linux-kernel - Re: [PATCH] mm: migrate: add missing flush_dcache

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <65ed6463-b61f-81ff-4fcc-27f4071a28da@suse.cz>
Date:   Mon, 25 Feb 2019 16:07:37 +0100
From:   Vlastimil Babka <vbabka@...e.cz>
To:     Lars Persson <lars.persson@...s.com>, linux-mm@...ck.org,
        linux-kernel@...r.kernel.org
Cc:     linux-mips@...r.kernel.org, Lars Persson <larper@...s.com>
Subject: Re: [PATCH] mm: migrate: add missing flush_dcache_page for non-mapped
 page migrate

On 2/19/19 1:32 PM, Lars Persson wrote:
> Our MIPS 1004Kc SoCs were seeing random userspace crashes with SIGILL
> and SIGSEGV that could not be traced back to a userspace code
> bug. They had all the magic signs of an I/D cache coherency issue.
> 
> Now recently we noticed that the /proc/sys/vm/compact_memory interface
> was quite efficient at provoking this class of userspace crashes.
> 
> Studying the code in mm/migrate.c there is a distinction made between
> migrating a page that is mapped at the instant of migration and one
> that is not mapped. Our problem turned out to be the non-mapped pages.
> 
> For the non-mapped page the code performs a copy of the page content
> and all relevant meta-data of the page without doing the required
> D-cache maintenance. This leaves dirty data in the D-cache of the CPU
> and on the 1004K cores this data is not visible to the I-cache. A
> subsequent page-fault that triggers a mapping of the page will happily
> serve the process with potentially stale code.
> 
> What about ARM then, this bug should have seen greater exposure? Well
> ARM became immune to this flaw back in 2010, see commit c01778001a4f
> ("ARM: 6379/1: Assume new page cache pages have dirty D-cache").
> 
> My proposed fix moves the D-cache maintenance inside move_to_new_page
> to make it common for both cases.
> 
> Signed-off-by: Lars Persson <larper@...s.com>

What about CC stable and a Fixes tag, would it be applicable here?

> ---
>  mm/migrate.c | 11 ++++++++---
>  1 file changed, 8 insertions(+), 3 deletions(-)
> 
> diff --git a/mm/migrate.c b/mm/migrate.c
> index d4fd680be3b0..80fc19e610b5 100644
> --- a/mm/migrate.c
> +++ b/mm/migrate.c
> @@ -248,10 +248,8 @@ static bool remove_migration_pte(struct page *page, struct vm_area_struct *vma,
>  				pte = swp_entry_to_pte(entry);
>  			} else if (is_device_public_page(new)) {
>  				pte = pte_mkdevmap(pte);
> -				flush_dcache_page(new);
>  			}
> -		} else
> -			flush_dcache_page(new);
> +		}
>  
>  #ifdef CONFIG_HUGETLB_PAGE
>  		if (PageHuge(new)) {
> @@ -995,6 +993,13 @@ static int move_to_new_page(struct page *newpage, struct page *page,
>  		 */
>  		if (!PageMappingFlags(page))
>  			page->mapping = NULL;
> +
> +		if (unlikely(is_zone_device_page(newpage))) {
> +			if (is_device_public_page(newpage))
> +				flush_dcache_page(newpage);
> +		} else
> +			flush_dcache_page(newpage);
> +
>  	}
>  out:
>  	return rc;
>