linux-kernel - Re: /dev/mem and PCI memory = EFAULT (regression?)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CA+55aFz_n8DJUtXjoJn9vD=rEo-Rn1_mcx9OX50OS5wEb5On_w@mail.gmail.com>
Date:   Fri, 28 Oct 2016 16:26:13 -0700
From:   Linus Torvalds <torvalds@...ux-foundation.org>
To:     Stas Sergeev <stsp@...t.ru>
Cc:     Andy Lutomirski <luto@...capital.net>,
        Linux kernel <linux-kernel@...r.kernel.org>,
        dosemu-devel <dosemu-devel@...ts.sourceforge.net>,
        Bart Oldeman <bartoldeman@...rs.sourceforge.net>,
        "Eric W. Biederman" <ebiederm@...ssion.com>
Subject: Re: /dev/mem and PCI memory = EFAULT (regression?)

On Fri, Oct 28, 2016 at 2:36 PM, Stas Sergeev <stsp@...t.ru> wrote:
>>>> On Fri, Oct 28, 2016 at 2:03 PM, Stas Sergeev <stsp@...t.ru> wrote:
>
> Hello.
>
> For the long time dosemu used /dev/mem for vga pass-through.
> Now it appears /dev/mem has this check:
> http://lxr.free-electrons.com/source/drivers/char/mem.c#L51
> which prevents an accesses to PCI memory regions if the
> "high_memory" points low enough. It seems "high_memory"
> just points to the end of the physical ram, so depending on
> the ram size you either can access PCI devices or you get
> EFAULT.
> Was it wrong to use /dev/mem for accessing the PCI devices?
> How should I do that now?

Has it ever worked for you? That code is ancient, going back in some
form or another at least ten years.

So /dev/mem does not allow "read()/write()" on IO memory, and really
hasn't in a long long time (maybe ever, quite frankly). It does allow
it on regular RAM, but STRICT_DEV_MEM then disallows that too for
security reasons (and realistically, everybody uses STRICT_DEV_MEM
these days).

What people do use /dev/mem for is to mmap() PCI memory, and then you
can access it from user space. That's the traditional model that X.org
used to do etc.

I'm surprised if there is a regression here, because I think
read/write really hasn't been supported in like forever. It's
fundamentally impossible to do on some architectures: the physical
access depends on the _size_ of the access on at least some alpha
CPU's, so you can't just do a random access to PCI address X, you need
to have a real size etc.

But if you can point to a particular commit that broke something (eg
with bisection), I'll certainly take a second look. I might have
missed something.

               Linus