systems, so
> it's a messy thing.
>
> What UIO driver are you using that causes this behavior?

We have observed this during the development of new UIO driver for our
soc. In our driver, we need to parse non probable properties of device
and provide these details to our user application. For this we do a
kmalloc of device info(approx size 80 bytes) and pass this address to
user space via UIO mem logical.

>
> thanks,
>
> greg k-h

Thanks,
Ankit
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/