linux-kernel - Re: [PATCH 1/1] mm/vmalloc: Make vmalloc_32_user() align base kernel virtual address to SHMLBA

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Wed, 09 Jan 2019 11:08:32 +0100
From:   Roman Penyaev <rpenyaev@...e.de>
To:     Andrew Morton <akpm@...ux-foundation.org>
Cc:     Stephen Rothwell <sfr@...b.auug.org.au>,
        Michal Hocko <mhocko@...e.com>,
        "David S . Miller" <davem@...emloft.net>,
        Peter Zijlstra <peterz@...radead.org>, linux-mm@...ck.org,
        linux-kernel@...r.kernel.org
Subject: Re: [PATCH 1/1] mm/vmalloc: Make vmalloc_32_user() align base kernel
 virtual address to SHMLBA

On 2019-01-08 20:36, Andrew Morton wrote:
> On Tue,  8 Jan 2019 12:09:44 +0100 Roman Penyaev <rpenyaev@...e.de> 
> wrote:
> 
>> This patch repeats the original one from David S. Miller:
>> 
>>   2dca6999eed5 ("mm, perf_event: Make vmalloc_user() align base kernel 
>> virtual address to SHMLBA")
>> 
>> but for missed vmalloc_32_user() case, which also requires correct
>> alignment of virtual address on kernel side to avoid D-caches
>> aliases.  A bit of copy-paste from original patch to recover in
>> memory of what is all about:
>> 
>>   When a vmalloc'd area is mmap'd into userspace, some kind of
>>   co-ordination is necessary for this to work on platforms with cpu
>>   D-caches which can have aliases.
>> 
>>   Otherwise kernel side writes won't be seen properly in userspace
>>   and vice versa.
>> 
>>   If the kernel side mapping and the user side one have the same
>>   alignment, modulo SHMLBA, this can work as long as VM_SHARED is
>>   shared of VMA and for all current users this is true.  VM_SHARED
>>   will force SHMLBA alignment of the user side mmap on platforms with
>>   D-cache aliasing matters.
> 
> What are the user-visible runtime effects of this change?

In simple words: proper alignment avoids possible difference in data,
seen by different virtual mapings: userspace and kernel in our case.
I.e. userspace reads cache line A, kernel writes to cache line B.
Both cache lines correspond to the same physical memory (thus aliases).

So this should fix data corruption for archs with vivt and vipt caches,
e.g. armv6.  Personally I've never worked with this archs, I just 
spotted
the strange difference in code: for one case we do alignment, for 
another
- not.  I have a strong feeling that David simply missed 
vmalloc_32_user()
case.

> 
> Is a -stable backport needed?

No, I do not think so.  The only one user of vmalloc_32_user() is 
virtual
frame buffer device drivers/video/fbdev/vfb.c, which has in the 
description
"The main use of this frame buffer device is testing and debugging the 
frame
buffer subsystem. Do NOT enable it for normal systems!".

And it seems to me that this vfb.c does not need 32bit addressable pages
(vmalloc_32_user() case), because it is virtual device and should not 
care
about things like dma32 zones, etc.  Probably is better to clean the 
code
and switch vfb.c from vmalloc_32_user() to vmalloc_user() case and wipe 
out
vmalloc_32_user() from vmalloc.c completely.  But I'm not very much sure
that this is worth to do, that's so minor, so we can leave it as is.

--
Roman