From: Andrew Morton <akpm@linux-foundation.org>
To: Muchun Song <songmuchun@bytedance.com>
Cc: Markus.Elfring@web.de, david@redhat.com, ktkhai@virtuozzo.com,
yang.shi@linux.alibaba.com, linux-mm@kvack.org,
linux-kernel@vger.kernel.org,
Xiongchun Duan <duanxiongchun@bytedance.com>
Subject: Re: [PATCH v4] mm/ksm: Fix NULL pointer dereference when KSM zero page is enabled
Date: Wed, 15 Apr 2020 19:58:41 -0700 [thread overview]
Message-ID: <20200415195841.da4361916f662a0136a271a5@linux-foundation.org> (raw)
In-Reply-To: <20200416025034.29780-1-songmuchun@bytedance.com>
On Thu, 16 Apr 2020 10:50:34 +0800 Muchun Song <songmuchun@bytedance.com> wrote:
> The find_mergeable_vma can return NULL. In this case, it leads
> to a crash when we access vm_mm(its offset is 0x40) later in
> write_protect_page. And this case did happen on our server. The
> following call trace is captured in kernel 4.19 with the following
> patch applied and KSM zero page enabled on our server.
>
> commit e86c59b1b12d ("mm/ksm: improve deduplication of zero pages with colouring")
>
> So add a vma check to fix it.
>
> ...
>
> --- a/mm/ksm.c
> +++ b/mm/ksm.c
> @@ -2112,8 +2112,15 @@ static void cmp_and_merge_page(struct page *page, struct rmap_item *rmap_item)
>
> down_read(&mm->mmap_sem);
> vma = find_mergeable_vma(mm, rmap_item->address);
> - err = try_to_merge_one_page(vma, page,
> - ZERO_PAGE(rmap_item->address));
> + if (vma)
> + err = try_to_merge_one_page(vma, page,
> + ZERO_PAGE(rmap_item->address));
> + else
> + /**
> + * If the vma is out of date, we do not need to
> + * continue.
> + */
> + err = 0;
> up_read(&mm->mmap_sem);
> /*
> * In case of failure, the page was not really empty, so we
Thanks.
It's conventional to put braces around multi-line blocks such as this.
Also, /** is specifically used to introduce kerneldoc comments. This
comment is not a kerneldoc one so use /*.
--- a/mm/ksm.c~mm-ksm-fix-null-pointer-dereference-when-ksm-zero-page-is-enabled-v4-fix
+++ a/mm/ksm.c
@@ -2112,15 +2112,16 @@ static void cmp_and_merge_page(struct pa
down_read(&mm->mmap_sem);
vma = find_mergeable_vma(mm, rmap_item->address);
- if (vma)
+ if (vma) {
err = try_to_merge_one_page(vma, page,
ZERO_PAGE(rmap_item->address));
- else
- /**
+ } else {
+ /*
* If the vma is out of date, we do not need to
* continue.
*/
err = 0;
+ }
up_read(&mm->mmap_sem);
/*
* In case of failure, the page was not really empty, so we
_
next prev parent reply other threads:[~2020-04-16 2:58 UTC|newest]
Thread overview: 7+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-04-16 2:50 [PATCH v4] mm/ksm: Fix NULL pointer dereference when KSM zero page is enabled Muchun Song
2020-04-16 2:58 ` Andrew Morton [this message]
2020-04-16 6:14 ` Markus Elfring
2020-04-16 11:20 ` Kirill Tkhai
2020-04-16 20:05 ` Joe Perches
2020-04-16 6:00 ` Markus Elfring
2020-04-16 11:21 ` Matthew Wilcox
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20200415195841.da4361916f662a0136a271a5@linux-foundation.org \
--to=akpm@linux-foundation.org \
--cc=Markus.Elfring@web.de \
--cc=david@redhat.com \
--cc=duanxiongchun@bytedance.com \
--cc=ktkhai@virtuozzo.com \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-mm@kvack.org \
--cc=songmuchun@bytedance.com \
--cc=yang.shi@linux.alibaba.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).