From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1755502AbdKOAeK (ORCPT ); Tue, 14 Nov 2017 19:34:10 -0500 Received: from mail-pg0-f65.google.com ([74.125.83.65]:47311 "EHLO mail-pg0-f65.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752929AbdKOAeB (ORCPT ); Tue, 14 Nov 2017 19:34:01 -0500 X-Google-Smtp-Source: AGs4zMaBgD304J509F3WgQKRDihkEGExwilSlil6kGu20RHGat+WvV7ADBimdgODOx1d0dBWrthWfg== Date: Tue, 14 Nov 2017 16:33:58 -0800 From: Tycho Andersen To: Dave Hansen Cc: linux-kernel@vger.kernel.org, linux-mm@kvack.org, kernel-hardening@lists.openwall.com, Marco Benatto , Juerg Haefliger , x86@kernel.org Subject: Re: [kernel-hardening] Re: [PATCH v6 03/11] mm, x86: Add support for eXclusive Page Frame Ownership (XPFO) Message-ID: <20171115003358.r3bsukc3vlbikjef@cisco> References: <20170907173609.22696-1-tycho@docker.com> <20170907173609.22696-4-tycho@docker.com> <34454a32-72c2-c62e-546c-1837e05327e1@intel.com> <20170920223452.vam3egenc533rcta@smitten> <97475308-1f3d-ea91-5647-39231f3b40e5@intel.com> <20170921000901.v7zo4g5edhqqfabm@docker> <20171110010907.qfkqhrbtdkt5y3hy@smitten> <7237ae6d-f8aa-085e-c144-9ed5583ec06b@intel.com> <2aa64bf6-fead-08cc-f4fe-bd353008ca59@intel.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <2aa64bf6-fead-08cc-f4fe-bd353008ca59@intel.com> User-Agent: NeoMutt/20170609 (1.8.3) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Hi Dave, On Mon, Nov 13, 2017 at 02:46:25PM -0800, Dave Hansen wrote: > On 11/13/2017 02:20 PM, Dave Hansen wrote: > > On 11/09/2017 05:09 PM, Tycho Andersen wrote: > >> which I guess is from the additional flags in grow_dev_page() somewhere down > >> the stack. Anyway... it seems this is a kernel allocation that's using > >> MIGRATE_MOVABLE, so perhaps we need some more fine tuned heuristic than just > >> all MOVABLE allocations are un-mapped via xpfo, and all the others are mapped. > >> > >> Do you have any ideas? > > > > It still has to do a kmap() or kmap_atomic() to be able to access it. I > > thought you hooked into that. Why isn't that path getting hit for these? > > Oh, this looks to be accessing data mapped by a buffer_head. It > (rudely) accesses data via: > > void set_bh_page(struct buffer_head *bh, > ... > bh->b_data = page_address(page) + offset; Ah, yes. I guess there will be many bugs like this :). Anyway, I'll try to cook up a patch. Thanks! Tycho