netdev - Re: [PATCH v2 06/35] nds32: MMU fault handling and page table management

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAEbi=3d8roTJHjsea3Up3uB+fu0fOmMcS7Dh=5-bV1GW4Y4e8Q@mail.gmail.com>
Date:   Wed, 29 Nov 2017 15:24:16 +0800
From:   Greentime Hu <green.hu@...il.com>
To:     Mark Rutland <mark.rutland@....com>
Cc:     Greentime <greentime@...estech.com>,
        Linux Kernel Mailing List <linux-kernel@...r.kernel.org>,
        Arnd Bergmann <arnd@...db.de>,
        linux-arch <linux-arch@...r.kernel.org>,
        Thomas Gleixner <tglx@...utronix.de>,
        Jason Cooper <jason@...edaemon.net>,
        Marc Zyngier <marc.zyngier@....com>,
        Rob Herring <robh+dt@...nel.org>,
        netdev <netdev@...r.kernel.org>,
        Vincent Chen <deanbo422@...il.com>,
        DTML <devicetree@...r.kernel.org>,
        Al Viro <viro@...iv.linux.org.uk>,
        David Howells <dhowells@...hat.com>,
        Will Deacon <will.deacon@....com>,
        Daniel Lezcano <daniel.lezcano@...aro.org>,
        linux-serial@...r.kernel.org, Vincent Chen <vincentc@...estech.com>
Subject: Re: [PATCH v2 06/35] nds32: MMU fault handling and page table management

Hi, Mark:

2017-11-27 21:51 GMT+08:00 Mark Rutland <mark.rutland@....com>:
> Hi,
>
> On Mon, Nov 27, 2017 at 08:27:53PM +0800, Greentime Hu wrote:
>> +void do_page_fault(unsigned long entry, unsigned long addr,
>> +                unsigned int error_code, struct pt_regs *regs)
>> +{
>
>> +     /*
>> +      * As per x86, we may deadlock here. However, since the kernel only
>> +      * validly references user space from well defined areas of the code,
>> +      * we can bug out early if this is from code which shouldn't.
>> +      */
>> +     if (unlikely(!down_read_trylock(&mm->mmap_sem))) {
>> +             if (!user_mode(regs) &&
>> +                 !search_exception_tables(instruction_pointer(regs)))
>> +                     goto no_context;
>> +retry:
>> +             down_read(&mm->mmap_sem);
>> +     } else {
>> +             /*
>> +              * The above down_read_trylock() might have succeeded in which
>> +              * case, we'll have missed the might_sleep() from down_read().
>> +              */
>> +             might_sleep();
>> +             if (IS_ENABLED(CONFIG_DEBUG_VM)) {
>> +                     if (!user_mode(regs) &&
>> +                         !search_exception_tables(instruction_pointer(regs)))
>> +                             goto no_context;
>> +             }
>> +     }
>
>> +     fault = handle_mm_fault(vma, addr, flags);
>> +
>> +     /*
>> +      * If we need to retry but a fatal signal is pending, handle the
>> +      * signal first. We do not need to release the mmap_sem because it
>> +      * would already be released in __lock_page_or_retry in mm/filemap.c.
>> +      */
>> +     if ((fault & VM_FAULT_RETRY) && fatal_signal_pending(current))
>> +             return;
>
> I believe you can get stuck in a livelock here (with an unkillable
> task), if a uaccess primitive tries to access a region protected by a
> userfaultfd. Please see:
>
>   https://lkml.kernel.org/r/1499782590-31366-1-git-send-email-mark.rutland@arm.com
>
> ... for details and a test case.
>

Thanks for your teatcase and patch. It works.
I will apply it to the next version patch.