[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <ZrTXXJ8r_WpPgcU4@x1n>
Date: Thu, 8 Aug 2024 10:34:04 -0400
From: Peter Xu <peterx@...hat.com>
To: Andrew Morton <akpm@...ux-foundation.org>
Cc: linux-kernel@...r.kernel.org, linux-mm@...ck.org,
"Aneesh Kumar K . V" <aneesh.kumar@...ux.ibm.com>,
Michael Ellerman <mpe@...erman.id.au>,
Oscar Salvador <osalvador@...e.de>,
Dan Williams <dan.j.williams@...el.com>,
James Houghton <jthoughton@...gle.com>,
Matthew Wilcox <willy@...radead.org>,
Nicholas Piggin <npiggin@...il.com>,
Rik van Riel <riel@...riel.com>, Dave Jiang <dave.jiang@...el.com>,
x86@...nel.org, Ingo Molnar <mingo@...hat.com>,
Rick P Edgecombe <rick.p.edgecombe@...el.com>,
"Kirill A . Shutemov" <kirill@...temov.name>,
linuxppc-dev@...ts.ozlabs.org,
Mel Gorman <mgorman@...hsingularity.net>,
Hugh Dickins <hughd@...gle.com>, Borislav Petkov <bp@...en8.de>,
David Hildenbrand <david@...hat.com>,
Thomas Gleixner <tglx@...utronix.de>,
Vlastimil Babka <vbabka@...e.cz>,
Dave Hansen <dave.hansen@...ux.intel.com>,
Christophe Leroy <christophe.leroy@...roup.eu>,
Huang Ying <ying.huang@...el.com>
Subject: Re: [PATCH v4 0/7] mm/mprotect: Fix dax puds
On Wed, Aug 07, 2024 at 02:44:54PM -0700, Andrew Morton wrote:
> On Wed, 7 Aug 2024 17:34:10 -0400 Peter Xu <peterx@...hat.com> wrote:
>
> > The problem is mprotect() will skip the dax 1G PUD while it shouldn't;
> > meanwhile it'll dump some bad PUD in dmesg. Both of them look like (corner
> > case) bugs to me.. where:
> >
> > - skipping the 1G pud means mprotect() will succeed even if the pud won't
> > be updated with the correct permission specified. Logically that can
> > cause e.g. in mprotect(RO) then write the page can cause data corrupt,
> > as the pud page will still be writable.
> >
> > - the bad pud will generate a pr_err() into dmesg, with no limit so far I
> > can see. So I think it means an userspace can DoS the kernel log if it
> > wants.. simply by creating the PUD and keep mprotect-ing it
> >
>
> I edited this important info into the [0/n] text, thanks.
>
> So current kernels can be made to spew into the kernel logs? That's
I suppose yes to this one.
> considered serious. Can unprivileged userspace code do this?
AFAIU, /dev/dax* require root privilege by default, so looks not. But
anyone more familiar with real life dax usages please correct me otherwise.
Thanks,
--
Peter Xu
Powered by blists - more mailing lists