| Message ID | 1386256471.3525.13.camel@linaro1.home (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
2013/12/5 Jon Medhurst (Tixy) <tixy@linaro.org>: > On Thu, 2013-12-05 at 14:23 +0000, Jon Medhurst (Tixy) wrote: >> On Wed, 2013-12-04 at 16:13 +0000, Will Deacon wrote: >> > took another look at that patch and can't see anything obviously wrong >> > with it. >> >> If the memory region isn't guaranteed to be page aligned then doesn't it >> flush up to PAGE_SIZE-1 more bytes than requested and so exceed the >> bounds check in do_cache_op? Fixing this as below _appears_ to stop the >> Browser crashes I'm seeing (still doing some more testing)... > > Actually, a smaller patch and one which avoids the possibility of > arithmetic owerflow is... > > From: Jon Medhurst <tixy@linaro.org> > Date: Thu, 5 Dec 2013 14:29:24 +0000 > Subject: [PATCH] ARM: cacheflush: correctly limit range of memory region > being flushed > > The __do_cache_op function operates with a 'chunk' size of one page > but fails to limit the size of the final chunk so as to not exceed > the specified memory region. Fix this. > > Signed-off-by: Jon Medhurst <tixy@linaro.org> > --- > arch/arm/kernel/traps.c | 3 ++- > 1 file changed, 2 insertions(+), 1 deletion(-) > > diff --git a/arch/arm/kernel/traps.c b/arch/arm/kernel/traps.c > index dbf0923..7940241 100644 > --- a/arch/arm/kernel/traps.c > +++ b/arch/arm/kernel/traps.c > @@ -509,9 +509,10 @@ static inline int > __do_cache_op(unsigned long start, unsigned long end) > { > int ret; > - unsigned long chunk = PAGE_SIZE; > > do { > + unsigned long chunk = min(PAGE_SIZE, end - start); > + > if (signal_pending(current)) { > struct thread_info *ti = current_thread_info(); > > -- > 1.7.10.4 > > I am running my test overnight with this patch... stay tuned. greets -- Christian Gmeiner, MSc
2013/12/5 Christian Gmeiner <christian.gmeiner@gmail.com>: > 2013/12/5 Jon Medhurst (Tixy) <tixy@linaro.org>: >> On Thu, 2013-12-05 at 14:23 +0000, Jon Medhurst (Tixy) wrote: >>> On Wed, 2013-12-04 at 16:13 +0000, Will Deacon wrote: >>> > took another look at that patch and can't see anything obviously wrong >>> > with it. >>> >>> If the memory region isn't guaranteed to be page aligned then doesn't it >>> flush up to PAGE_SIZE-1 more bytes than requested and so exceed the >>> bounds check in do_cache_op? Fixing this as below _appears_ to stop the >>> Browser crashes I'm seeing (still doing some more testing)... >> >> Actually, a smaller patch and one which avoids the possibility of >> arithmetic owerflow is... >> >> From: Jon Medhurst <tixy@linaro.org> >> Date: Thu, 5 Dec 2013 14:29:24 +0000 >> Subject: [PATCH] ARM: cacheflush: correctly limit range of memory region >> being flushed >> >> The __do_cache_op function operates with a 'chunk' size of one page >> but fails to limit the size of the final chunk so as to not exceed >> the specified memory region. Fix this. >> >> Signed-off-by: Jon Medhurst <tixy@linaro.org> >> --- >> arch/arm/kernel/traps.c | 3 ++- >> 1 file changed, 2 insertions(+), 1 deletion(-) >> >> diff --git a/arch/arm/kernel/traps.c b/arch/arm/kernel/traps.c >> index dbf0923..7940241 100644 >> --- a/arch/arm/kernel/traps.c >> +++ b/arch/arm/kernel/traps.c >> @@ -509,9 +509,10 @@ static inline int >> __do_cache_op(unsigned long start, unsigned long end) >> { >> int ret; >> - unsigned long chunk = PAGE_SIZE; >> >> do { >> + unsigned long chunk = min(PAGE_SIZE, end - start); >> + >> if (signal_pending(current)) { >> struct thread_info *ti = current_thread_info(); >> >> -- >> 1.7.10.4 >> >> > > I am running my test overnight with this patch... stay tuned. > My test is still running, which is good. Tested-by: Christian Gmeiner <christian.gmeiner@gmail.com>
Hi guys, I was out-of-office yesterday, so sorry for the radio silence. On Thu, Dec 05, 2013 at 03:14:31PM +0000, Jon Medhurst (Tixy) wrote: > On Thu, 2013-12-05 at 14:23 +0000, Jon Medhurst (Tixy) wrote: > > On Wed, 2013-12-04 at 16:13 +0000, Will Deacon wrote: > > > took another look at that patch and can't see anything obviously wrong > > > with it. > > > > If the memory region isn't guaranteed to be page aligned then doesn't it > > flush up to PAGE_SIZE-1 more bytes than requested and so exceed the > > bounds check in do_cache_op? Fixing this as below _appears_ to stop the > > Browser crashes I'm seeing (still doing some more testing)... Well spotted! We used to round down to a page, but I fixed that in the same series and didn't notice I'd introduce a bug here. Thanks for digging. Interesting that we've not heard more reports of this... > Actually, a smaller patch and one which avoids the possibility of > arithmetic owerflow is... > > From: Jon Medhurst <tixy@linaro.org> > Date: Thu, 5 Dec 2013 14:29:24 +0000 > Subject: [PATCH] ARM: cacheflush: correctly limit range of memory region > being flushed > > The __do_cache_op function operates with a 'chunk' size of one page > but fails to limit the size of the final chunk so as to not exceed > the specified memory region. Fix this. > > Signed-off-by: Jon Medhurst <tixy@linaro.org> > --- > arch/arm/kernel/traps.c | 3 ++- > 1 file changed, 2 insertions(+), 1 deletion(-) > > diff --git a/arch/arm/kernel/traps.c b/arch/arm/kernel/traps.c > index dbf0923..7940241 100644 > --- a/arch/arm/kernel/traps.c > +++ b/arch/arm/kernel/traps.c > @@ -509,9 +509,10 @@ static inline int > __do_cache_op(unsigned long start, unsigned long end) > { > int ret; > - unsigned long chunk = PAGE_SIZE; > > do { > + unsigned long chunk = min(PAGE_SIZE, end - start); > + > if (signal_pending(current)) { > struct thread_info *ti = current_thread_info(); Acked-by: Will Deacon <will.deacon@arm.com> Please can you put this into the patch system, along with a CC stable? Cheers, Will
diff --git a/arch/arm/kernel/traps.c b/arch/arm/kernel/traps.c index dbf0923..7940241 100644 --- a/arch/arm/kernel/traps.c +++ b/arch/arm/kernel/traps.c @@ -509,9 +509,10 @@ static inline int __do_cache_op(unsigned long start, unsigned long end) { int ret; - unsigned long chunk = PAGE_SIZE; do { + unsigned long chunk = min(PAGE_SIZE, end - start); + if (signal_pending(current)) { struct thread_info *ti = current_thread_info();