From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1757224AbcBIM1d (ORCPT ); Tue, 9 Feb 2016 07:27:33 -0500 Received: from david.siemens.de ([192.35.17.14]:51408 "EHLO david.siemens.de" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1756882AbcBIM13 (ORCPT ); Tue, 9 Feb 2016 07:27:29 -0500 Date: Tue, 9 Feb 2016 13:26:45 +0100 From: Henning Schild To: Ingo Molnar Cc: Toshi Kani , , , , , , , Subject: Re: [PATCH] x86/mm/vmfault: Make vmalloc_fault() handle large pages Message-ID: <20160209132645.55971eff@md1em3qc> In-Reply-To: <20160209102235.GA9885@gmail.com> References: <1454976038-22486-1-git-send-email-toshi.kani@hpe.com> <20160209091003.GA10774@gmail.com> <20160209105325.0ce9a104@md1em3qc> <20160209102235.GA9885@gmail.com> X-Mailer: Claws Mail 3.13.1 (GTK+ 2.24.28; x86_64-pc-linux-gnu) MIME-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Tue, 9 Feb 2016 11:22:35 +0100 Ingo Molnar wrote: > * Henning Schild wrote: > > > On Tue, 9 Feb 2016 10:10:03 +0100 > > Ingo Molnar wrote: > > > > > * Toshi Kani wrote: > > > > > > > Since 4.1, ioremap() supports large page (pud/pmd) mappings in > > > > x86_64 and PAE. vmalloc_fault() however assumes that the vmalloc > > > > range is limited to pte mappings. > > > > > > > > pgd_ctor() sets the kernel's pgd entries to user's during > > > > fork(), which makes user processes share the same page tables > > > > for the kernel ranges. When a call to ioremap() is made at > > > > run-time that leads to allocate a new 2nd level table (pud in > > > > 64-bit and pmd in PAE), user process needs to re-sync with the > > > > updated kernel pgd entry with vmalloc_fault(). > > > > > > > > Following changes are made to vmalloc_fault(). > > > > > > So what were the effects of this shortcoming? Were large page > > > ioremap()s unusable? Was this harmless because no driver used this > > > facility? > > > > Drivers do use huge ioremap()s. Now if a pre-existing mm is used to > > access the device memory a #PF and the call to vmalloc_fault would > > eventually make the kernel treat device memory as if it was a > > pagetable. > > The results are illegal reads/writes on iomem and dereferencing > > iomem content like it was a pointer to a lower level pagetable. > > - #PF if you are lucky > > - funny modification of arbitrary memory possible > > - can be abused with uio or regular userland ?? Looking over the code again i am not sure the last two are even possible, it is just the pointer deref that can cause a #PF. If the pointer turns out to "work" the code will just read and eventually BUG(). > Ok, so this is a serious live bug exposed to drivers, that also > requires a Cc: stable tag. > > All of this should have been in the changelog! > > Thanks, > > Ingo