linux-kernel - Re: [RFC PATCH v2 1/2] ARM/mm/fault: always goto bad_area when handling with page faults of kernel address

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20251129023323.11612-1-xieyuanbin1@huawei.com>
Date: Sat, 29 Nov 2025 10:33:23 +0800
From: Xie Yuanbin <xieyuanbin1@...wei.com>
To: <bigeasy@...utronix.de>
CC: <akpm@...ux-foundation.org>, <arnd@...db.de>, <brauner@...nel.org>,
	<david.laight@...box.com>, <hch@....de>, <jack@...e.com>,
	<kuninori.morimoto.gx@...esas.com>, <liaohua4@...wei.com>,
	<lilinjie8@...wei.com>, <linux-arm-kernel@...ts.infradead.org>,
	<linux-fsdevel@...r.kernel.org>, <linux-kernel@...r.kernel.org>,
	<linux-mm@...ck.org>, <linux@...linux.org.uk>, <lorenzo.stoakes@...cle.com>,
	<marc.zyngier@....com>, <nico@...xnic.net>, <pangliyuan1@...wei.com>,
	<pfalcato@...e.de>, <punitagrawal@...il.com>, <rjw@...ysocki.net>,
	<rmk+kernel@...linux.org.uk>, <rppt@...nel.org>, <tony@...mide.com>,
	<vbabka@...e.cz>, <viro@...iv.linux.org.uk>, <wangkefeng.wang@...wei.com>,
	<will@...nel.org>, <wozizhi@...weicloud.com>, <xieyuanbin1@...wei.com>
Subject: Re: [RFC PATCH v2 1/2] ARM/mm/fault: always goto bad_area when handling with page faults of kernel address

On Fri, 28 Nov 2025 13:03:59 +0100, Sebastian Andrzej Siewior wrote:
> what about this:
> diff --git a/arch/arm/mm/fault.c b/arch/arm/mm/fault.c
> index ad58c1e22a5f9..b6b3cd893c808 100644
> --- a/arch/arm/mm/fault.c
> +++ b/arch/arm/mm/fault.c
> @@ -282,10 +282,10 @@ do_page_fault(unsigned long addr, unsigned int fsr, struct pt_regs *regs)
>  	}
>
>  	/*
> -	 * If we're in an interrupt or have no user
> -	 * context, we must not take the fault..
> +	 * If we're in an interrupt or have no user context, we must not take
> +	 * the fault. Kernel addresses are handled in do_translation_fault().
> 	 */
> -	if (faulthandler_disabled() || !mm)
> +	if (faulthandler_disabled() || !mm || addr >= TASK_SIZE)
>  		goto no_context;
>
>  	if (user_mode(regs))
>
> We shouldn't be getting here. Above TASK_SIZE there are just fix
> mappings which don't fault and the VMALLOC array which should be handled
> by do_translation_fault(). So this should be only the exception table.
>
> This should also not clash with the previous patches. Would that work
> for everyone?

When it is user_mode(), it should be goto __do_user_fault(), but
no_context goto __do_kernel_fault(). So I think it is not ok.

> Sebastian

Xie Yuanbin