lkml.org 
[lkml]   [2017]   [Jul]   [19]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.9 36/72] thp, mm: fix crash due race in MADV_FREE handling
    Date
    4.9-stable review patch.  If anyone has any objections, please let me know.

    ------------------

    From: Kirill A. Shutemov <kirill.shutemov@linux.intel.com>

    commit bbf29ffc7f963bb894f84f0580c70cfea01c3892 upstream.

    Reinette reported the following crash:

    BUG: Bad page state in process log2exe pfn:57600
    page:ffffea00015d8000 count:0 mapcount:0 mapping: (null) index:0x20200
    flags: 0x4000000000040019(locked|uptodate|dirty|swapbacked)
    raw: 4000000000040019 0000000000000000 0000000000020200 00000000ffffffff
    raw: ffffea00015d8020 ffffea00015d8020 0000000000000000 0000000000000000
    page dumped because: PAGE_FLAGS_CHECK_AT_FREE flag(s) set
    bad because of flags: 0x1(locked)
    Modules linked in: rfcomm 8021q bnep intel_rapl x86_pkg_temp_thermal coretemp efivars btusb btrtl btbcm pwm_lpss_pci snd_hda_codec_hdmi btintel pwm_lpss snd_hda_codec_realtek snd_soc_skl snd_hda_codec_generic snd_soc_skl_ipc spi_pxa2xx_platform snd_soc_sst_ipc snd_soc_sst_dsp i2c_designware_platform i2c_designware_core snd_hda_ext_core snd_soc_sst_match snd_hda_intel snd_hda_codec mei_me snd_hda_core mei snd_soc_rt286 snd_soc_rl6347a snd_soc_core efivarfs
    CPU: 1 PID: 354 Comm: log2exe Not tainted 4.12.0-rc7-test-test #19
    Hardware name: Intel corporation NUC6CAYS/NUC6CAYB, BIOS AYAPLCEL.86A.0027.2016.1108.1529 11/08/2016
    Call Trace:
    bad_page+0x16a/0x1f0
    free_pages_check_bad+0x117/0x190
    free_hot_cold_page+0x7b1/0xad0
    __put_page+0x70/0xa0
    madvise_free_huge_pmd+0x627/0x7b0
    madvise_free_pte_range+0x6f8/0x1150
    __walk_page_range+0x6b5/0xe30
    walk_page_range+0x13b/0x310
    madvise_free_page_range.isra.16+0xad/0xd0
    madvise_free_single_vma+0x2e4/0x470
    SyS_madvise+0x8ce/0x1450

    If somebody frees the page under us and we hold the last reference to
    it, put_page() would attempt to free the page before unlocking it.

    The fix is trivial reorder of operations.

    Dave said:
    "I came up with the exact same patch. For posterity, here's the test
    case, generated by syzkaller and trimmed down by Reinette:

    https://www.sr71.net/~dave/intel/log2.c

    And the config that helps detect this:

    https://www.sr71.net/~dave/intel/config-log2"

    Fixes: b8d3c4c3009d ("mm/huge_memory.c: don't split THP page when MADV_FREE syscall is called")
    Link: http://lkml.kernel.org/r/20170628101249.17879-1-kirill.shutemov@linux.intel.com
    Signed-off-by: Kirill A. Shutemov <kirill.shutemov@linux.intel.com>
    Reported-by: Reinette Chatre <reinette.chatre@intel.com>
    Acked-by: Dave Hansen <dave.hansen@intel.com>
    Acked-by: Michal Hocko <mhocko@suse.com>
    Acked-by: Minchan Kim <minchan@kernel.org>
    Cc: Huang Ying <ying.huang@intel.com>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

    ---
    mm/huge_memory.c | 2 +-
    1 file changed, 1 insertion(+), 1 deletion(-)

    --- a/mm/huge_memory.c
    +++ b/mm/huge_memory.c
    @@ -1373,8 +1373,8 @@ bool madvise_free_huge_pmd(struct mmu_ga
    get_page(page);
    spin_unlock(ptl);
    split_huge_page(page);
    - put_page(page);
    unlock_page(page);
    + put_page(page);
    goto out_unlocked;
    }


    \
     
     \ /
      Last update: 2017-07-19 12:33    [W:2.107 / U:1.136 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site