From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1754866AbdKNMMr (ORCPT ); Tue, 14 Nov 2017 07:12:47 -0500 Received: from Galois.linutronix.de ([146.0.238.70]:37010 "EHLO Galois.linutronix.de" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752704AbdKNMMj (ORCPT ); Tue, 14 Nov 2017 07:12:39 -0500 Date: Tue, 14 Nov 2017 13:11:41 +0100 (CET) From: Thomas Gleixner To: "Kirill A. Shutemov" cc: "Kirill A. Shutemov" , Ingo Molnar , Linus Torvalds , x86@kernel.org, "H. Peter Anvin" , Andy Lutomirski , Cyrill Gorcunov , Nicholas Piggin , linux-mm@kvack.org, linux-kernel@vger.kernel.org Subject: Re: [PATCH] x86/mm: Do not allow non-MAP_FIXED mapping across DEFAULT_MAP_WINDOW border In-Reply-To: <20171114120520.u3cyxw42wqvvnnf6@node.shutemov.name> Message-ID: References: <20171107130539.52676-1-kirill.shutemov@linux.intel.com> <20171113164154.fp5fd2seozbmxcbs@node.shutemov.name> <20171113200657.pk56mxofg2t2xbi6@node.shutemov.name> <20171114120520.u3cyxw42wqvvnnf6@node.shutemov.name> User-Agent: Alpine 2.20 (DEB 67 2015-01-07) MIME-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Tue, 14 Nov 2017, Kirill A. Shutemov wrote: > On Mon, Nov 13, 2017 at 10:14:36PM +0100, Thomas Gleixner wrote: > > I can see where you are heading to. Now the case I was looking at is: > > > > arch_get_unmapped_area_topdown() > > > > addr0 = addr; > > > > .... > > if (addr) { > > if (cross_border(addr, len)) > > goto get_unmapped_area; > > ... > > } > > get_unmapped_area: > > ... > > if (addr > DEFAULT_MAP_WINDOW && !in_compat_syscall()) > > > > ^^^ evaluates to false because addr < DEFAULT_MAP_WINDOW > > > > addr - vm_unmapped_area(&info); > > > > ^^^ fails for whatever reason. > > > > bottomup: > > return arch_get_unmapped_area(.., addr0, len, ....); > > > > > > AFAICT arch_get_unmapped_area() can allocate a mapping which crosses the > > border, i.e. a mapping which you want to prevent for the !MAP_FIXED case. > > No, it can't as long as addr0 is below DEFAULT_MAP_WINDOW: > > arch_get_unmapped_area() > { > ... > find_start_end(addr, flags, &begin, &end); > // end is DEFAULT_MAP_WINDOW here, since addr is below the border Sigh, I missed that task_size_64bit() magic in find_start_end(). This is really convoluted and non intuitive. I'm so not looking forward to debug any failure in that context. Thanks, tglx From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail-wr0-f197.google.com (mail-wr0-f197.google.com [209.85.128.197]) by kanga.kvack.org (Postfix) with ESMTP id 586A16B0253 for ; Tue, 14 Nov 2017 07:12:39 -0500 (EST) Received: by mail-wr0-f197.google.com with SMTP id v105so10818800wrc.11 for ; Tue, 14 Nov 2017 04:12:39 -0800 (PST) Received: from Galois.linutronix.de (Galois.linutronix.de. [2a01:7a0:2:106d:700::1]) by mx.google.com with ESMTPS id i66si7384975wmd.14.2017.11.14.04.12.37 for (version=TLS1_2 cipher=AES128-SHA bits=128/128); Tue, 14 Nov 2017 04:12:38 -0800 (PST) Date: Tue, 14 Nov 2017 13:11:41 +0100 (CET) From: Thomas Gleixner Subject: Re: [PATCH] x86/mm: Do not allow non-MAP_FIXED mapping across DEFAULT_MAP_WINDOW border In-Reply-To: <20171114120520.u3cyxw42wqvvnnf6@node.shutemov.name> Message-ID: References: <20171107130539.52676-1-kirill.shutemov@linux.intel.com> <20171113164154.fp5fd2seozbmxcbs@node.shutemov.name> <20171113200657.pk56mxofg2t2xbi6@node.shutemov.name> <20171114120520.u3cyxw42wqvvnnf6@node.shutemov.name> MIME-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Sender: owner-linux-mm@kvack.org List-ID: To: "Kirill A. Shutemov" Cc: "Kirill A. Shutemov" , Ingo Molnar , Linus Torvalds , x86@kernel.org, "H. Peter Anvin" , Andy Lutomirski , Cyrill Gorcunov , Nicholas Piggin , linux-mm@kvack.org, linux-kernel@vger.kernel.org On Tue, 14 Nov 2017, Kirill A. Shutemov wrote: > On Mon, Nov 13, 2017 at 10:14:36PM +0100, Thomas Gleixner wrote: > > I can see where you are heading to. Now the case I was looking at is: > > > > arch_get_unmapped_area_topdown() > > > > addr0 = addr; > > > > .... > > if (addr) { > > if (cross_border(addr, len)) > > goto get_unmapped_area; > > ... > > } > > get_unmapped_area: > > ... > > if (addr > DEFAULT_MAP_WINDOW && !in_compat_syscall()) > > > > ^^^ evaluates to false because addr < DEFAULT_MAP_WINDOW > > > > addr - vm_unmapped_area(&info); > > > > ^^^ fails for whatever reason. > > > > bottomup: > > return arch_get_unmapped_area(.., addr0, len, ....); > > > > > > AFAICT arch_get_unmapped_area() can allocate a mapping which crosses the > > border, i.e. a mapping which you want to prevent for the !MAP_FIXED case. > > No, it can't as long as addr0 is below DEFAULT_MAP_WINDOW: > > arch_get_unmapped_area() > { > ... > find_start_end(addr, flags, &begin, &end); > // end is DEFAULT_MAP_WINDOW here, since addr is below the border Sigh, I missed that task_size_64bit() magic in find_start_end(). This is really convoluted and non intuitive. I'm so not looking forward to debug any failure in that context. Thanks, tglx -- To unsubscribe, send a message with 'unsubscribe linux-mm' in the body to majordomo@kvack.org. For more info on Linux MM, see: http://www.linux-mm.org/ . Don't email: email@kvack.org