linux-kernel - Re: Kernel page fault in vmalloc_fault() after a preempted ioremap

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <1520553209.2693.110.camel@hpe.com>
Date:   Thu, 8 Mar 2018 23:08:34 +0000
From:   "Kani, Toshi" <toshi.kani@....com>
To:     "luto@...nel.org" <luto@...nel.org>
CC:     "mingo@...nel.org" <mingo@...nel.org>,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
        "peterz@...radead.org" <peterz@...radead.org>,
        "julia.cartwright@...com" <julia.cartwright@...com>,
        "torvalds@...ux-foundation.org" <torvalds@...ux-foundation.org>,
        "linux-mm@...ck.org" <linux-mm@...ck.org>,
        "tglx@...utronix.de" <tglx@...utronix.de>,
        "bp@...e.de" <bp@...e.de>,
        "gratian.crisan@...com" <gratian.crisan@...com>,
        "akpm@...ux-foundation.org" <akpm@...ux-foundation.org>,
        "hpa@...or.com" <hpa@...or.com>,
        "brgerst@...il.com" <brgerst@...il.com>,
        "dave.hansen@...el.com" <dave.hansen@...el.com>,
        "dvlasenk@...hat.com" <dvlasenk@...hat.com>,
        "gratian@...il.com" <gratian@...il.com>
Subject: Re: Kernel page fault in vmalloc_fault() after a preempted ioremap

On Thu, 2018-03-08 at 22:38 +0000, Andy Lutomirski wrote:
> On Thu, Mar 8, 2018 at 9:43 PM, Kani, Toshi <toshi.kani@....com> wrote:
> > On Thu, 2018-03-08 at 14:34 -0600, Gratian Crisan wrote:
 :
> > 
> > Thanks for the report and analysis!  I believe pud_large() and
> > pmd_large() should have been used here.  I will try to reproduce the
> > issue and verify the fix.
> 
> Indeed.  I find myself wondering why pud_huge() exists at all.
> 
> While you're at it, I think there may be more bugs in there.
> Specifically, the code walks the reference and current tables at the
> same time without any synchronization and without READ_ONCE()
> protection.  I think that all of the BUG() calls below the comment:
> 
>         /*
>          * Below here mismatches are bugs because these lower tables
>          * are shared:
>          */
> 
> are bogus and could be hit due to races.  I also think they're
> pointless -- we've already asserted that the reference and loaded
> tables are literally the same pointers.  I think the right fix is to
> remove pud_ref, pmd_ref and pte_ref entirely and to get rid of those
> BUG() calls.
> 
> What do you think?

I agree that these BUG() checks are pointless.  I will remove them in
this opportunity.

Thanks,
-Toshi