From: "Li Xinhai" <lixinhai.lxh@gmail.com>
To: akpm <akpm@linux-foundation.org>
Cc: "linux-mm@kvack.org" <linux-mm@kvack.org>
Subject: Re: [PATCH 0/3] mm: Fix misuse of parent anon_vma in dup_mmap path
Date: Mon, 10 Feb 2020 10:15:53 +0800 [thread overview]
Message-ID: <2020021010155155113445@gmail.com> (raw)
In-Reply-To: 20200209165204.73197330d083095e0ad18d6c@linux-foundation.org
On 2020-02-10 at 08:52 Andrew Morton wrote:
>On Sat, 8 Feb 2020 08:35:25 +0000 Li Xinhai <lixinhai.lxh@gmail.com> wrote:
>
>> This patchset fix the misuse of parenet anon_vma, which mainly caused by
>> child vma's vm_next and vm_prev are left same as its parent after
>> duplicate vma. Finally, code reached parent vma's neighbor by referring
>> pointer of child vma and executed wrong logic.
>>
>> The first two patches fix relevant issues, and the third patch sets vm_next
>> and vm_prev to NULL when duplicate vma to prevent potential misuse in future.
>
>What are the runtime effects of this bug? How is the bug triggered?
Effects of the first one is that causes ramp code to check both parent and
child's page table, although a page couldn't be mapped by both parent
and child, because child vma has WIPEONFORK so all pages mapped by child
are 'new' and not relevant to parent.
Effects of the second one is that the relationship of anon_vma of parent and
child are totally convoluted. It would cause 'son', 'grandson', ..., etc, to share
'parent' anon_vma, which disobey the design rule of reusing anon_vma (the
rule to be followed is that reusing should among vma of same process, and
vma should not gone through fork).
So, both issues should cause unnecessary rmap walking and have unexpected
complexity.
These two issues would not be directly visible, I used debugging code to check
the anon_vma pointers of parent and child when inspecting the suspicious
implementation of issue #2, then find the problem.
next prev parent reply other threads:[~2020-02-10 2:15 UTC|newest]
Thread overview: 16+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-02-08 8:35 [PATCH 0/3] mm: Fix misuse of parent anon_vma in dup_mmap path Li Xinhai
2020-02-08 8:35 ` [PATCH 1/3] mm: don't prepare anon_vma if vma has VM_WIPEONFORK Li Xinhai
2020-02-08 8:53 ` Li Xinhai
2020-04-02 13:45 ` Kirill A. Shutemov
2020-02-08 8:35 ` [PATCH 2/3] Revert "mm/rmap.c: reuse mergeable anon_vma as parent when fork" Li Xinhai
2020-04-02 13:59 ` Kirill A. Shutemov
2020-04-03 3:08 ` Li Xinhai
2020-04-05 1:26 ` Li Xinhai
2020-02-08 8:35 ` [PATCH 3/3] mm: set vm_next and vm_prev to NULL in vm_area_dup() Li Xinhai
2020-04-02 14:07 ` Kirill A. Shutemov
2020-02-10 0:52 ` [PATCH 0/3] mm: Fix misuse of parent anon_vma in dup_mmap path Andrew Morton
2020-02-10 2:15 ` Li Xinhai [this message]
2020-04-20 12:06 ` Michal Hocko
2020-04-21 3:53 ` Li Xinhai
2020-04-21 7:26 ` Michal Hocko
2020-04-02 1:25 ` Andrew Morton
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=2020021010155155113445@gmail.com \
--to=lixinhai.lxh@gmail.com \
--cc=akpm@linux-foundation.org \
--cc=linux-mm@kvack.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).