From mboxrd@z Thu Jan 1 00:00:00 1970 From: Dave Hansen Subject: Re: [kernel-hardening] [PATCH v5 13/32] x86/mm/64: In vmalloc_fault(), use CR3 instead of current->active_mm Date: Tue, 12 Jul 2016 10:51:57 -0700 Message-ID: <57852E3D.6010107@intel.com> References: <3213d3f31959a6467b1feb80a384c1e11341b2be.1468270393.git.luto@kernel.org> Mime-Version: 1.0 Content-Type: text/plain; charset=windows-1252 Content-Transfer-Encoding: 7bit Return-path: In-Reply-To: <3213d3f31959a6467b1feb80a384c1e11341b2be.1468270393.git.luto@kernel.org> Sender: linux-kernel-owner@vger.kernel.org To: kernel-hardening@lists.openwall.com, x86@kernel.org, linux-kernel@vger.kernel.org Cc: linux-arch@vger.kernel.org, Borislav Petkov , Nadav Amit , Kees Cook , Brian Gerst , Linus Torvalds , Josh Poimboeuf , Jann Horn , Heiko Carstens , Andy Lutomirski List-Id: linux-arch.vger.kernel.org On 07/11/2016 01:53 PM, Andy Lutomirski wrote: > If we get a vmalloc fault while current->active_mm->pgd doesn't > match CR3, we'll crash without this change. I've seen this failure > mode on heavily instrumented kernels with virtually mapped stacks. When does this happen, btw? Crossing page boundaries on the stack between the time we swap mm's and the time we switch stacks? From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mga01.intel.com ([192.55.52.88]:64214 "EHLO mga01.intel.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1750901AbcGLRxA (ORCPT ); Tue, 12 Jul 2016 13:53:00 -0400 Subject: Re: [kernel-hardening] [PATCH v5 13/32] x86/mm/64: In vmalloc_fault(), use CR3 instead of current->active_mm References: <3213d3f31959a6467b1feb80a384c1e11341b2be.1468270393.git.luto@kernel.org> From: Dave Hansen Message-ID: <57852E3D.6010107@intel.com> Date: Tue, 12 Jul 2016 10:51:57 -0700 MIME-Version: 1.0 In-Reply-To: <3213d3f31959a6467b1feb80a384c1e11341b2be.1468270393.git.luto@kernel.org> Content-Type: text/plain; charset=windows-1252 Content-Transfer-Encoding: 7bit Sender: linux-arch-owner@vger.kernel.org List-ID: To: kernel-hardening@lists.openwall.com, x86@kernel.org, linux-kernel@vger.kernel.org Cc: linux-arch@vger.kernel.org, Borislav Petkov , Nadav Amit , Kees Cook , Brian Gerst , Linus Torvalds , Josh Poimboeuf , Jann Horn , Heiko Carstens , Andy Lutomirski Message-ID: <20160712175157.DL6FDFFpPSidU2QO19IoiMxuuaGnsy9A5ESFVQMl4Ik@z> On 07/11/2016 01:53 PM, Andy Lutomirski wrote: > If we get a vmalloc fault while current->active_mm->pgd doesn't > match CR3, we'll crash without this change. I've seen this failure > mode on heavily instrumented kernels with virtually mapped stacks. When does this happen, btw? Crossing page boundaries on the stack between the time we swap mm's and the time we switch stacks?