On Tue, 9 Feb 2016 11:22:35 +0100 Ingo Molnar <mingo@xxxxxxxxxx> wrote: > * Henning Schild <henning.schild@xxxxxxxxxxx> wrote: > > > On Tue, 9 Feb 2016 10:10:03 +0100 > > Ingo Molnar <mingo@xxxxxxxxxx> wrote: > > > > > * Toshi Kani <toshi.kani@xxxxxxx> wrote: > > > > > > > Since 4.1, ioremap() supports large page (pud/pmd) mappings in > > > > x86_64 and PAE. vmalloc_fault() however assumes that the vmalloc > > > > range is limited to pte mappings. > > > > > > > > pgd_ctor() sets the kernel's pgd entries to user's during > > > > fork(), which makes user processes share the same page tables > > > > for the kernel ranges. When a call to ioremap() is made at > > > > run-time that leads to allocate a new 2nd level table (pud in > > > > 64-bit and pmd in PAE), user process needs to re-sync with the > > > > updated kernel pgd entry with vmalloc_fault(). > > > > > > > > Following changes are made to vmalloc_fault(). > > > > > > So what were the effects of this shortcoming? Were large page > > > ioremap()s unusable? Was this harmless because no driver used this > > > facility? > > > > Drivers do use huge ioremap()s. Now if a pre-existing mm is used to > > access the device memory a #PF and the call to vmalloc_fault would > > eventually make the kernel treat device memory as if it was a > > pagetable. > > The results are illegal reads/writes on iomem and dereferencing > > iomem content like it was a pointer to a lower level pagetable. > > - #PF if you are lucky > > - funny modification of arbitrary memory possible > > - can be abused with uio or regular userland ?? Looking over the code again i am not sure the last two are even possible, it is just the pointer deref that can cause a #PF. If the pointer turns out to "work" the code will just read and eventually BUG(). > Ok, so this is a serious live bug exposed to drivers, that also > requires a Cc: stable tag. > > All of this should have been in the changelog! > > Thanks, > > Ingo -- To unsubscribe, send a message with 'unsubscribe linux-mm' in the body to majordomo@xxxxxxxxx. For more info on Linux MM, see: http://www.linux-mm.org/ . Don't email: <a href=mailto:"dont@xxxxxxxxx";> email@xxxxxxxxx </a>