lkml.org 
[lkml]   [2017]   [Nov]   [23]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
Patch in this message
/
From
Subject[PATCH] mm,madvise: bugfix of madvise systemcall infinite loop under special circumstances.
Date
From: chenjie <chenjie6@huawei.com>

The madvise() system call supported a set of "conventional" advice values,
the MADV_WILLNEED parameter will trigger an infinite loop under direct
access mode(DAX). In DAX mode, the function madvise_vma() will return
directly without updating the pointer [prev].

For example:
Special circumstances:
1、init [ start < vam->vm_start < vam->vm_end < end ]
2、madvise_vma() using MADV_WILLNEED parameter ;
madvise_vma() -> madvise_willneed() -> return 0 && without updating [prev]

=======================================================================
in Function SYSCALL_DEFINE3(madvise,...)

for (;;)
{
//[first loop: start = vam->vm_start < vam->vm_end <end ];
update [start = vma->vm_start | end ]

con0: if (start >= end) //false always;
goto out;
tmp = vma->vm_end;

//do not update [prev] and always return 0;
error = madvise_willneed();

con1: if (error) //false always;
goto out;

//[ vam->vm_start < start = vam->vm_end <end ]
update [start = tmp ]

con2: if (start >= end) //false always ;
goto out;

//because of pointer [prev] did not change,[vma] keep as it was;
update [ vma = prev->vm_next ]
}

=======================================================================
After the first cycle ;it will always keep
[ vam->vm_start < start = vam->vm_end < end ].
since Circulation exit conditions (con{0,1,2}) will never meet ,the
program stuck in infinite loop.

Signed-off-by: chenjie <chenjie6@huawei.com>
Signed-off-by: guoxuenan <guoxuenan@huawei.com>
---
mm/madvise.c | 1 +
1 file changed, 1 insertion(+)

diff --git a/mm/madvise.c b/mm/madvise.c
index 21261ff..c355fee 100644
--- a/mm/madvise.c
+++ b/mm/madvise.c
@@ -294,6 +294,7 @@ static long madvise_willneed(struct vm_area_struct *vma,
#endif

if (IS_DAX(file_inode(file))) {
+ *prev = vma;
/* no bad return value, but ignore advice */
return 0;
}
--
2.9.5
\
 
 \ /
  Last update: 2017-11-24 03:26    [W:0.061 / U:1.636 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site