linux-kernel - Re: [RFC] dev/mem: "memtester -p 0x6c80000000000 10G" cause crash

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20170502091630.GH14593@dhcp22.suse.cz>
Date:   Tue, 2 May 2017 11:16:31 +0200
From:   Michal Hocko <mhocko@...nel.org>
To:     Xishi Qiu <qiuxishi@...wei.com>
Cc:     Andrew Morton <akpm@...ux-foundation.org>,
        Mel Gorman <mgorman@...e.de>, Vlastimil Babka <vbabka@...e.cz>,
        Joonsoo Kim <js1304@...il.com>,
        Johannes Weiner <hannes@...xchg.org>,
        Rik van Riel <riel@...hat.com>,
        Shakeel Butt <shakeelb@...gle.com>,
        Linux MM <linux-mm@...ck.org>,
        LKML <linux-kernel@...r.kernel.org>,
        zhong jiang <zhongjiang@...wei.com>
Subject: Re: [RFC] dev/mem: "memtester -p 0x6c80000000000 10G" cause crash

On Tue 02-05-17 16:52:00, Xishi Qiu wrote:
> On 2017/5/2 16:43, Michal Hocko wrote:
> 
> > On Tue 02-05-17 15:59:23, Xishi Qiu wrote:
> >> Hi, I use "memtester -p 0x6c80000000000 10G" to test physical address 0x6c80000000000
> >> Because this physical address is invalid, and valid_mmap_phys_addr_range()
> >> always return 1, so it causes crash.
> >>
> >> My question is that should the user assure the physical address is valid?
> > 
> > We already seem to be checking range_is_allowed(). What is your
> > CONFIG_STRICT_DEVMEM setting? The code seems to be rather confusing but
> > my assumption is that you better know what you are doing when mapping
> > this file.
> > 
> 
> HI Michal,
> 
> CONFIG_STRICT_DEVMEM=y, and range_is_allowed() will skip memory, but
> 0x6c80000000000 is not memory, it is just a invalid address, so it cause
> crash. 

OK, I only now looked at the value. It is beyond addressable limit
(for 47b address space). None of the checks seems to stop this because
range_is_allowed() resp. its devmem_is_allowed() will allow it as a
non RAM (!page_is_ram check). I am not really sure how to fix this or
whether even we should try to fix this particular problem. As I've said
/dev/mem is dangerous and you should better know what you are doing when
accessing it.

-- 
Michal Hocko
SUSE Labs