linux-kernel - Re: [PATCH] mm/hmm: fix uninitialized use of 'entry' in hmm_vma_walk

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Mon, 22 Jan 2018 16:56:40 -0500
From:   Jerome Glisse <jglisse@...hat.com>
To:     Andrew Morton <akpm@...ux-foundation.org>
Cc:     linux-mm@...ck.org, linux-kernel@...r.kernel.org,
        Ralph Campbell <rcampbell@...dia.com>
Subject: Re: [PATCH] mm/hmm: fix uninitialized use of 'entry' in
 hmm_vma_walk_pmd()

On Mon, Jan 22, 2018 at 12:58:36PM -0800, Andrew Morton wrote:
> On Mon, 22 Jan 2018 13:57:59 -0500 jglisse@...hat.com wrote:
> 
> > From: Ralph Campbell <rcampbell@...dia.com>
> > 
> > The variable 'entry' is used before being initialized in
> > hmm_vma_walk_pmd()
> > 
> > ...
> >
> > --- a/mm/hmm.c
> > +++ b/mm/hmm.c
> > @@ -418,7 +418,7 @@ static int hmm_vma_walk_pmd(pmd_t *pmdp,
> >  		}
> >  
> >  		if (!pte_present(pte)) {
> > -			swp_entry_t entry;
> > +			swp_entry_t entry = pte_to_swp_entry(pte);
> >  
> >  			if (!non_swap_entry(entry)) {
> >  				if (hmm_vma_walk->fault)
> > @@ -426,8 +426,6 @@ static int hmm_vma_walk_pmd(pmd_t *pmdp,
> >  				continue;
> >  			}
> >  
> > -			entry = pte_to_swp_entry(pte);
> > -
> >  			/*
> >  			 * This is a special swap entry, ignore migration, use
> >  			 * device and report anything else as error.
> 
> Gee, how did that sneak through.  gcc not clever enough...
> 
> I'll add a cc:stable to this, even though the changelog didn't tell us what
> the runtime effects of the bug are.  It should do so, so can you please
> send us that description and I will add it, thanks.
> 

No bad effect (beside performance hit) so !non_swap_entry(0) evaluate to
true which trigger a fault as if CPU was trying to access migrated memory
and migrate memory back from device memory to regular memory.

This function (hmm_vma_walk_pmd()) is call when device driver tries to
populate its own page table. For migrated memory it should not happen as
the device driver should already have populated its page table correctly
during the migration.

Only case i can think of is multi-GPU where a second GPU trigger migration
back to regular memory. Again this would just result in a performance hit,
nothing bad would happen.


(I will try to keep in mind to always add a more in depth analysis even
for small patch :))

Cheers,
Jérôme