Re: [x86, vdso] BUG: unable to handle kernel paging request at d34bd000

[Andy Lutomirski]

On Mon, Mar 10, 2014 at 10:58 AM, H. Peter Anvin <hpa@xxxxxxxxxxxxxxx> wrote:
> On 03/10/2014 10:52 AM, Andy Lutomirski wrote:
>>>
>>> Hint: where is your RIP?  Where is the RIP of other processes?
>>>
>>
>> Whoa there, I'm not suggesting anything nearly that crazy :)
>>
>> I'm suggesting changing out the vvar page *for that process*, which is
>> not executable.  The actual vdso code already supports this -- from
>> userspace's point of view it's the same thing as 'echo acpi_pm >
>> /sys/devices/system/clocksource/clocksource0/current_clocksource',
>> except that if the actual clocksource is HPET, the hpet page will be
>> switched out (presumably with a zero page) while being read.
>>
>> Other processes are totally irrelevant, unless they share the same
>> struct mm.  (This is why the vvar page can't be in the fixmap for this
>> to work.)
>>
>
> I meant "threads" not "processes"...

Still okay.  The vclock_gettime code does, more or less:

        do {
                seq = raw_read_seqcount_begin(&gtod->seq);
                mode = gtod->clock.vclock_mode;
                read the time;
        } while (unlikely(read_seqcount_retry(&gtod->seq, seq)));

Switching the clocksource in current code will make seq odd, then
change vclock_mode, then make seq even again.  The prctl would zap the
mapping, flush the TLB, and then map something else (with a different
seq and vclock_mode) there.  User code will be hard pressed to tell
the difference.

To avoid having to carve out a special seq value, I'd actually propose
just leaving seq odd for the TSC off case -- I think that the
vclock_gettime code could move the branch for mode == NONE inside the
loop with no loss in performance.

--Andy
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/