From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 45B6FC433EF for ; Fri, 8 Oct 2021 16:20:57 +0000 (UTC) Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by mail.kernel.org (Postfix) with ESMTP id D9DCF61029 for ; Fri, 8 Oct 2021 16:20:56 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.4.1 mail.kernel.org D9DCF61029 Authentication-Results: mail.kernel.org; dmarc=fail (p=reject dis=none) header.from=google.com Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=kvack.org Received: by kanga.kvack.org (Postfix) id 825A76B0071; Fri, 8 Oct 2021 12:20:56 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id 7D20A6B0072; Fri, 8 Oct 2021 12:20:56 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 6C2226B0073; Fri, 8 Oct 2021 12:20:56 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from forelay.hostedemail.com (smtprelay0148.hostedemail.com [216.40.44.148]) by kanga.kvack.org (Postfix) with ESMTP id 5F1436B0071 for ; Fri, 8 Oct 2021 12:20:56 -0400 (EDT) Received: from smtpin35.hostedemail.com (10.5.19.251.rfc1918.com [10.5.19.251]) by forelay02.hostedemail.com (Postfix) with ESMTP id 0BDA13A8C6 for ; Fri, 8 Oct 2021 16:20:56 +0000 (UTC) X-FDA: 78673784112.35.1BF60B7 Received: from mail-yb1-f169.google.com (mail-yb1-f169.google.com [209.85.219.169]) by imf01.hostedemail.com (Postfix) with ESMTP id A057F5076928 for ; Fri, 8 Oct 2021 16:20:55 +0000 (UTC) Received: by mail-yb1-f169.google.com with SMTP id g6so22300825ybb.3 for ; Fri, 08 Oct 2021 09:20:55 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20210112; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=WbpqBG1YQa7jgZ7Xg/LUvMqcMj/e4xUqlnDR3VFNVxQ=; b=UIkASagcUJKOLIsR4xgyAUUqbC8307RLetJG+kurS2qk8UIUG8qxAj/RqBj5x/lUGy EBwiBFOu3R0gLdWerUPc00zraXwvnv1/pR/2pgXvs/A7yjJ1y/qDMdxE06yqNlFYnf0d 5hL8CAd/Sjc7uj61Ea+CE1w4VxqluoMiz1y3BiCH0Il+yVBHxbjpqHxDMxpI2ItFRepu GYgN7gjA3WbkA0WdI1Gd3RP5c59+MuRFfDD1jUl0DLZz/3SX79EcU9ig0mI/x7m5lKe0 w0NqhcOQIi5KBbHBE/mamGc9dP0Gc75NOpKZAA/KEXly6XyLNeRqW1GRrX2XlwJ1sKz2 DD4w== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=WbpqBG1YQa7jgZ7Xg/LUvMqcMj/e4xUqlnDR3VFNVxQ=; b=rwkRhYK0KTJmKHQtQw9sJDfTiDK8fITMzxT/t+qdhF8cA7og/TuISpB2YkAirM7rdF p0aNeJ/+7Ryph1D96/02dyikx4J1UfLYKo46bUfnuPymscKzsmLOiYIQaxgut+NOjUdy B4xgpvCrJssWw5AGh7lmx1S/+82FRNw1g5JKgHjtg/oUO0maN1ia5R5ZGIlot2cM6CwF BVup5pWcXQTstebUpzH8W3ODbtYJucQt+7Bs1piHoQE17I5b/IuiOdqb6gOIAca8g1Nr ZGHMDMrrrCJc35g4InCJ4CdYoa94dlxEEqnyPsmm7SGwOjarKDboJbVEIr/gr3Q6LSf/ h+kg== X-Gm-Message-State: AOAM531aSfE/hmXwXz6UdoS3G59//lNOGv1vkiz0xEChMcsXRJPWdouK hGuiLJ80xrSQM/9YAaA95aH4+BeqGponG4FSPws5jsb7kdhB8w== X-Google-Smtp-Source: ABdhPJznc865GfL2wZPpFhMF0eUz9hIq2Bz5wGehdboZMEWXlw8O+EI2ITp2goIZnicRuwIRBsS5iolIcrrkyz/QxQ0= X-Received: by 2002:a25:7415:: with SMTP id p21mr4531647ybc.78.1633710054416; Fri, 08 Oct 2021 09:20:54 -0700 (PDT) MIME-Version: 1.0 References: <20211001174947.135123-1-eric.dumazet@gmail.com> In-Reply-To: From: Eric Dumazet Date: Fri, 8 Oct 2021 09:20:43 -0700 Message-ID: Subject: Re: [PATCH] mm/mempolicy: do not allow illegal MPOL_F_NUMA_BALANCING | MPOL_LOCAL in mbind() To: Dongliang Mu Cc: Eric Dumazet , Andrew Morton , linux-kernel , linux-mm , syzbot , "Huang, Ying" , Mel Gorman Content-Type: text/plain; charset="UTF-8" X-Rspamd-Server: rspam02 X-Rspamd-Queue-Id: A057F5076928 X-Stat-Signature: d6nk97ducgpc4egwumnd144sqxwwre89 Authentication-Results: imf01.hostedemail.com; dkim=pass header.d=google.com header.s=20210112 header.b=UIkASagc; spf=pass (imf01.hostedemail.com: domain of edumazet@google.com designates 209.85.219.169 as permitted sender) smtp.mailfrom=edumazet@google.com; dmarc=pass (policy=reject) header.from=google.com X-HE-Tag: 1633710055-622838 X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: On Thu, Oct 7, 2021 at 10:26 PM Dongliang Mu wrote: > > On Sat, Oct 2, 2021 at 1:49 AM Eric Dumazet wrote: > > > > From: Eric Dumazet > > > > syzbot reported access to unitialized memory in mbind() [1] > > > > Issue came with commit bda420b98505 ("numa balancing: migrate on > > fault among multiple bound nodes") > > > > This commit added a new bit in MPOL_MODE_FLAGS, but only checked > > valid combination (MPOL_F_NUMA_BALANCING can only be used with MPOL_BIND) > > in do_set_mempolicy() > > > > This patch moves the check in sanitize_mpol_flags() so that it > > is also used by mbind() > > > > [1] > > BUG: KMSAN: uninit-value in __mpol_equal+0x567/0x590 mm/mempolicy.c:2260 > > __mpol_equal+0x567/0x590 mm/mempolicy.c:2260 > > mpol_equal include/linux/mempolicy.h:105 [inline] > > vma_merge+0x4a1/0x1e60 mm/mmap.c:1190 > > mbind_range+0xcc8/0x1e80 mm/mempolicy.c:811 > > do_mbind+0xf42/0x15f0 mm/mempolicy.c:1333 > > kernel_mbind mm/mempolicy.c:1483 [inline] > > __do_sys_mbind mm/mempolicy.c:1490 [inline] > > __se_sys_mbind+0x437/0xb80 mm/mempolicy.c:1486 > > __x64_sys_mbind+0x19d/0x200 mm/mempolicy.c:1486 > > do_syscall_x64 arch/x86/entry/common.c:51 [inline] > > do_syscall_64+0x54/0xd0 arch/x86/entry/common.c:82 > > entry_SYSCALL_64_after_hwframe+0x44/0xae > > > > Uninit was created at: > > slab_alloc_node mm/slub.c:3221 [inline] > > slab_alloc mm/slub.c:3230 [inline] > > kmem_cache_alloc+0x751/0xff0 mm/slub.c:3235 > > mpol_new mm/mempolicy.c:293 [inline] > > do_mbind+0x912/0x15f0 mm/mempolicy.c:1289 > > kernel_mbind mm/mempolicy.c:1483 [inline] > > __do_sys_mbind mm/mempolicy.c:1490 [inline] > > __se_sys_mbind+0x437/0xb80 mm/mempolicy.c:1486 > > __x64_sys_mbind+0x19d/0x200 mm/mempolicy.c:1486 > > do_syscall_x64 arch/x86/entry/common.c:51 [inline] > > do_syscall_64+0x54/0xd0 arch/x86/entry/common.c:82 > > entry_SYSCALL_64_after_hwframe+0x44/0xae > > ===================================================== > > Kernel panic - not syncing: panic_on_kmsan set ... > > CPU: 0 PID: 15049 Comm: syz-executor.0 Tainted: G B 5.15.0-rc2-syzkaller #0 > > Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 > > Call Trace: > > __dump_stack lib/dump_stack.c:88 [inline] > > dump_stack_lvl+0x1ff/0x28e lib/dump_stack.c:106 > > dump_stack+0x25/0x28 lib/dump_stack.c:113 > > panic+0x44f/0xdeb kernel/panic.c:232 > > kmsan_report+0x2ee/0x300 mm/kmsan/report.c:186 > > __msan_warning+0xd7/0x150 mm/kmsan/instrumentation.c:208 > > __mpol_equal+0x567/0x590 mm/mempolicy.c:2260 > > mpol_equal include/linux/mempolicy.h:105 [inline] > > vma_merge+0x4a1/0x1e60 mm/mmap.c:1190 > > mbind_range+0xcc8/0x1e80 mm/mempolicy.c:811 > > do_mbind+0xf42/0x15f0 mm/mempolicy.c:1333 > > kernel_mbind mm/mempolicy.c:1483 [inline] > > __do_sys_mbind mm/mempolicy.c:1490 [inline] > > __se_sys_mbind+0x437/0xb80 mm/mempolicy.c:1486 > > __x64_sys_mbind+0x19d/0x200 mm/mempolicy.c:1486 > > do_syscall_x64 arch/x86/entry/common.c:51 [inline] > > do_syscall_64+0x54/0xd0 arch/x86/entry/common.c:82 > > entry_SYSCALL_64_after_hwframe+0x44/0xae > > RIP: 0033:0x7f4a41b2c709 > > Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 > > RSP: 002b:00007f4a3f0a3188 EFLAGS: 00000246 ORIG_RAX: 00000000000000ed > > RAX: ffffffffffffffda RBX: 00007f4a41c30f60 RCX: 00007f4a41b2c709 > > RDX: 0000000000002001 RSI: 0000000000c00007 RDI: 0000000020012000 > > RBP: 00007f4a41b86cb4 R08: 0000000000000000 R09: 0000010000000002 > > R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 > > R13: 00007f4a42164b2f R14: 00007f4a3f0a3300 R15: 0000000000022000 > > > > Hi Eric, > > this crash seems like the bug report [1] on Syzbot dashboard. > > [1] https://syzkaller.appspot.com/bug?id=028833194204bb15c2c43d822b8f7401360d57f5 > > If yes, maybe you can push a patch testing request. > No, it was a different syzbot report, currently held in our queue. (Andrew Morton has access to our internal bug, I CC him (b/201266830)) I can release it, at the expense of more noise to various mailing lists, but really the bug is trivial.