From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from spaceape9.eur.corp.google.com (spaceape9.eur.corp.google.com [172.28.16.143]) by smtp-out.google.com with ESMTP id l0TIWodL013436 for ; Mon, 29 Jan 2007 18:32:50 GMT Received: from ug-out-1314.google.com (ugem3.prod.google.com [10.66.164.3]) by spaceape9.eur.corp.google.com with ESMTP id l0TIWM0L031934 for ; Mon, 29 Jan 2007 18:32:41 GMT Received: by ug-out-1314.google.com with SMTP id m3so1329256uge for ; Mon, 29 Jan 2007 10:32:41 -0800 (PST) Message-ID: Date: Mon, 29 Jan 2007 10:32:39 -0800 From: "Ken Chen" Subject: Re: [PATCH] Don't allow the stack to grow into hugetlb reserved regions In-Reply-To: MIME-Version: 1.0 Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit Content-Disposition: inline References: <20070125214052.22841.33449.stgit@localhost.localdomain> Sender: owner-linux-mm@kvack.org Return-Path: To: Hugh Dickins Cc: Adam Litke , Andrew Morton , William Irwin , David Gibson , linux-mm@kvack.org, linux-kernel@vger.kernel.org, tony.luck@intel.com List-ID: On 1/29/07, Hugh Dickins wrote: > But, never mind hugetlb, you still not quite convinced me that there's > no problem at all with get_user_pages find_extend_vma growing on ia64. > > I repeat that ia64_do_page_fault has REGION tests to guard against > expanding either kind of stack across into another region. ia64_brk, > ia64_mmap_check and arch_get_unmapped_area have RGN_MAP_LIMIT checks. > But where is the equivalent paranoia when ptrace calls get_user_pages > calls find_extend_vma? > > If your usual stacks face each other across the same region, they're > not going to pose problem. But what if someone mmaps MAP_GROWSDOWN > near the base of a region, then uses ptrace to touch an address near > the top of the region below? OK, now I fully understand what you are after. I kept on thinking in the context of hugetlb. You are correct that ia64 does not have proper address check for find_extend_vma() and it is indeed a potentially very bad bug in there. I'm with you, I don't see the equivalent RGN_MAP_LIMIT check in the get_user_pages() path. Forwarding this to Tony as I don't have any access to ia64 machine anymore to test/validate a fix. - Ken -- To unsubscribe, send a message with 'unsubscribe linux-mm' in the body to majordomo@kvack.org. For more info on Linux MM, see: http://www.linux-mm.org/ . Don't email: email@kvack.org