LKML Archive on
help / color / mirror / Atom feed
From: Hugh Dickins <>
To: Ken Chen <>
Cc: Adam Litke <>, Andrew Morton <>,
	William Irwin <>,
	David Gibson <>,,
Subject: Re: [PATCH] Don't allow the stack to grow into hugetlb reserved regions
Date: Mon, 29 Jan 2007 17:26:56 +0000 (GMT)	[thread overview]
Message-ID: <> (raw)
In-Reply-To: <>

On Sun, 28 Jan 2007, Ken Chen wrote:
> For ia64, the hugetlb address region is reserved at the top of user
> space address.  Stacks are below that region.  Throw in the mix, we
> have two stacks, one memory stack that grows down and one register
> stack backing store that grows up.  These two stacks are always in
> pair and grow towards each other. And lastly, we have virtual address
> holes in between regions.  It's just impossible to grow any of these
> two stacks into hugetlb region no matter how I played it.
> So, AFAICS this bug doesn't apply to ia64 (and certainly not x86). The
> new check of is_hugepage_only_range() is really a noop for both arches.

Certainly not a problem on x86.

But, never mind hugetlb, you still not quite convinced me that there's
no problem at all with get_user_pages find_extend_vma growing on ia64.

I repeat that ia64_do_page_fault has REGION tests to guard against
expanding either kind of stack across into another region.  ia64_brk,
ia64_mmap_check and arch_get_unmapped_area have RGN_MAP_LIMIT checks.
But where is the equivalent paranoia when ptrace calls get_user_pages
calls find_extend_vma?

If your usual stacks face each other across the same region, they're
not going to pose problem.  But what if someone mmaps MAP_GROWSDOWN
near the base of a region, then uses ptrace to touch an address near
the top of the region below?


  reply	other threads:[~2007-01-29 17:26 UTC|newest]

Thread overview: 9+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2007-01-25 21:40 Adam Litke
2007-01-26 20:05 ` Andrew Morton
2007-01-26 21:02 ` Hugh Dickins
2007-01-26 22:48   ` Ken Chen
2007-01-27  9:08     ` Hugh Dickins
2007-01-28 20:27       ` Ken Chen
2007-01-29 17:26         ` Hugh Dickins [this message]
2007-01-29 18:32           ` Ken Chen
2007-01-29 18:34 Adam Litke

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \ \ \ \ \ \ \ \ \ \
    --subject='Re: [PATCH] Don'\''t allow the stack to grow into hugetlb reserved regions' \

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).