archive mirror
 help / color / mirror / Atom feed
From: Greg KH <>
To: Dan Williams <>
Cc: Arnd Bergmann <>, Ingo Molnar <>,
	Kees Cook <>,
	Russell King <>,
	Andrew Morton <>,,
Subject: Re: [PATCH v2] /dev/mem: Revoke mappings when a driver claims the region
Date: Tue, 19 May 2020 14:11:15 +0200	[thread overview]
Message-ID: <> (raw)
In-Reply-To: <>

On Tue, May 19, 2020 at 12:03:06AM -0700, Dan Williams wrote:
> Close the hole of holding a mapping over kernel driver takeover event of
> a given address range.
> Commit 90a545e98126 ("restrict /dev/mem to idle io memory ranges")
> introduced CONFIG_IO_STRICT_DEVMEM with the goal of protecting the
> kernel against scenarios where a /dev/mem user tramples memory that a
> kernel driver owns. However, this protection only prevents *new* read(),
> write() and mmap() requests. Established mappings prior to the driver
> calling request_mem_region() are left alone.
> Especially with persistent memory, and the core kernel metadata that is
> stored there, there are plentiful scenarios for a /dev/mem user to
> violate the expectations of the driver and cause amplified damage.
> Teach request_mem_region() to find and shoot down active /dev/mem
> mappings that it believes it has successfully claimed for the exclusive
> use of the driver. Effectively a driver call to request_mem_region()
> becomes a hole-punch on the /dev/mem device.
> The typical usage of unmap_mapping_range() is part of
> truncate_pagecache() to punch a hole in a file, but in this case the
> implementation is only doing the "first half" of a hole punch. Namely it
> is just evacuating current established mappings of the "hole", and it
> relies on the fact that /dev/mem establishes mappings in terms of
> absolute physical address offsets. Once existing mmap users are
> invalidated they can attempt to re-establish the mapping, or attempt to
> continue issuing read(2) / write(2) to the invalidated extent, but they
> will then be subject to the CONFIG_IO_STRICT_DEVMEM checking that can
> block those subsequent accesses.
> Cc: Arnd Bergmann <>
> Cc: Ingo Molnar <>
> Cc: Kees Cook <>
> Cc: Russell King <>
> Cc: Andrew Morton <>
> Cc: Greg Kroah-Hartman <>
> Fixes: 90a545e98126 ("restrict /dev/mem to idle io memory ranges")
> Signed-off-by: Dan Williams <>
> ---
> Changes since v1 [1]:
> - updated the changelog to describe the usage of unmap_mapping_range().
>   No other logic changes:
> [1]:
> Greg, Andrew,
> I have a regression test for this case now. This was found by an
> intermittent data corruption scenario on pmem from a test tool using
> /dev/mem.

Ick, why are test tools messing around in /dev/mem :)

Anyway, this seems sane to me, want me to take it through my tree?


greg k-h

  reply	other threads:[~2020-05-19 12:11 UTC|newest]

Thread overview: 6+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2020-05-19  7:03 [PATCH v2] /dev/mem: Revoke mappings when a driver claims the region Dan Williams
2020-05-19 12:11 ` Greg KH [this message]
2020-05-19 18:27   ` Dan Williams
2020-05-20  5:44     ` Greg KH
2020-05-19 18:46 ` Matthew Wilcox
2020-05-19 19:36   ` Dan Williams

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \ \ \ \ \ \ \ \ \ \ \

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).