linux-kernel - Re: [PATCH v1 2/4] mm: Expose abnormal new_pte during move

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <263929f5-bde6-48fb-a162-298a9f83bf5b@huaweicloud.com>
Date: Fri, 30 May 2025 09:24:54 +0800
From: Pu Lehui <pulehui@...weicloud.com>
To: Andrew Morton <akpm@...ux-foundation.org>
Cc: mhiramat@...nel.org, oleg@...hat.com, peterz@...radead.org,
 Liam.Howlett@...cle.com, lorenzo.stoakes@...cle.com, vbabka@...e.cz,
 jannh@...gle.com, pfalcato@...e.de, linux-mm@...ck.org,
 linux-kernel@...r.kernel.org, stable@...r.kernel.org, pulehui@...wei.com
Subject: Re: [PATCH v1 2/4] mm: Expose abnormal new_pte during move_ptes



On 2025/5/30 3:19, Andrew Morton wrote:
> On Thu, 29 May 2025 15:56:48 +0000 Pu Lehui <pulehui@...weicloud.com> wrote:
> 
>> From: Pu Lehui <pulehui@...wei.com>
>>
>> When executing move_ptes, the new_pte must be NULL, otherwise it will be
>> overwritten by the old_pte, and cause the abnormal new_pte to be leaked.
>> In order to make this problem to be more explicit, let's add
>> WARN_ON_ONCE when new_pte is not NULL.
>>
>> ...
>>
>> --- a/mm/mremap.c
>> +++ b/mm/mremap.c
>> @@ -237,6 +237,8 @@ static int move_ptes(struct pagetable_move_control *pmc,
>>   
>>   	for (; old_addr < old_end; old_pte++, old_addr += PAGE_SIZE,
>>   				   new_pte++, new_addr += PAGE_SIZE) {
>> +		WARN_ON_ONCE(!pte_none(*new_pte));
>> +
>>   		if (pte_none(ptep_get(old_pte)))
>>   			continue;
>>   
> 
> We now have no expectation that this will trigger, yes?  It's a sanity

Hi Andrew,

This can sanitize abnormal new_pte. It is expected that uprobe would not 
come in later, but others, uncertain🤔? So it will be a good alert. And 
after patch 1 it will not trigger WARNING.

> check that patch [1/4] is working?  Perhaps VM_WARN_ON_ONCE() would be

Agree, should I respin one more?

> more appropriate.  And maybe even a comment:
> 
> 	/* temporary, remove this one day */
>