Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1330185

Re: [PATCH] x86/mm/vmfault: Make vmalloc_fault() handle large pages

Show all headers | View raw

On Tue, 9 Feb 2016 11:22:35 +0100
Ingo Molnar <mingo@kernel.org> wrote:

> * Henning Schild <henning.schild@siemens.com> wrote:
> 
> > On Tue, 9 Feb 2016 10:10:03 +0100
> > Ingo Molnar <mingo@kernel.org> wrote:
> >   
> > > * Toshi Kani <toshi.kani@hpe.com> wrote:
> > >   
> > > > Since 4.1, ioremap() supports large page (pud/pmd) mappings in
> > > > x86_64 and PAE. vmalloc_fault() however assumes that the vmalloc
> > > > range is limited to pte mappings.
> > > > 
> > > > pgd_ctor() sets the kernel's pgd entries to user's during
> > > > fork(), which makes user processes share the same page tables
> > > > for the kernel ranges.  When a call to ioremap() is made at
> > > > run-time that leads to allocate a new 2nd level table (pud in
> > > > 64-bit and pmd in PAE), user process needs to re-sync with the
> > > > updated kernel pgd entry with vmalloc_fault().
> > > > 
> > > > Following changes are made to vmalloc_fault().    
> > > 
> > > So what were the effects of this shortcoming? Were large page
> > > ioremap()s unusable? Was this harmless because no driver used this
> > > facility?  
> > 
> > Drivers do use huge ioremap()s. Now if a pre-existing mm is used to
> > access the device memory a #PF and the call to vmalloc_fault would
> > eventually make the kernel treat device memory as if it was a
> > pagetable.
> > The results are illegal reads/writes on iomem and dereferencing
> > iomem content like it was a pointer to a lower level pagetable.
> > - #PF if you are lucky

> > - funny modification of arbitrary memory possible
> > - can be abused with uio or regular userland ??   

Looking over the code again i am not sure the last two are even
possible, it is just the pointer deref that can cause a #PF.
If the pointer turns out to "work" the code will just read and
eventually BUG().

> Ok, so this is a serious live bug exposed to drivers, that also
> requires a Cc: stable tag.
>
> All of this should have been in the changelog!
> 
> Thanks,
> 
> 	Ingo

Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

[PATCH] x86/mm/vmfault: Make vmalloc_fault() handle large pages Toshi Kani <toshi.kani@hpe.com> - 2016-02-09 00:10 +0100
  Re: [PATCH] x86/mm/vmfault: Make vmalloc_fault() handle large pages Ingo Molnar <mingo@kernel.org> - 2016-02-09 10:20 +0100
    Re: [PATCH] x86/mm/vmfault: Make vmalloc_fault() handle large pages Henning Schild <henning.schild@siemens.com> - 2016-02-09 11:20 +0100
      Re: [PATCH] x86/mm/vmfault: Make vmalloc_fault() handle large pages Ingo Molnar <mingo@kernel.org> - 2016-02-09 11:30 +0100
        Re: [PATCH] x86/mm/vmfault: Make vmalloc_fault() handle large pages Henning Schild <henning.schild@siemens.com> - 2016-02-09 13:30 +0100
          Re: [PATCH] x86/mm/vmfault: Make vmalloc_fault() handle large pages Toshi Kani <toshi.kani@hpe.com> - 2016-02-09 16:20 +0100
    Re: [PATCH] x86/mm/vmfault: Make vmalloc_fault() handle large pages Toshi Kani <toshi.kani@hpe.com> - 2016-02-09 16:20 +0100

csiph-web