From: Michal Hocko <mhocko@kernel.org> To: Anshuman Khandual <khandual@linux.vnet.ibm.com> Cc: Michael Ellerman <mpe@ellerman.id.au>, akpm@linux-foundation.org, mm-commits@vger.kernel.org, linux-kernel@vger.kernel.org, linux-mm@kvack.org, linux-fsdevel@vger.kernel.org, linux-next@vger.kernel.org, sfr@canb.auug.org.au, broonie@kernel.org Subject: Re: ppc elf_map breakage with MAP_FIXED_NOREPLACE Date: Mon, 29 Jan 2018 14:22:35 +0100 [thread overview] Message-ID: <20180129132235.GE21609@dhcp22.suse.cz> (raw) In-Reply-To: <6db9b33d-fd46-c529-b357-3397926f0733@linux.vnet.ibm.com> On Mon 29-01-18 11:02:09, Anshuman Khandual wrote: > On 01/29/2018 08:17 AM, Anshuman Khandual wrote: > > On 01/26/2018 07:34 PM, Michal Hocko wrote: > >> On Fri 26-01-18 18:04:27, Anshuman Khandual wrote: > >> [...] > >>> I tried to instrument mmap_region() for a single instance of 'sed' > >>> binary and traced all it's VMA creation. But there is no trace when > >>> that 'anon' VMA got created which suddenly shows up during subsequent > >>> elf_map() call eventually failing it. Please note that the following > >>> VMA was never created through call into map_region() in the process > >>> which is strange. > >> > >> Could you share your debugging patch? > > > > Please find the debug patch at the end. > > > >> > >>> ================================================================= > >>> [ 9.076867] Details for VMA[3] c000001fce42b7c0 > >>> [ 9.076925] vma c000001fce42b7c0 start 0000000010030000 end 0000000010040000 > >>> next c000001fce42b580 prev c000001fce42b880 mm c000001fce40fa00 > >>> prot 8000000000000104 anon_vma (null) vm_ops (null) > >>> pgoff 1003 file (null) private_data (null) > >>> flags: 0x100073(read|write|mayread|maywrite|mayexec|account) > >>> ================================================================= > >> > >> Isn't this vdso or some other special mapping? It is not really an > >> anonymous vma. Please hook into __install_special_mapping > > > > Yeah, will do. Its not an anon mapping as it does not have a anon_vma > > structure ? > > Okay, this colliding VMA seems to be getting loaded from load_elf_binary() > function as well. > > [ 9.422410] vma c000001fceedbc40 start 0000000010030000 end 0000000010040000 > next c000001fceedbe80 prev c000001fceedb700 mm c000001fceea8200 > prot 8000000000000104 anon_vma (null) vm_ops (null) > pgoff 1003 file (null) private_data (null) > flags: 0x100073(read|write|mayread|maywrite|mayexec|account) > [ 9.422576] CPU: 46 PID: 7457 Comm: sed Not tainted 4.14.0-dirty #158 > [ 9.422610] Call Trace: > [ 9.422623] [c000001fdc4f79b0] [c000000000b17ac0] dump_stack+0xb0/0xf0 (unreliable) > [ 9.422670] [c000001fdc4f79f0] [c0000000002dafb8] do_brk_flags+0x2d8/0x440 > [ 9.422708] [c000001fdc4f7ac0] [c0000000002db3d0] vm_brk_flags+0x80/0x130 > [ 9.422747] [c000001fdc4f7b20] [c0000000003d23a4] set_brk+0x80/0xdc > [ 9.422785] [c000001fdc4f7b60] [c0000000003d1f24] load_elf_binary+0x1304/0x158c > [ 9.422830] [c000001fdc4f7c80] [c00000000035d3e0] search_binary_handler+0xd0/0x270 > [ 9.422881] [c000001fdc4f7d10] [c00000000035f338] do_execveat_common.isra.31+0x658/0x890 > [ 9.422926] [c000001fdc4f7df0] [c00000000035f980] SyS_execve+0x40/0x50 > [ 9.423588] [c000001fdc4f7e30] [c00000000000b220] system_call+0x58/0x6c > > which is getting hit after adding some more debug. Voila! So your binary simply overrides brk by elf segments. That sounds like the exactly the thing that the patch is supposed to protect from. Why this is the case I dunno. It is just clear that either brk or elf base are not put to the proper place. Something to get fixed. You are probably just lucky that brk allocations do not spil over to elf mappings. > @@ -2949,6 +2997,13 @@ static int do_brk_flags(unsigned long addr, unsigned long request, unsigned long > if (flags & VM_LOCKED) > mm->locked_vm += (len >> PAGE_SHIFT); > vma->vm_flags |= VM_SOFTDIRTY; > + > + if (!strcmp(current->comm, "sed")) { > + if (just_init && (mm_ptr == vma->vm_mm)) { > + dump_vma(vma); > + dump_stack(); > + } > + } > return 0; > } > > -- > To unsubscribe, send a message with 'unsubscribe linux-mm' in > the body to majordomo@kvack.org. For more info on Linux MM, > see: http://www.linux-mm.org/ . > Don't email: <a href=mailto:"dont@kvack.org"> email@kvack.org </a> -- Michal Hocko SUSE Labs
WARNING: multiple messages have this Message-ID (diff)
From: Michal Hocko <mhocko@kernel.org> To: Anshuman Khandual <khandual@linux.vnet.ibm.com> Cc: Michael Ellerman <mpe@ellerman.id.au>, akpm@linux-foundation.org, mm-commits@vger.kernel.org, linux-kernel@vger.kernel.org, linux-mm@kvack.org, linux-fsdevel@vger.kernel.org, linux-next@vger.kernel.org, sfr@canb.auug.org.au, broonie@kernel.org Subject: Re: ppc elf_map breakage with MAP_FIXED_NOREPLACE Date: Mon, 29 Jan 2018 14:22:35 +0100 [thread overview] Message-ID: <20180129132235.GE21609@dhcp22.suse.cz> (raw) In-Reply-To: <6db9b33d-fd46-c529-b357-3397926f0733@linux.vnet.ibm.com> On Mon 29-01-18 11:02:09, Anshuman Khandual wrote: > On 01/29/2018 08:17 AM, Anshuman Khandual wrote: > > On 01/26/2018 07:34 PM, Michal Hocko wrote: > >> On Fri 26-01-18 18:04:27, Anshuman Khandual wrote: > >> [...] > >>> I tried to instrument mmap_region() for a single instance of 'sed' > >>> binary and traced all it's VMA creation. But there is no trace when > >>> that 'anon' VMA got created which suddenly shows up during subsequent > >>> elf_map() call eventually failing it. Please note that the following > >>> VMA was never created through call into map_region() in the process > >>> which is strange. > >> > >> Could you share your debugging patch? > > > > Please find the debug patch at the end. > > > >> > >>> ================================================================= > >>> [ 9.076867] Details for VMA[3] c000001fce42b7c0 > >>> [ 9.076925] vma c000001fce42b7c0 start 0000000010030000 end 0000000010040000 > >>> next c000001fce42b580 prev c000001fce42b880 mm c000001fce40fa00 > >>> prot 8000000000000104 anon_vma (null) vm_ops (null) > >>> pgoff 1003 file (null) private_data (null) > >>> flags: 0x100073(read|write|mayread|maywrite|mayexec|account) > >>> ================================================================= > >> > >> Isn't this vdso or some other special mapping? It is not really an > >> anonymous vma. Please hook into __install_special_mapping > > > > Yeah, will do. Its not an anon mapping as it does not have a anon_vma > > structure ? > > Okay, this colliding VMA seems to be getting loaded from load_elf_binary() > function as well. > > [ 9.422410] vma c000001fceedbc40 start 0000000010030000 end 0000000010040000 > next c000001fceedbe80 prev c000001fceedb700 mm c000001fceea8200 > prot 8000000000000104 anon_vma (null) vm_ops (null) > pgoff 1003 file (null) private_data (null) > flags: 0x100073(read|write|mayread|maywrite|mayexec|account) > [ 9.422576] CPU: 46 PID: 7457 Comm: sed Not tainted 4.14.0-dirty #158 > [ 9.422610] Call Trace: > [ 9.422623] [c000001fdc4f79b0] [c000000000b17ac0] dump_stack+0xb0/0xf0 (unreliable) > [ 9.422670] [c000001fdc4f79f0] [c0000000002dafb8] do_brk_flags+0x2d8/0x440 > [ 9.422708] [c000001fdc4f7ac0] [c0000000002db3d0] vm_brk_flags+0x80/0x130 > [ 9.422747] [c000001fdc4f7b20] [c0000000003d23a4] set_brk+0x80/0xdc > [ 9.422785] [c000001fdc4f7b60] [c0000000003d1f24] load_elf_binary+0x1304/0x158c > [ 9.422830] [c000001fdc4f7c80] [c00000000035d3e0] search_binary_handler+0xd0/0x270 > [ 9.422881] [c000001fdc4f7d10] [c00000000035f338] do_execveat_common.isra.31+0x658/0x890 > [ 9.422926] [c000001fdc4f7df0] [c00000000035f980] SyS_execve+0x40/0x50 > [ 9.423588] [c000001fdc4f7e30] [c00000000000b220] system_call+0x58/0x6c > > which is getting hit after adding some more debug. Voila! So your binary simply overrides brk by elf segments. That sounds like the exactly the thing that the patch is supposed to protect from. Why this is the case I dunno. It is just clear that either brk or elf base are not put to the proper place. Something to get fixed. You are probably just lucky that brk allocations do not spil over to elf mappings. > @@ -2949,6 +2997,13 @@ static int do_brk_flags(unsigned long addr, unsigned long request, unsigned long > if (flags & VM_LOCKED) > mm->locked_vm += (len >> PAGE_SHIFT); > vma->vm_flags |= VM_SOFTDIRTY; > + > + if (!strcmp(current->comm, "sed")) { > + if (just_init && (mm_ptr == vma->vm_mm)) { > + dump_vma(vma); > + dump_stack(); > + } > + } > return 0; > } > > -- > To unsubscribe, send a message with 'unsubscribe linux-mm' in > the body to majordomo@kvack.org. For more info on Linux MM, > see: http://www.linux-mm.org/ . > Don't email: <a href=mailto:"dont@kvack.org"> email@kvack.org </a> -- Michal Hocko SUSE Labs -- To unsubscribe, send a message with 'unsubscribe linux-mm' in the body to majordomo@kvack.org. For more info on Linux MM, see: http://www.linux-mm.org/ . Don't email: <a href=mailto:"dont@kvack.org"> email@kvack.org </a>
next prev parent reply other threads:[~2018-01-29 13:22 UTC|newest] Thread overview: 82+ messages / expand[flat|nested] mbox.gz Atom feed top 2018-01-05 0:20 mmotm 2018-01-04-16-19 uploaded akpm 2018-01-05 0:20 ` akpm 2018-01-05 6:43 ` Anshuman Khandual 2018-01-05 6:43 ` Anshuman Khandual 2018-01-05 8:46 ` Michal Hocko 2018-01-05 8:46 ` Michal Hocko 2018-01-07 6:49 ` Anshuman Khandual 2018-01-07 6:49 ` Anshuman Khandual 2018-01-07 9:02 ` ppc elf_map breakage with MAP_FIXED_NOREPLACE (was: Re: mmotm 2018-01-04-16-19 uploaded) Michal Hocko 2018-01-07 9:02 ` Michal Hocko 2018-01-07 11:26 ` Michael Ellerman 2018-01-07 11:26 ` Michael Ellerman 2018-01-08 3:02 ` ppc elf_map breakage with MAP_FIXED_NOREPLACE Anshuman Khandual 2018-01-08 3:02 ` Anshuman Khandual 2018-01-08 22:12 ` Michael Ellerman 2018-01-08 22:12 ` Michael Ellerman 2018-01-08 22:12 ` Michael Ellerman 2018-01-09 11:48 ` Anshuman Khandual 2018-01-09 11:48 ` Anshuman Khandual 2018-01-09 16:13 ` Michal Hocko 2018-01-09 16:13 ` Michal Hocko 2018-01-11 10:08 ` Anshuman Khandual 2018-01-11 10:08 ` Anshuman Khandual 2018-01-17 8:07 ` Michal Hocko 2018-01-17 8:07 ` Michal Hocko 2018-01-23 11:25 ` Anshuman Khandual 2018-01-23 11:25 ` Anshuman Khandual 2018-01-23 12:45 ` Michal Hocko 2018-01-23 12:45 ` Michal Hocko 2018-01-23 15:58 ` Anshuman Khandual 2018-01-23 15:58 ` Anshuman Khandual 2018-01-23 16:06 ` Michal Hocko 2018-01-23 16:06 ` Michal Hocko 2018-01-24 5:09 ` Anshuman Khandual 2018-01-24 5:09 ` Anshuman Khandual 2018-01-24 9:05 ` Michal Hocko 2018-01-24 9:05 ` Michal Hocko 2018-01-26 12:34 ` Anshuman Khandual 2018-01-26 12:34 ` Anshuman Khandual 2018-01-26 14:04 ` Michal Hocko 2018-01-26 14:04 ` Michal Hocko 2018-01-29 2:47 ` Anshuman Khandual 2018-01-29 2:47 ` Anshuman Khandual 2018-01-29 5:32 ` Anshuman Khandual 2018-01-29 5:32 ` Anshuman Khandual 2018-01-29 13:22 ` Michal Hocko [this message] 2018-01-29 13:22 ` Michal Hocko 2018-01-30 3:35 ` Michael Ellerman 2018-01-30 3:35 ` Michael Ellerman 2018-01-30 9:42 ` Michal Hocko 2018-01-30 9:42 ` Michal Hocko 2018-01-31 5:05 ` Anshuman Khandual 2018-01-31 5:05 ` Anshuman Khandual 2018-01-31 13:19 ` Michal Hocko 2018-01-31 13:19 ` Michal Hocko 2018-02-01 3:13 ` Anshuman Khandual 2018-02-01 3:13 ` Anshuman Khandual 2018-02-01 13:10 ` Michal Hocko 2018-02-01 13:10 ` Michal Hocko 2018-02-01 13:40 ` Michal Hocko 2018-02-01 13:40 ` Michal Hocko 2018-02-01 20:55 ` Kees Cook 2018-02-01 20:55 ` Kees Cook 2018-02-13 10:04 ` [RFC PATCH] elf: enforce MAP_FIXED on overlaying elf segments (was: Re: ppc elf_map breakage with MAP_FIXED_NOREPLACE) Michal Hocko 2018-02-13 10:04 ` Michal Hocko 2018-02-13 10:04 ` Michal Hocko 2018-02-14 16:30 ` Khalid Aziz 2018-02-14 16:30 ` Khalid Aziz 2018-02-01 13:48 ` ppc elf_map breakage with MAP_FIXED_NOREPLACE Michal Hocko 2018-02-01 13:48 ` Michal Hocko 2018-02-01 21:06 ` Kees Cook 2018-02-01 21:06 ` Kees Cook 2018-02-12 14:48 ` Michal Hocko 2018-02-12 14:48 ` Michal Hocko 2018-02-13 1:02 ` Anshuman Khandual 2018-02-13 1:02 ` Anshuman Khandual 2018-02-13 6:49 ` Anshuman Khandual 2018-02-13 6:49 ` Anshuman Khandual 2018-02-13 10:00 ` Michal Hocko 2018-02-13 10:00 ` Michal Hocko 2018-01-05 12:14 ` mmotm 2018-01-04-16-19 uploaded Michal Hocko 2018-01-05 12:14 ` Michal Hocko
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=20180129132235.GE21609@dhcp22.suse.cz \ --to=mhocko@kernel.org \ --cc=akpm@linux-foundation.org \ --cc=broonie@kernel.org \ --cc=khandual@linux.vnet.ibm.com \ --cc=linux-fsdevel@vger.kernel.org \ --cc=linux-kernel@vger.kernel.org \ --cc=linux-mm@kvack.org \ --cc=linux-next@vger.kernel.org \ --cc=mm-commits@vger.kernel.org \ --cc=mpe@ellerman.id.au \ --cc=sfr@canb.auug.org.au \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: linkBe sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.