Date: Fri, 21 Mar 2014 18:47:40 GMT From: Adrian Chadd <adrian@freebsd.org> To: freebsd-gnats-submit@FreeBSD.org Subject: kern/187826: [kern] /dev/mem accesses may cause page faults Message-ID: <201403211847.s2LIleth069234@cgiserv.freebsd.org> Resent-Message-ID: <201403211850.s2LIo055042999@freefall.freebsd.org>
next in thread | raw e-mail | index | archive | help
>Number: 187826 >Category: kern >Synopsis: [kern] /dev/mem accesses may cause page faults >Confidential: no >Severity: non-critical >Priority: low >Responsible: freebsd-bugs >State: open >Quarter: >Keywords: >Date-Required: >Class: sw-bug >Submitter-Id: current-users >Arrival-Date: Fri Mar 21 18:50:00 UTC 2014 >Closed-Date: >Last-Modified: >Originator: Adrian Chadd >Release: -HEAD >Organization: >Environment: >Description: >From the commit to amd64 (r263475): Fix two issues with /dev/mem access on amd64, both causing kernel page faults. First, for accesses to direct map region should check for the limit by which direct map is instantiated. Second, for accesses to the kernel map, success returned from the kernacc(9) does not guarantee that consequent attempt to read or write to the checked address succeed, since other thread might invalidate the address meantime. Add a new thread private flag TDP_DEVMEMIO, which instructs vm_fault() to return error when fault happens on the MAP_ENTRY_NOFAULT entry, instead of panicing. The trap handler would then see a page fault from access, and recover in normal way, making /dev/mem access safer. Remove GIANT_REQUIRED from the amd64 memrw(), since it is not needed and having Giant locked does not solve issues for amd64. Note that at least the second issue exists on other architectures, and requires similar patching for md code. >How-To-Repeat: >Fix: >Release-Note: >Audit-Trail: >Unformatted:
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?201403211847.s2LIleth069234>