lkml.org 
[lkml]   [2019]   [Oct]   [6]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.2 134/137] kexec: bail out upon SIGKILL when allocating memory.
    Date
    From: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>

    commit 7c3a6aedcd6aae0a32a527e68669f7dd667492d1 upstream.

    syzbot found that a thread can stall for minutes inside kexec_load() after
    that thread was killed by SIGKILL [1]. It turned out that the reproducer
    was trying to allocate 2408MB of memory using kimage_alloc_page() from
    kimage_load_normal_segment(). Let's check for SIGKILL before doing memory
    allocation.

    [1] https://syzkaller.appspot.com/bug?id=a0e3436829698d5824231251fad9d8e998f94f5e

    Link: http://lkml.kernel.org/r/993c9185-d324-2640-d061-bed2dd18b1f7@I-love.SAKURA.ne.jp
    Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
    Reported-by: syzbot <syzbot+8ab2d0f39fb79fe6ca40@syzkaller.appspotmail.com>
    Cc: Eric Biederman <ebiederm@xmission.com>
    Reviewed-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

    ---
    kernel/kexec_core.c | 2 ++
    1 file changed, 2 insertions(+)

    --- a/kernel/kexec_core.c
    +++ b/kernel/kexec_core.c
    @@ -300,6 +300,8 @@ static struct page *kimage_alloc_pages(g
    {
    struct page *pages;

    + if (fatal_signal_pending(current))
    + return NULL;
    pages = alloc_pages(gfp_mask & ~__GFP_ZERO, order);
    if (pages) {
    unsigned int count, i;

    \
     
     \ /
      Last update: 2019-10-06 19:39    [W:7.887 / U:0.040 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site