All of lore.kernel.org
 help / color / mirror / Atom feed
From: Michal Hocko <mhocko@kernel.org>
To: Andrew Morton <akpm@linux-foundation.org>
Cc: Johannes Weiner <hannes@cmpxchg.org>,
	syzbot+8a5de3cce7cdc70e9ebe@syzkaller.appspotmail.com,
	Andrey Ryabinin <aryabinin@virtuozzo.com>,
	LKML <linux-kernel@vger.kernel.org>, <linux-mm@kvack.org>,
	Michal Hocko <mhocko@suse.com>
Subject: [PATCH] memcg: fix per_node_info cleanup
Date: Fri,  6 Apr 2018 12:09:06 +0200	[thread overview]
Message-ID: <20180406100906.17790-1-mhocko@kernel.org> (raw)

From: Michal Hocko <mhocko@suse.com>

syzbot has triggered a NULL ptr dereference when allocation fault
injection enforces a failure and alloc_mem_cgroup_per_node_info
initializes memcg->nodeinfo only half way through. __mem_cgroup_free
still tries to free all per-node data and dereferences pn->lruvec_stat_cpu
unconditioanlly even if the specific per-node data hasn't been
initialized.

The bug is quite unlikely to hit because small allocations do not fail
and we would need quite some numa nodes to make struct mem_cgroup_per_node
large enough to cross the costly order.

Reported-by: syzbot+8a5de3cce7cdc70e9ebe@syzkaller.appspotmail.com
Fixes: 00f3ca2c2d66 ("mm: memcontrol: per-lruvec stats infrastructure")
Reviewed-by: Andrey Ryabinin <aryabinin@virtuozzo.com>
Signed-off-by: Michal Hocko <mhocko@suse.com>
---

Hi!
Previously posted [1] based on the syzkaller report [2]. I haven't heard
back from syzkaller but this seems like the right fix. Andrew could you
add this to the pile?

[1] http://lkml.kernel.org/r/20180403105048.GK5501@dhcp22.suse.cz
[2] http://lkml.kernel.org/r/001a113fe4c0a623b10568bb75ea@google.com

 mm/memcontrol.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/mm/memcontrol.c b/mm/memcontrol.c
index 7667ea9daf4f..8c2ed1c2b72c 100644
--- a/mm/memcontrol.c
+++ b/mm/memcontrol.c
@@ -4340,6 +4340,9 @@ static void free_mem_cgroup_per_node_info(struct mem_cgroup *memcg, int node)
 {
 	struct mem_cgroup_per_node *pn = memcg->nodeinfo[node];
 
+	if (!pn)
+		return;
+
 	free_percpu(pn->lruvec_stat_cpu);
 	kfree(pn);
 }
-- 
2.16.3

WARNING: multiple messages have this Message-ID (diff)
From: Michal Hocko <mhocko@kernel.org>
To: Andrew Morton <akpm@linux-foundation.org>
Cc: Johannes Weiner <hannes@cmpxchg.org>,
	syzbot+8a5de3cce7cdc70e9ebe@syzkaller.appspotmail.com,
	Andrey Ryabinin <aryabinin@virtuozzo.com>,
	LKML <linux-kernel@vger.kernel.org>,
	linux-mm@kvack.org, Michal Hocko <mhocko@suse.com>
Subject: [PATCH] memcg: fix per_node_info cleanup
Date: Fri,  6 Apr 2018 12:09:06 +0200	[thread overview]
Message-ID: <20180406100906.17790-1-mhocko@kernel.org> (raw)

From: Michal Hocko <mhocko@suse.com>

syzbot has triggered a NULL ptr dereference when allocation fault
injection enforces a failure and alloc_mem_cgroup_per_node_info
initializes memcg->nodeinfo only half way through. __mem_cgroup_free
still tries to free all per-node data and dereferences pn->lruvec_stat_cpu
unconditioanlly even if the specific per-node data hasn't been
initialized.

The bug is quite unlikely to hit because small allocations do not fail
and we would need quite some numa nodes to make struct mem_cgroup_per_node
large enough to cross the costly order.

Reported-by: syzbot+8a5de3cce7cdc70e9ebe@syzkaller.appspotmail.com
Fixes: 00f3ca2c2d66 ("mm: memcontrol: per-lruvec stats infrastructure")
Reviewed-by: Andrey Ryabinin <aryabinin@virtuozzo.com>
Signed-off-by: Michal Hocko <mhocko@suse.com>
---

Hi!
Previously posted [1] based on the syzkaller report [2]. I haven't heard
back from syzkaller but this seems like the right fix. Andrew could you
add this to the pile?

[1] http://lkml.kernel.org/r/20180403105048.GK5501@dhcp22.suse.cz
[2] http://lkml.kernel.org/r/001a113fe4c0a623b10568bb75ea@google.com

 mm/memcontrol.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/mm/memcontrol.c b/mm/memcontrol.c
index 7667ea9daf4f..8c2ed1c2b72c 100644
--- a/mm/memcontrol.c
+++ b/mm/memcontrol.c
@@ -4340,6 +4340,9 @@ static void free_mem_cgroup_per_node_info(struct mem_cgroup *memcg, int node)
 {
 	struct mem_cgroup_per_node *pn = memcg->nodeinfo[node];
 
+	if (!pn)
+		return;
+
 	free_percpu(pn->lruvec_stat_cpu);
 	kfree(pn);
 }
-- 
2.16.3

             reply	other threads:[~2018-04-06 10:09 UTC|newest]

Thread overview: 6+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2018-04-06 10:09 Michal Hocko [this message]
2018-04-06 10:09 ` [PATCH] memcg: fix per_node_info cleanup Michal Hocko
2018-04-10 13:50 ` Sasha Levin
2018-04-10 14:01   ` Michal Hocko
2018-04-10 17:55     ` Sasha Levin
2018-04-10 20:37       ` Michal Hocko

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20180406100906.17790-1-mhocko@kernel.org \
    --to=mhocko@kernel.org \
    --cc=akpm@linux-foundation.org \
    --cc=aryabinin@virtuozzo.com \
    --cc=hannes@cmpxchg.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=linux-mm@kvack.org \
    --cc=mhocko@suse.com \
    --cc=syzbot+8a5de3cce7cdc70e9ebe@syzkaller.appspotmail.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.