Page MenuHomeFreeBSD

i386: Use atomic 64bit load to read PDE value from PAE pagetables in pmap_kextract().
ClosedPublic

Authored by kib on Jan 2 2019, 1:17 PM.
Tags
None
Referenced Files
Unknown Object (File)
Mon, Oct 13, 8:45 PM
Unknown Object (File)
Sat, Oct 11, 11:48 PM
Unknown Object (File)
Sat, Oct 4, 9:15 PM
Unknown Object (File)
Tue, Sep 30, 7:55 PM
Unknown Object (File)
Mon, Sep 29, 6:04 AM
Unknown Object (File)
Sun, Sep 28, 8:17 PM
Unknown Object (File)
Sun, Sep 28, 12:45 PM
Unknown Object (File)
Tue, Sep 16, 2:32 PM
Subscribers

Details

Summary

pmap_kextract() can race with promotion/demotion on the kernel page table, in which case current non-atomic 64bit read would see torn value, breaking pmap_kextract(). pmap_kextract() would correctly handle either promoted or demoted PDE, but not the mix where one word is from a different state.

It requires PAE and > 4G memory to reproduce. We observed this in real loads, both for intensive use of malloc()/free() where vtoslab() returned invalid pointer to the slab, and with the use of busdma_bounce, where incorrect page was bounced.

In collaboration with: pho

Diff Detail

Repository
rS FreeBSD src repository - subversion
Lint
Lint Not Applicable
Unit
Tests Not Applicable