Re: [MIPS] Fix aliasing bug in copy_user_highpage, take 2.

Re: [MIPS] Fix aliasing bug in copy_user_highpage, take 2.

[Atsushi Nemoto]

On Mon, 15 Oct 2007 16:47:30 +0100, linux-mips@linux-mips.org wrote:
> Turns out 6a36458d9348265327d074bdd40bfb1c5b6fb2cb  wasn't quite right.
> When called for a page that isn't marked dirty it would artificially
> create an alias instead of doing the obvious thing and access the page
> via KSEG0.
> 
> The same issue also exists in copy_to_user_page and copy_from_user_page
> which was causing the machine to die under rare circumstances for example
> when running ps if the BUG_ON() assertion added by the earlier fix was
> getting triggered.

This commit added a SetPageDcacheDirty() call for both
copy_to_user_page() and copy_from_user_page().  The call in
copy_from_user_page() is really needed?

---
Atsushi Nemoto

Re: [MIPS] Fix aliasing bug in copy_user_highpage, take 2.

[Ralf Baechle]

On Tue, Oct 16, 2007 at 02:31:25AM +0900, Atsushi Nemoto wrote:

> On Mon, 15 Oct 2007 16:47:30 +0100, linux-mips@linux-mips.org wrote:
> > Turns out 6a36458d9348265327d074bdd40bfb1c5b6fb2cb  wasn't quite right.
> > When called for a page that isn't marked dirty it would artificially
> > create an alias instead of doing the obvious thing and access the page
> > via KSEG0.
> > 
> > The same issue also exists in copy_to_user_page and copy_from_user_page
> > which was causing the machine to die under rare circumstances for example
> > when running ps if the BUG_ON() assertion added by the earlier fix was
> > getting triggered.
> 
> This commit added a SetPageDcacheDirty() call for both
> copy_to_user_page() and copy_from_user_page().  The call in
> copy_from_user_page() is really needed?

After copy_from_user_page the page will reside in the D-cache.  So just
in case it ever gets mapped to userspace and modified there we better
make sure its kernel address will get flushed before mapping it to user
space.  If not, we might see stale data if the page got modified under
its userspace address.

  Ralf

Re: [MIPS] Fix aliasing bug in copy_user_highpage, take 2.

[Atsushi Nemoto]

On Mon, 15 Oct 2007 19:28:11 +0100, Ralf Baechle <ralf@linux-mips.org> wrote:
> After copy_from_user_page the page will reside in the D-cache.  So just
> in case it ever gets mapped to userspace and modified there we better
> make sure its kernel address will get flushed before mapping it to user
> space.  If not, we might see stale data if the page got modified under
> its userspace address.

Hmm, setting SetPageDcacheDirty() will not make sure the modified data
flushed before reading via the kernel mapping.  The flush_dcache_page()
should be used for such case, shouldn't it?

---
Atsushi Nemoto

Re: [MIPS] Fix aliasing bug in copy_user_highpage, take 2.

[Ralf Baechle]

On Wed, Oct 17, 2007 at 12:29:16AM +0900, Atsushi Nemoto wrote:

> On Mon, 15 Oct 2007 19:28:11 +0100, Ralf Baechle <ralf@linux-mips.org> wrote:
> > After copy_from_user_page the page will reside in the D-cache.  So just
> > in case it ever gets mapped to userspace and modified there we better
> > make sure its kernel address will get flushed before mapping it to user
> > space.  If not, we might see stale data if the page got modified under
> > its userspace address.
> 
> Hmm, setting SetPageDcacheDirty() will not make sure the modified data
> flushed before reading via the kernel mapping.  The flush_dcache_page()
> should be used for such case, shouldn't it?

You're right - and the intent is to _not_ flush the page.  But we're
bringing it into the cache, so we better flush it before it will be mapped
to userspace.  We want to delay the flush operation.

  Ralf

Re: [MIPS] Fix aliasing bug in copy_user_highpage, take 2.

[Atsushi Nemoto]

On Tue, 16 Oct 2007 16:38:06 +0100, Ralf Baechle <ralf@linux-mips.org> wrote:
> > Hmm, setting SetPageDcacheDirty() will not make sure the modified data
> > flushed before reading via the kernel mapping.  The flush_dcache_page()
> > should be used for such case, shouldn't it?
> 
> You're right - and the intent is to _not_ flush the page.  But we're
> bringing it into the cache, so we better flush it before it will be mapped
> to userspace.  We want to delay the flush operation.

I see, but I'm afraid of unnecessary flushing might hide another
bug...

Setting SetPageDcacheDirty() for non-modified page looks a bit
overkill for me.  For example, in copy_user_highpage() we do not flush
the source page if the page was not mapped to userspace.

---
Atsushi Nemoto

Re: [MIPS] Fix aliasing bug in copy_user_highpage, take 2.

[Ralf Baechle]

On Wed, Oct 17, 2007 at 01:13:49AM +0900, Atsushi Nemoto wrote:

> On Tue, 16 Oct 2007 16:38:06 +0100, Ralf Baechle <ralf@linux-mips.org> wrote:
> > > Hmm, setting SetPageDcacheDirty() will not make sure the modified data
> > > flushed before reading via the kernel mapping.  The flush_dcache_page()
> > > should be used for such case, shouldn't it?
> > 
> > You're right - and the intent is to _not_ flush the page.  But we're
> > bringing it into the cache, so we better flush it before it will be mapped
> > to userspace.  We want to delay the flush operation.
> 
> I see, but I'm afraid of unnecessary flushing might hide another
> bug...
> 
> Setting SetPageDcacheDirty() for non-modified page looks a bit
> overkill for me.  For example, in copy_user_highpage() we do not flush
> the source page if the page was not mapped to userspace.

kunmap_atomic() is supposed to deal with that.

It doesn't quite on the MIPS implementation so the kernel refuses highmem
with aliasing caches.

  Ralf