linux-kernel - Re: [PATCH v2 06/35] nds32: MMU fault handling and page table management

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20171127135136.3gnguzaf6d52tcpd@lakrids.cambridge.arm.com>
Date:   Mon, 27 Nov 2017 13:51:36 +0000
From:   Mark Rutland <mark.rutland@....com>
To:     Greentime Hu <green.hu@...il.com>
Cc:     greentime@...estech.com, linux-kernel@...r.kernel.org,
        arnd@...db.de, linux-arch@...r.kernel.org, tglx@...utronix.de,
        jason@...edaemon.net, marc.zyngier@....com, robh+dt@...nel.org,
        netdev@...r.kernel.org, deanbo422@...il.com,
        devicetree@...r.kernel.org, viro@...iv.linux.org.uk,
        dhowells@...hat.com, will.deacon@....com,
        daniel.lezcano@...aro.org, linux-serial@...r.kernel.org,
        Vincent Chen <vincentc@...estech.com>
Subject: Re: [PATCH v2 06/35] nds32: MMU fault handling and page table
 management

Hi,

On Mon, Nov 27, 2017 at 08:27:53PM +0800, Greentime Hu wrote:
> +void do_page_fault(unsigned long entry, unsigned long addr,
> +		   unsigned int error_code, struct pt_regs *regs)
> +{

> +	/*
> +	 * As per x86, we may deadlock here. However, since the kernel only
> +	 * validly references user space from well defined areas of the code,
> +	 * we can bug out early if this is from code which shouldn't.
> +	 */
> +	if (unlikely(!down_read_trylock(&mm->mmap_sem))) {
> +		if (!user_mode(regs) &&
> +		    !search_exception_tables(instruction_pointer(regs)))
> +			goto no_context;
> +retry:
> +		down_read(&mm->mmap_sem);
> +	} else {
> +		/*
> +		 * The above down_read_trylock() might have succeeded in which
> +		 * case, we'll have missed the might_sleep() from down_read().
> +		 */
> +		might_sleep();
> +		if (IS_ENABLED(CONFIG_DEBUG_VM)) {
> +			if (!user_mode(regs) &&
> +			    !search_exception_tables(instruction_pointer(regs)))
> +				goto no_context;
> +		}
> +	}

> +	fault = handle_mm_fault(vma, addr, flags);
> +
> +	/*
> +	 * If we need to retry but a fatal signal is pending, handle the
> +	 * signal first. We do not need to release the mmap_sem because it
> +	 * would already be released in __lock_page_or_retry in mm/filemap.c.
> +	 */
> +	if ((fault & VM_FAULT_RETRY) && fatal_signal_pending(current))
> +		return;

I believe you can get stuck in a livelock here (with an unkillable
task), if a uaccess primitive tries to access a region protected by a
userfaultfd. Please see:

  https://lkml.kernel.org/r/1499782590-31366-1-git-send-email-mark.rutland@arm.com

... for details and a test case.

Thanks,
Mark.