Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1440878 > unrolled thread

[PATCH v5 13/32] x86/mm/64: In vmalloc_fault(), use CR3 instead of current->active_mm

Back to article view | Back to linux.kernel

This discussion starts older than the indexed window; earlier articles aren't shown. The article labeled Started by below is the oldest one visible, not the original post.

Contents

  [PATCH v5 13/32] x86/mm/64: In vmalloc_fault(), use CR3 instead of current->active_mm Andy Lutomirski <luto@kernel.org> - 2016-07-11 23:00 +0200
    Re: [kernel-hardening] [PATCH v5 13/32] x86/mm/64: In  vmalloc_fault(), use CR3 instead of current->active_mm Dave Hansen <dave.hansen@intel.com> - 2016-07-12 20:00 +0200
      Re: [kernel-hardening] [PATCH v5 13/32] x86/mm/64: In  vmalloc_fault(), use CR3 instead of current->active_mm Andy Lutomirski <luto@amacapital.net> - 2016-07-12 20:10 +0200

#1440878 — [PATCH v5 13/32] x86/mm/64: In vmalloc_fault(), use CR3 instead of current->active_mm

If we get a vmalloc fault while current->active_mm->pgd doesn't
match CR3, we'll crash without this change.  I've seen this failure
mode on heavily instrumented kernels with virtually mapped stacks.

Signed-off-by: Andy Lutomirski <luto@kernel.org>
---
 arch/x86/mm/fault.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/x86/mm/fault.c b/arch/x86/mm/fault.c
index 7d1fa7cd2374..ca44e2e7fd00 100644
--- a/arch/x86/mm/fault.c
+++ b/arch/x86/mm/fault.c
@@ -439,7 +439,7 @@ static noinline int vmalloc_fault(unsigned long address)
 	 * happen within a race in page table update. In the later
 	 * case just flush:
 	 */
-	pgd = pgd_offset(current->active_mm, address);
+	pgd = (pgd_t *)__va(read_cr3()) + pgd_index(address);
 	pgd_ref = pgd_offset_k(address);
 	if (pgd_none(*pgd_ref))
 		return -1;
-- 
2.7.4

[toc] | [next] | [standalone]

#1441629 — Re: [kernel-hardening] [PATCH v5 13/32] x86/mm/64: In vmalloc_fault(), use CR3 instead of current->active_mm

On 07/11/2016 01:53 PM, Andy Lutomirski wrote:
> If we get a vmalloc fault while current->active_mm->pgd doesn't
> match CR3, we'll crash without this change.  I've seen this failure
> mode on heavily instrumented kernels with virtually mapped stacks.

When does this happen, btw?  Crossing page boundaries on the stack
between the time we swap mm's and the time we switch stacks?

[toc] | [prev] | [next] | [standalone]

#1441631 — Re: [kernel-hardening] [PATCH v5 13/32] x86/mm/64: In vmalloc_fault(), use CR3 instead of current->active_mm

On Tue, Jul 12, 2016 at 10:51 AM, Dave Hansen <dave.hansen@intel.com> wrote:
> On 07/11/2016 01:53 PM, Andy Lutomirski wrote:
>> If we get a vmalloc fault while current->active_mm->pgd doesn't
>> match CR3, we'll crash without this change.  I've seen this failure
>> mode on heavily instrumented kernels with virtually mapped stacks.
>
> When does this happen, btw?  Crossing page boundaries on the stack
> between the time we swap mm's and the time we switch stacks?

This can happen for any vmalloc fault between the mm swap and writing
to current or current->active_mm.  I hit it when playing with KASAN
during the first clone.  (KASAN has other issues, but this was one of
them AFAICT.)

--Andy

[toc] | [prev] | [standalone]

Back to top | Article view | linux.kernel

csiph-web