lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date:   Wed, 4 Sep 2019 19:19:47 +0900
From:   Tetsuo Handa <penguin-kernel@...ove.sakura.ne.jp>
To:     Greg Kroah-Hartman <gregkh@...uxfoundation.org>
Cc:     Arnd Bergmann <arnd@...db.de>, linux-kernel@...r.kernel.org,
        Linus Torvalds <torvalds@...ux-foundation.org>,
        syzbot <syzbot+8ab2d0f39fb79fe6ca40@...kaller.appspotmail.com>
Subject: Re: [PATCH v3] /dev/mem: Bail out upon SIGKILL.

Ping? Syzbot is still reporting this problem.

On 2019/08/26 22:44, Tetsuo Handa wrote:
> On 2019/08/26 22:29, Greg Kroah-Hartman wrote:
>> On Mon, Aug 26, 2019 at 10:13:25PM +0900, Tetsuo Handa wrote:
>>> syzbot found that a thread can stall for minutes inside read_mem() or
>>> write_mem() after that thread was killed by SIGKILL [1]. Reading from
>>> iomem areas of /dev/mem can be slow, depending on the hardware.
>>> While reading 2GB at one read() is legal, delaying termination of killed
>>> thread for minutes is bad. Thus, allow reading/writing /dev/mem and
>>> /dev/kmem to be preemptible and killable.
>>>
>>>   [ 1335.912419][T20577] read_mem: sz=4096 count=2134565632
>>>   [ 1335.943194][T20577] read_mem: sz=4096 count=2134561536
>>>   [ 1335.978280][T20577] read_mem: sz=4096 count=2134557440
>>>   [ 1336.011147][T20577] read_mem: sz=4096 count=2134553344
>>>   [ 1336.041897][T20577] read_mem: sz=4096 count=2134549248
>>>
>>> Theoretically, reading/writing /dev/mem and /dev/kmem can become
>>> "interruptible". But this patch chose "killable". Future patch will make
>>> them "interruptible" so that we can revert to "killable" if some program
>>> regressed.
>>>
>>> [1] https://syzkaller.appspot.com/bug?id=a0e3436829698d5824231251fad9d8e998f94f5e
>>>
>>> Signed-off-by: Tetsuo Handa <penguin-kernel@...ove.SAKURA.ne.jp>
>>> Reported-by: syzbot <syzbot+8ab2d0f39fb79fe6ca40@...kaller.appspotmail.com>
>>> ---
>>>  drivers/char/mem.c | 21 +++++++++++++++++++++
>>>  1 file changed, 21 insertions(+)
>>
>> What changed from previous versions?
>>
>> That goes below the --- line at the very least.
> 
> (1) Moved fatal_signal_pending() test to end of iteration.
> (2) Added need_resched() test before cond_resched().
> (3) Removed -EINTR assignment because end of iteration means
>     that at least one byte was processed (sz > 0).
> 
>>
>> thanks,
>>
>> greg k-h
>>
> 

Powered by blists - more mailing lists

Powered by Openwall GNU/*/Linux Powered by OpenVZ