Thread (57 messages) 57 messages, 11 authors, 2016-07-23

Re: [kernel-hardening] [PATCH v5 03/32] x86/cpa: In populate_pgd, don't set the pgd entry until it's populated

From: Andy Lutomirski <luto@amacapital.net>
Date: 2016-07-22 18:31:37
Also in: lkml

On Fri, Jul 22, 2016 at 11:21 AM, Andy Lutomirski [off-list ref] wrote:
On Fri, Jul 22, 2016 at 3:21 AM, Ingo Molnar [off-list ref] wrote:
quoted
* Andy Lutomirski [off-list ref] wrote:
quoted
On 07/21/2016 09:43 PM, Valdis.Kletnieks@vt.edu wrote:
quoted
On Mon, 11 Jul 2016 13:53:36 -0700, Andy Lutomirski said:
quoted
This avoids pointless races in which another CPU or task might see a
partially populated global pgd entry.  These races should normally
be harmless, but, if another CPU propagates the entry via
vmalloc_fault and then populate_pgd fails (due to memory allocation
failure, for example), this prevents a use-after-free of the pgd
entry.

Signed-off-by: Andy Lutomirski <luto@kernel.org>
---
arch/x86/mm/pageattr.c | 9 ++++++---
1 file changed, 6 insertions(+), 3 deletions(-)
I just bisected a failure to boot down to this patch.  On my Dell Latitude
laptop, it results in the kernel being loaded and then just basically sitting
there dead in the water - as far as I can tell, it dies before the kernel
ever gets going far enough to do any console I/O (even with ignore_loglevel).
Nothing in /sys/fs/pstore either.  I admit not understanding the VM code
at all, so I don't have a clue *why* this causes indigestion...

CPU is an Intel Core i5-3340M in case that matters....
How much memory do you have and what's your config?  My code is obviously
buggy, but I'm wondering why neither I nor the 0day bot caught this.

The attached patch is compile-tested only.  (Even Thunderbird doesn't want
to send non-flowed text right now, sigh.)

--Andy
quoted
From 6589ddf69a1369e1ecb95f0af489d90b980e256e Mon Sep 17 00:00:00 2001
Message-Id: [off-list ref]
From: Andy Lutomirski <luto@kernel.org>
Date: Thu, 21 Jul 2016 22:22:02 -0700
Subject: [PATCH] x86/mm: Fix populate_pgd()

I make an obvious error in populate_pgd() -- it would fail to correctly
populate the page tables when it allocated a new pud page.
JFYI, on allnoconfig it gives:

  arch/x86/mm/pageattr.c:1016:20: error: implicit declaration of function ‘pud_index’ [-Werror=implicit-function-declaration]
As it happens, my fix interacts badly with the steaming pile of crap
that is Linux's support for <4 page table levels.  Can you just revert
the offending patch and I'll redo it differently?
No, don't revert it.  The result doesn't work.  I'll send something.
Keyboard shortcuts
hback out one level
jnext message in thread
kprevious message in thread
ldrill in
Escclose help / fold thread tree
?toggle this help