linux-kernel - Re: [PATCH 2/4] mm/hwpoison: fix potential pte_unmap

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20210817072900.GA452155@hori.linux.bs1.fc.nec.co.jp>
Date:   Tue, 17 Aug 2021 07:29:00 +0000
From:   HORIGUCHI NAOYA(堀口　直也) 
        <naoya.horiguchi@....com>
To:     Miaohe Lin <linmiaohe@...wei.com>
CC:     "akpm@...ux-foundation.org" <akpm@...ux-foundation.org>,
        "sfr@...b.auug.org.au" <sfr@...b.auug.org.au>,
        "linux-mm@...ck.org" <linux-mm@...ck.org>,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH 2/4] mm/hwpoison: fix potential pte_unmap_unlock pte error

On Sat, Aug 14, 2021 at 06:51:29PM +0800, Miaohe Lin wrote:
> If the first pte is equal to poisoned_pfn, i.e. check_hwpoisoned_entry()
> return 1, the wrong ptep - 1 would be passed to pte_unmap_unlock().
> 
> Fixes: ad9c59c24095 ("mm,hwpoison: send SIGBUS with error virutal address")
> Signed-off-by: Miaohe Lin <linmiaohe@...wei.com>

I agree with the change itself, so

Acked-by: Naoya Horiguchi <naoya.horiguchi@....com>

One question is that according to "grep -r pte_unmap_unlock ." command over
whole kernel source code, pte_unmap_unlock() is called with "ptep - 1" in some places.
I think that none of them seems to have "break in for loop" in locked period,
so the same problem does not occur there.  But I'm still not sure why some place
call with "ptep - 1" and the others call with pte returned by pte_offset_map_lock().