Re: [PATCH] x86/mpx: fix recursive munmap() corruption

2020-11-04 Thread Laurent Dufour
Le 03/11/2020 à 22:08, Dmitry Safonov a écrit : Hi Laurent, Christophe, Michael, all, On 11/3/20 5:11 PM, Laurent Dufour wrote: Le 23/10/2020 à 14:28, Christophe Leroy a écrit : [..] That seems like it would work for CRIU and make sense in general? Sorry for the late answer, yes this would

Re: [PATCH] x86/mpx: fix recursive munmap() corruption

2020-11-03 Thread Dmitry Safonov
Hi Laurent, Christophe, Michael, all, On 11/3/20 5:11 PM, Laurent Dufour wrote: > Le 23/10/2020 à 14:28, Christophe Leroy a écrit : [..] That seems like it would work for CRIU and make sense in general? >>> >>> Sorry for the late answer, yes this would make more sense. >>> >>> Here is a

Re: [PATCH] x86/mpx: fix recursive munmap() corruption

2020-11-03 Thread Laurent Dufour
Le 23/10/2020 à 14:28, Christophe Leroy a écrit : Hi Laurent Le 07/05/2019 à 18:35, Laurent Dufour a écrit : Le 01/05/2019 à 12:32, Michael Ellerman a écrit : Laurent Dufour writes: Le 23/04/2019 à 18:04, Dave Hansen a écrit : On 4/23/19 4:16 AM, Laurent Dufour wrote: ... There are 2

Re: [PATCH] x86/mpx: fix recursive munmap() corruption

2020-10-23 Thread Christophe Leroy
Hi Laurent Le 07/05/2019 à 18:35, Laurent Dufour a écrit : Le 01/05/2019 à 12:32, Michael Ellerman a écrit : Laurent Dufour writes: Le 23/04/2019 à 18:04, Dave Hansen a écrit : On 4/23/19 4:16 AM, Laurent Dufour wrote: ... There are 2 assumptions here:    1. 'start' and 'end' are page

Re: [PATCH] x86/mpx: fix recursive munmap() corruption

2019-04-23 Thread Laurent Dufour
Le 23/04/2019 à 18:04, Dave Hansen a écrit : On 4/23/19 4:16 AM, Laurent Dufour wrote: My only concern is the error path. Calling arch_unmap() before handling any error case means that it will have to be undo and there is no way to do so. Is there a practical scenario where munmap() of the

Re: [PATCH] x86/mpx: fix recursive munmap() corruption

2019-04-23 Thread Dave Hansen
On 4/23/19 4:16 AM, Laurent Dufour wrote: > My only concern is the error path. > Calling arch_unmap() before handling any error case means that it will > have to be undo and there is no way to do so. Is there a practical scenario where munmap() of the VDSO can split a VMA? If the VDSO is

Re: [PATCH] x86/mpx: fix recursive munmap() corruption

2019-04-23 Thread Thomas Gleixner
On Tue, 23 Apr 2019, Laurent Dufour wrote: > Le 20/04/2019 à 12:31, Michael Ellerman a écrit : > > Thomas Gleixner writes: > > > Aside of that the powerpc variant looks suspicious: > > > > > > static inline void arch_unmap(struct mm_struct *mm, > > >unsigned long

Re: [PATCH] x86/mpx: fix recursive munmap() corruption

2019-04-23 Thread Laurent Dufour
Le 20/04/2019 à 12:31, Michael Ellerman a écrit : Thomas Gleixner writes: On Mon, 1 Apr 2019, Dave Hansen wrote: diff -puN mm/mmap.c~mpx-rss-pass-no-vma mm/mmap.c --- a/mm/mmap.c~mpx-rss-pass-no-vma 2019-04-01 06:56:53.409411123 -0700 +++ b/mm/mmap.c 2019-04-01 06:56:53.423411123 -0700 @@

Re: [PATCH] x86/mpx: fix recursive munmap() corruption

2019-04-20 Thread Michael Ellerman
Thomas Gleixner writes: > On Mon, 1 Apr 2019, Dave Hansen wrote: >> diff -puN mm/mmap.c~mpx-rss-pass-no-vma mm/mmap.c >> --- a/mm/mmap.c~mpx-rss-pass-no-vma 2019-04-01 06:56:53.409411123 -0700 >> +++ b/mm/mmap.c 2019-04-01 06:56:53.423411123 -0700 >> @@ -2731,9 +2731,17 @@ int

Re: [PATCH] x86/mpx: fix recursive munmap() corruption

2019-04-19 Thread Thomas Gleixner
On Mon, 1 Apr 2019, Dave Hansen wrote: > diff -puN mm/mmap.c~mpx-rss-pass-no-vma mm/mmap.c > --- a/mm/mmap.c~mpx-rss-pass-no-vma 2019-04-01 06:56:53.409411123 -0700 > +++ b/mm/mmap.c 2019-04-01 06:56:53.423411123 -0700 > @@ -2731,9 +2731,17 @@ int __do_munmap(struct mm_struct *mm, un >

[PATCH] x86/mpx: fix recursive munmap() corruption

2019-04-01 Thread Dave Hansen
This is a bit of a mess, to put it mildly. But, it's a bug that seems to have gone unticked up to now, probably because nobody uses MPX. The other alternative to this fix is to just deprecate MPX, even in -stable kernels. MPX has the arch_unmap() hook inside of munmap() because MPX uses

[PATCH] x86/mpx: fix recursive munmap() corruption

2019-03-19 Thread Dave Hansen
This is a bit of a mess, to put it mildly. But, it's a bug that seems to have gone unticked up to now, probably because nobody uses MPX. The other alternative to this fix is to just deprecate MPX, even in -stable kernels. MPX has the arch_unmap() hook inside of munmap() because MPX uses