[PATCH] mm/nommu.c - return 0 from kobjsize with invalid objects

[PATCH] mm/nommu.c - return 0 from kobjsize with invalid objects

[Robin Getz]

From: Michael Hennerich <Michael.Hennerich@analog.com>

Don't perform kobjsize operations on objects the kernel doesn't manage.

Signed-off-by: Michael Hennerich <Michael.Hennerich@analog.com>
Signed-off-by: Robin Getz <rgetz@blackfin.uclinux.org>

---
On Blackfin, drivers can get dma coherent memory by calling a function
dma_alloc_coherent(). We do this in nommu by configuring a chunk of uncached
memory at the top of memory.

Since we don't want the kernel to use the uncached memory, we lie to the
kernel, and tell it that it's max memory is between 0, and the start of the
uncached dma coherent section.

this all works well, until this memory gets exposed into userspace (with a
frame buffer), when you look at the process's maps, it shows the framebuf:

root:/proc> cat maps
[snip]
03f0ef00-03f34700 rw-p 00000000 1f:00 192        /dev/fb0
root:/proc>

This is outside the "normal" range for the kernel. When the kernel tries to
find the size of this object (when you run ps), it dies in nommu.c in
kobjsize.

BUG_ON(page->index >= MAX_ORDER);

since the page we are referring to is outside what the kernel thinks is it's
max valid memory.

root:~> while [ 1 ]; ps > /dev/null; done
kernel BUG at mm/nommu.c:119!
Kernel panic - not syncing: BUG!

We fixed this by adding a check to reject out of range object pointers as it
already does that for NULL pointers.

----

--- linux/mm/nommu.c	2008-04-16 21:00:20.000000000 -0400
+++ linux/mm/nommu.c	2008-04-22 13:39:04.000000000 -0400
@@ -105,7 +106,11 @@
 {
 	struct page *page;
 
-	if (!objp || !((page = virt_to_page(objp))))
+	/*
+	 * If the object we have should not have ksize performed on it,
+	 * return size of 0
+	 */
+	if (!objp || !((page = virt_to_page(objp))) || (unsigned long)objp >= memory_end)
 		return 0;
 
 	if (PageSlab(page))

Re: [PATCH] mm/nommu.c - return 0 from kobjsize with invalid objects

[David Howells]

Robin Getz <rgetz@blackfin.uclinux.org> wrote:

> +	if (!objp || !((page = virt_to_page(objp))) || (unsigned long)objp >= memory_end)

You should probably do the additional test before calling virt_to_page(), just
in case the illegal value you've rejected would otherwise break virt_to_page()
(not very likely, but...).  For valid addresses, you've got to do all the
tests anyway.

David

Re: [PATCH] mm/nommu.c - return 0 from kobjsize with invalid objects

[Robin Getz]

From: Michael Hennerich <Michael.Hennerich@analog.com>

Don't perform kobjsize operations on objects the kernel doesn't manage.

Signed-off-by: Michael Hennerich <Michael.Hennerich@analog.com>
Signed-off-by: Robin Getz <rgetz@blackfin.uclinux.org>

---
On Blackfin, drivers can get dma coherent memory by calling a function
dma_alloc_coherent(). We do this in nommu by configuring a chunk of uncached
memory at the top of memory.

Since we don't want the kernel to use the uncached memory, we lie to the
kernel, and tell it that it's max memory is between 0, and the start of the
uncached dma coherent section.

this all works well, until this memory gets exposed into userspace (with a
frame buffer), when you look at the process's maps, it shows the framebuf:

root:/proc> cat maps
[snip]
03f0ef00-03f34700 rw-p 00000000 1f:00 192        /dev/fb0
root:/proc>

This is outside the "normal" range for the kernel. When the kernel tries to
find the size of this object (when you run ps), it dies in nommu.c in
kobjsize.

BUG_ON(page->index >= MAX_ORDER);

since the page we are referring to is outside what the kernel thinks is it's
max valid memory.

root:~> while [ 1 ]; ps > /dev/null; done
kernel BUG at mm/nommu.c:119!
Kernel panic - not syncing: BUG!

We fixed this by adding a check to reject out of range object pointers as it
already does that for NULL pointers.

As pointed out by David Howells on Tue 22 Apr 2008 17:35, the first
version I sent could still have a problem:
> Robin Getz <rgetz@blackfin.uclinux.org> wrote:
> 
> > +	if (!objp || !((page = virt_to_page(objp))) || (unsigned long)objp >= memory_end)
> 
> You should probably do the additional test before calling
> virt_to_page(), just in case the illegal value you've 
> rejected would otherwise break virt_to_page()

True enough... try that one again.

----
--- linux/mm/nommu.c	2008-04-16 21:00:20.000000000 -0400
+++ linux/mm/nommu.c	2008-04-22 13:39:04.000000000 -0400
@@ -105,7 +106,11 @@
 {
 	struct page *page;
 
-	if (!objp || !((page = virt_to_page(objp))))
+	/*
+	 * If the object we have should not have ksize performed on it,
+	 * return size of 0
+	 */
+	if (!objp || (unsigned long)objp >= memory_end || !((page = virt_to_page(objp))))
 		return 0;
 
 	if (PageSlab(page))

Re: [PATCH] mm/nommu.c - return 0 from kobjsize with invalid objects

[David Howells]

Robin Getz <rgetz@blackfin.uclinux.org> wrote:

> Don't perform kobjsize operations on objects the kernel doesn't manage.
> 
> Signed-off-by: Michael Hennerich <Michael.Hennerich@analog.com>
> Signed-off-by: Robin Getz <rgetz@blackfin.uclinux.org>

Acked-by: David Howells <dhowells@redhat.com>