[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-Id: <20240402101023.aea0f8ed981903077dcd9e6b@linux-foundation.org>
Date: Tue, 2 Apr 2024 10:10:23 -0700
From: Andrew Morton <akpm@...ux-foundation.org>
To: Mike Rapoport <rppt@...ux.ibm.com>
Cc: Herbert Xu <herbert@...dor.apana.org.au>, xingwei lee
<xrivendell7@...il.com>, davem@...emloft.net, linux-crypto@...r.kernel.org,
linux-kernel@...r.kernel.org, syzkaller-bugs@...glegroups.com,
samsun1006219@...il.com, Linus Torvalds <torvalds@...ux-foundation.org>,
Eric Dumazet <edumazet@...gle.com>, Jakub Kicinski <kuba@...nel.org>,
netdev@...r.kernel.org
Subject: Re: BUG: unable to handle kernel paging request in
crypto_sha3_update
On Tue, 2 Apr 2024 18:09:21 +0300 Mike Rapoport <rppt@...ux.ibm.com> wrote:
> On Tue, Apr 02, 2024 at 04:36:11PM +0800, Herbert Xu wrote:
> > On Wed, Mar 20, 2024 at 10:57:53AM +0800, xingwei lee wrote:
> > >
> > > syscall(__NR_bind, /*fd=*/r[0], /*addr=*/0x20000000ul, /*addrlen=*/0x58ul);
> > > res = syscall(__NR_accept, /*fd=*/r[0], /*peer=*/0ul, /*peerlen=*/0ul);
> > > if (res != -1)
> > > r[1] = res;
> > > res = syscall(__NR_memfd_secret, /*flags=*/0ul);
> > > if (res != -1)
> > > r[2] = res;
> >
> > So this is the key to the issue. The whole point of memfd_secret is
> > to make the pages inaccessible to the kernel. The issue is those
> > pages are then gifted to the kernel through sendmsg. Somewhere
> > along the line someone is supposed to throw up an error about this,
> > or map the pages properly. I guess neither happened which is why
> > we end up with a page fault.
>
> Yeah, there was a bug in folio_is_secretmem() that should have throw an
> error about this.
>
> David Hildenbrand sent a fix, it's in Andrew's tree
>
> https://lore.kernel.org/all/20240326143210.291116-1-david@redhat.com
I'll send "mm/secretmem: fix GUP-fast succeeding on secretmem folios"
upstream this week.
Powered by blists - more mailing lists