From: Michal Hocko <mhocko@suse.com>
To: Oscar Salvador <osalvador@suse.de>
Cc: Shijie Luo <luoshijie1@huawei.com>,
akpm@linux-foundation.org, linux-mm@kvack.org,
linux-kernel@vger.kernel.org, linmiaohe@huawei.com,
linfeilong@huawei.com
Subject: Re: [PATCH] mm: mempolicy: fix potential pte_unmap_unlock pte error
Date: Mon, 19 Oct 2020 13:32:24 +0200 [thread overview]
Message-ID: <20201019113224.GD27114@dhcp22.suse.cz> (raw)
In-Reply-To: <20201019105029.GA18953@linux>
On Mon 19-10-20 12:50:34, Oscar Salvador wrote:
> On Mon, Oct 19, 2020 at 03:48:53AM -0400, Shijie Luo wrote:
> > When flags in queue_pages_pte_range don't have MPOL_MF_MOVE or MPOL_MF_MOVE_ALL
> > bits, code breaks and passing origin pte - 1 to pte_unmap_unlock seems like
> > not a good idea.
>
> I think the above is already explained below?
Yes
> > queue_pages_pte_range can run in MPOL_MF_MOVE_ALL mode which doesn't migrate
> > misplaced pages but returns with EIO when encountering such a page. Since
> > commit a7f40cfe3b7a ("mm: mempolicy: make mbind() return -EIO when MPOL_MF_STRICT
> > is specified") and early break on the first pte in the range results in
> > pte_unmap_unlock on an underflow pte. This can lead to lockups later on when
> > somebody tries to lock the pte resp. page_table_lock again..
> >
> > Fixes: a7f40cfe3b7a ("mm: mempolicy: make mbind() return -EIO when
> > MPOL_MF_STRICT is specified")
Cc: stable
is due as well. There are even security concerns and I wouldn't be
surprised if this gained a CVE.
> > Signed-off-by: Shijie Luo <luoshijie1@huawei.com>
> > Signed-off-by: Miaohe Lin <linmiaohe@huawei.com>
>
> Anyway, LGTM:
>
> Reviewed-by: Oscar Salvador <osalvador@suse.de>
Acked-by: Michal Hocko <mhocko@suse.com>
--
Michal Hocko
SUSE Labs
prev parent reply other threads:[~2020-10-19 11:32 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-10-19 7:48 [PATCH] mm: mempolicy: fix potential pte_unmap_unlock pte error Shijie Luo
2020-10-19 10:50 ` Oscar Salvador
2020-10-19 11:32 ` Michal Hocko [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20201019113224.GD27114@dhcp22.suse.cz \
--to=mhocko@suse.com \
--cc=akpm@linux-foundation.org \
--cc=linfeilong@huawei.com \
--cc=linmiaohe@huawei.com \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-mm@kvack.org \
--cc=luoshijie1@huawei.com \
--cc=osalvador@suse.de \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.