linux-kernel - [PATCH] mm/gup: check page posion status for coredump.

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20210317163714.328a038d@alex-virtual-machine>
Date:   Wed, 17 Mar 2021 16:37:14 +0800
From:   Aili Yao <yaoaili@...gsoft.com>
To:     <akpm@...ux-foundation.org>, <naoya.horiguchi@....com>
CC:     <yaoaili@...gsoft.com>, <linux-mm@...ck.org>,
        <linux-kernel@...r.kernel.org>, <yangfeng1@...gsoft.com>,
        <sunhao2@...gsoft.com>, <yaoaili@...gsoft.com>
Subject: [PATCH] mm/gup: check page posion status for coredump.

When we do coredump for user process signal, this may be an SIGBUS signal
with BUS_MCEERR_AR or BUS_MCEERR_AO code, which means this signal is
resulted from ECC memory fail like SRAR or SRAO, we expect the memory
recovery work is finished correctly, then the get_dump_page() will not
return the error page as its process pte is set invalid by
memory_failure().

But memory_failure() may fail, and the process's related pte may not be
correctly set invalid, for current code, we will return the poison page
and get it dumped and lead to system panic as its in kernel code.

So check the poison status in get_dump_page(), and if TRUE, return NULL.

Signed-off-by: Aili Yao <yaoaili@...gsoft.com>
---
 mm/gup.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/mm/gup.c b/mm/gup.c
index e4c224c..499a496 100644
--- a/mm/gup.c
+++ b/mm/gup.c
@@ -1536,6 +1536,14 @@ struct page *get_dump_page(unsigned long addr)
 				      FOLL_FORCE | FOLL_DUMP | FOLL_GET);
 	if (locked)
 		mmap_read_unlock(mm);
+
+	if (IS_ENABLED(CONFIG_MEMORY_FAILURE) && ret == 1) {
+		if (unlikely(PageHuge(page) && PageHWPoison(compound_head(page))))
+			ret = 0;
+		else if (unlikely(PageHWPoison(page)))
+			ret = 0;
+	}
+
 	return (ret == 1) ? page : NULL;
 }
 #endif /* CONFIG_ELF_CORE */
-- 
1.8.3.1