lkml.org 
[lkml]   [2016]   [Feb]   [9]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: [PATCH] x86/mm/vmfault: Make vmalloc_fault() handle large pages

* Henning Schild <henning.schild@siemens.com> wrote:

> On Tue, 9 Feb 2016 10:10:03 +0100
> Ingo Molnar <mingo@kernel.org> wrote:
>
> > * Toshi Kani <toshi.kani@hpe.com> wrote:
> >
> > > Since 4.1, ioremap() supports large page (pud/pmd) mappings in
> > > x86_64 and PAE. vmalloc_fault() however assumes that the vmalloc
> > > range is limited to pte mappings.
> > >
> > > pgd_ctor() sets the kernel's pgd entries to user's during fork(),
> > > which makes user processes share the same page tables for the
> > > kernel ranges. When a call to ioremap() is made at run-time that
> > > leads to allocate a new 2nd level table (pud in 64-bit and pmd in
> > > PAE), user process needs to re-sync with the updated kernel pgd
> > > entry with vmalloc_fault().
> > >
> > > Following changes are made to vmalloc_fault().
> >
> > So what were the effects of this shortcoming? Were large page
> > ioremap()s unusable? Was this harmless because no driver used this
> > facility?
>
> Drivers do use huge ioremap()s. Now if a pre-existing mm is used to
> access the device memory a #PF and the call to vmalloc_fault would
> eventually make the kernel treat device memory as if it was a
> pagetable.
> The results are illegal reads/writes on iomem and dereferencing iomem
> content like it was a pointer to a lower level pagetable.
> - #PF if you are lucky
> - funny modification of arbitrary memory possible
> - can be abused with uio or regular userland ??

Ok, so this is a serious live bug exposed to drivers, that also requires a
Cc: stable tag.

All of this should have been in the changelog!

Thanks,

Ingo

\
 
 \ /
  Last update: 2016-02-09 11:41    [W:0.094 / U:0.140 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site