From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
stable@vger.kernel.org,
Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>,
Aliaksei Karaliou <akaraliou.dev@gmail.com>,
syzbot <syzkaller@googlegroups.com>,
Glauber Costa <glauber@scylladb.com>,
Al Viro <viro@zeniv.linux.org.uk>
Subject: [PATCH 3.18 18/58] mm,vmscan: Make unregister_shrinker() no-op if register_shrinker() failed.
Date: Fri, 23 Feb 2018 19:26:17 +0100 [thread overview]
Message-ID: <20180223170209.676970355@linuxfoundation.org> (raw)
In-Reply-To: <20180223170206.724655284@linuxfoundation.org>
3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
commit bb422a738f6566f7439cd347d54e321e4fe92a9f upstream.
Syzbot caught an oops at unregister_shrinker() because combination of
commit 1d3d4437eae1bb29 ("vmscan: per-node deferred work") and fault
injection made register_shrinker() fail and the caller of
register_shrinker() did not check for failure.
----------
[ 554.881422] FAULT_INJECTION: forcing a failure.
[ 554.881422] name failslab, interval 1, probability 0, space 0, times 0
[ 554.881438] CPU: 1 PID: 13231 Comm: syz-executor1 Not tainted 4.14.0-rc8+ #82
[ 554.881443] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[ 554.881445] Call Trace:
[ 554.881459] dump_stack+0x194/0x257
[ 554.881474] ? arch_local_irq_restore+0x53/0x53
[ 554.881486] ? find_held_lock+0x35/0x1d0
[ 554.881507] should_fail+0x8c0/0xa40
[ 554.881522] ? fault_create_debugfs_attr+0x1f0/0x1f0
[ 554.881537] ? check_noncircular+0x20/0x20
[ 554.881546] ? find_next_zero_bit+0x2c/0x40
[ 554.881560] ? ida_get_new_above+0x421/0x9d0
[ 554.881577] ? find_held_lock+0x35/0x1d0
[ 554.881594] ? __lock_is_held+0xb6/0x140
[ 554.881628] ? check_same_owner+0x320/0x320
[ 554.881634] ? lock_downgrade+0x990/0x990
[ 554.881649] ? find_held_lock+0x35/0x1d0
[ 554.881672] should_failslab+0xec/0x120
[ 554.881684] __kmalloc+0x63/0x760
[ 554.881692] ? lock_downgrade+0x990/0x990
[ 554.881712] ? register_shrinker+0x10e/0x2d0
[ 554.881721] ? trace_event_raw_event_module_request+0x320/0x320
[ 554.881737] register_shrinker+0x10e/0x2d0
[ 554.881747] ? prepare_kswapd_sleep+0x1f0/0x1f0
[ 554.881755] ? _down_write_nest_lock+0x120/0x120
[ 554.881765] ? memcpy+0x45/0x50
[ 554.881785] sget_userns+0xbcd/0xe20
(...snipped...)
[ 554.898693] kasan: CONFIG_KASAN_INLINE enabled
[ 554.898724] kasan: GPF could be caused by NULL-ptr deref or user memory access
[ 554.898732] general protection fault: 0000 [#1] SMP KASAN
[ 554.898737] Dumping ftrace buffer:
[ 554.898741] (ftrace buffer empty)
[ 554.898743] Modules linked in:
[ 554.898752] CPU: 1 PID: 13231 Comm: syz-executor1 Not tainted 4.14.0-rc8+ #82
[ 554.898755] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[ 554.898760] task: ffff8801d1dbe5c0 task.stack: ffff8801c9e38000
[ 554.898772] RIP: 0010:__list_del_entry_valid+0x7e/0x150
[ 554.898775] RSP: 0018:ffff8801c9e3f108 EFLAGS: 00010246
[ 554.898780] RAX: dffffc0000000000 RBX: 0000000000000000 RCX: 0000000000000000
[ 554.898784] RDX: 0000000000000000 RSI: ffff8801c53c6f98 RDI: ffff8801c53c6fa0
[ 554.898788] RBP: ffff8801c9e3f120 R08: 1ffff100393c7d55 R09: 0000000000000004
[ 554.898791] R10: ffff8801c9e3ef70 R11: 0000000000000000 R12: 0000000000000000
[ 554.898795] R13: dffffc0000000000 R14: 1ffff100393c7e45 R15: ffff8801c53c6f98
[ 554.898800] FS: 0000000000000000(0000) GS:ffff8801db300000(0000) knlGS:0000000000000000
[ 554.898804] CS: 0010 DS: 002b ES: 002b CR0: 0000000080050033
[ 554.898807] CR2: 00000000dbc23000 CR3: 00000001c7269000 CR4: 00000000001406e0
[ 554.898813] DR0: 0000000020000000 DR1: 0000000020000000 DR2: 0000000000000000
[ 554.898816] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000600
[ 554.898818] Call Trace:
[ 554.898828] unregister_shrinker+0x79/0x300
[ 554.898837] ? perf_trace_mm_vmscan_writepage+0x750/0x750
[ 554.898844] ? down_write+0x87/0x120
[ 554.898851] ? deactivate_super+0x139/0x1b0
[ 554.898857] ? down_read+0x150/0x150
[ 554.898864] ? check_same_owner+0x320/0x320
[ 554.898875] deactivate_locked_super+0x64/0xd0
[ 554.898883] deactivate_super+0x141/0x1b0
----------
Since allowing register_shrinker() callers to call unregister_shrinker()
when register_shrinker() failed can simplify error recovery path, this
patch makes unregister_shrinker() no-op when register_shrinker() failed.
Also, reset shrinker->nr_deferred in case unregister_shrinker() was
by error called twice.
Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Signed-off-by: Aliaksei Karaliou <akaraliou.dev@gmail.com>
Reported-by: syzbot <syzkaller@googlegroups.com>
Cc: Glauber Costa <glauber@scylladb.com>
Cc: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
mm/vmscan.c | 3 +++
1 file changed, 3 insertions(+)
--- a/mm/vmscan.c
+++ b/mm/vmscan.c
@@ -220,10 +220,13 @@ EXPORT_SYMBOL(register_shrinker);
*/
void unregister_shrinker(struct shrinker *shrinker)
{
+ if (!shrinker->nr_deferred)
+ return;
down_write(&shrinker_rwsem);
list_del(&shrinker->list);
up_write(&shrinker_rwsem);
kfree(shrinker->nr_deferred);
+ shrinker->nr_deferred = NULL;
}
EXPORT_SYMBOL(unregister_shrinker);
next prev parent reply other threads:[~2018-02-23 18:30 UTC|newest]
Thread overview: 64+ messages / expand[flat|nested] mbox.gz Atom feed top
2018-02-23 18:25 [PATCH 3.18 00/58] 3.18.96-stable review Greg Kroah-Hartman
2018-02-23 18:26 ` [PATCH 3.18 01/58] IB/mlx4: Fix incorrectly releasing steerable UD QPs when have only ETH ports Greg Kroah-Hartman
2018-02-23 18:26 ` [PATCH 3.18 02/58] PM / devfreq: Propagate error from devfreq_add_device() Greg Kroah-Hartman
2018-02-23 18:26 ` [PATCH 3.18 03/58] s390: fix handling of -1 in set{,fs}[gu]id16 syscalls Greg Kroah-Hartman
2018-02-23 18:26 ` [PATCH 3.18 04/58] arm: spear600: Add missing interrupt-parent of rtc Greg Kroah-Hartman
2018-02-23 18:26 ` [PATCH 3.18 05/58] arm: spear13xx: Fix dmas cells Greg Kroah-Hartman
2018-02-23 18:26 ` [PATCH 3.18 06/58] arm: spear13xx: Fix spics gpio controllers warning Greg Kroah-Hartman
2018-02-23 18:26 ` [PATCH 3.18 07/58] ALSA: seq: Fix regression by incorrect ioctl_mutex usages Greg Kroah-Hartman
2018-02-23 18:26 ` [PATCH 3.18 08/58] drm/radeon: adjust tested variable Greg Kroah-Hartman
2018-02-23 18:26 ` [PATCH 3.18 09/58] ext4: save error to disk in __ext4_grp_locked_error() Greg Kroah-Hartman
2018-02-23 18:26 ` [PATCH 3.18 10/58] ext4: correct documentation for grpid mount option Greg Kroah-Hartman
2018-02-23 18:26 ` [PATCH 3.18 11/58] video: fbdev: atmel_lcdfb: fix display-timings lookup Greg Kroah-Hartman
2018-02-23 18:26 ` [PATCH 3.18 12/58] console/dummy: leave .con_font_get set to NULL Greg Kroah-Hartman
2018-02-23 18:26 ` [PATCH 3.18 13/58] Btrfs: fix deadlock in run_delalloc_nocow Greg Kroah-Hartman
2018-02-23 18:26 ` [PATCH 3.18 14/58] Btrfs: fix crash due to not cleaning up tree log blocks dirty bits Greg Kroah-Hartman
2018-02-23 18:26 ` [PATCH 3.18 15/58] ALSA: seq: Fix racy pool initializations Greg Kroah-Hartman
2018-02-23 18:26 ` [PATCH 3.18 16/58] ARM: dts: s5pv210: add interrupt-parent for ohci Greg Kroah-Hartman
2018-02-23 18:26 ` [PATCH 3.18 17/58] media: r820t: fix r820t_write_reg for KASAN Greg Kroah-Hartman
2018-02-23 18:26 ` Greg Kroah-Hartman [this message]
2018-02-23 18:26 ` [PATCH 3.18 19/58] xfrm: check id proto in validate_tmpl() Greg Kroah-Hartman
2018-02-23 18:26 ` [PATCH 3.18 20/58] selinux: skip bounded transition processing if the policy isnt loaded Greg Kroah-Hartman
2018-02-23 18:26 ` [PATCH 3.18 21/58] crypto: x86/twofish-3way - Fix %rbp usage Greg Kroah-Hartman
2018-02-23 18:26 ` [PATCH 3.18 22/58] staging: android: ion: Add __GFP_NOWARN for system contig heap Greg Kroah-Hartman
2018-02-23 18:26 ` [PATCH 3.18 23/58] netfilter: x_tables: fix int overflow in xt_alloc_table_info() Greg Kroah-Hartman
2018-02-23 18:26 ` [PATCH 3.18 24/58] netfilter: x_tables: avoid out-of-bounds reads in xt_request_find_{match|target} Greg Kroah-Hartman
2018-02-23 18:26 ` [PATCH 3.18 25/58] netfilter: ipt_CLUSTERIP: fix out-of-bounds accesses in clusterip_tg_check() Greg Kroah-Hartman
2018-02-23 18:26 ` [PATCH 3.18 26/58] netfilter: on sockopt() acquire sock lock only in the required scope Greg Kroah-Hartman
2018-02-23 18:26 ` [PATCH 3.18 27/58] netfilter: xt_RATEEST: acquire xt_rateest_mutex for hash insert Greg Kroah-Hartman
2018-02-23 18:26 ` [PATCH 3.18 28/58] net: avoid skb_warn_bad_offload on IS_ERR Greg Kroah-Hartman
2018-02-23 18:26 ` [PATCH 3.18 29/58] Provide a function to create a NUL-terminated string from unterminated data Greg Kroah-Hartman
2018-02-23 18:26 ` [PATCH 3.18 30/58] selinux: ensure the context is NUL terminated in security_context_to_sid_core() Greg Kroah-Hartman
2018-02-23 18:26 ` [PATCH 3.18 31/58] ASoC: ux500: add MODULE_LICENSE tag Greg Kroah-Hartman
2018-02-23 18:26 ` [PATCH 3.18 32/58] video: fbdev/mmp: add MODULE_LICENSE Greg Kroah-Hartman
2018-02-23 18:26 ` [PATCH 3.18 33/58] dn_getsockoptdecnet: move nf_{get/set}sockopt outside sock lock Greg Kroah-Hartman
2018-02-23 18:26 ` [PATCH 3.18 34/58] usbip: keep usbip_device sockfd state in sync with tcp_socket Greg Kroah-Hartman
2018-02-23 18:26 ` [PATCH 3.18 35/58] usb: build drivers/usb/common/ when USB_SUPPORT is set Greg Kroah-Hartman
2018-02-23 18:26 ` [PATCH 3.18 36/58] ARM: AM33xx: PRM: Remove am33xx_pwrdm_read_prev_pwrst function Greg Kroah-Hartman
2018-02-23 18:26 ` [PATCH 3.18 37/58] ARM: dts: am4372: Correct the interrupts_properties of McASP Greg Kroah-Hartman
2018-02-23 18:26 ` [PATCH 3.18 38/58] perf top: Fix window dimensions change handling Greg Kroah-Hartman
2018-02-23 18:26 ` [PATCH 3.18 39/58] perf bench numa: Fixup discontiguous/sparse numa nodes Greg Kroah-Hartman
2018-02-23 18:26 ` [PATCH 3.18 40/58] media: s5k6aa: describe some function parameters Greg Kroah-Hartman
2018-02-23 18:26 ` [PATCH 3.18 41/58] scripts/kernel-doc: Dont fail with status != 0 if error encountered with -none Greg Kroah-Hartman
2018-02-23 18:26 ` [PATCH 3.18 42/58] m68k: add missing SOFTIRQENTRY_TEXT linker section Greg Kroah-Hartman
2018-02-23 18:26 ` [PATCH 3.18 43/58] powerpc/perf: Fix oops when grouping different pmu events Greg Kroah-Hartman
2018-02-23 18:26 ` [PATCH 3.18 44/58] s390/dasd: prevent prefix I/O error Greg Kroah-Hartman
2018-02-23 18:26 ` [PATCH 3.18 45/58] gianfar: fix a flooded alignment reports because of padding issue Greg Kroah-Hartman
2018-02-23 18:26 ` [PATCH 3.18 46/58] net_sched: red: Avoid devision by zero Greg Kroah-Hartman
2018-02-23 18:26 ` [PATCH 3.18 47/58] net_sched: red: Avoid illegal values Greg Kroah-Hartman
2018-02-23 18:26 ` [PATCH 3.18 48/58] btrfs: Fix possible off-by-one in btrfs_search_path_in_tree Greg Kroah-Hartman
2018-02-23 18:26 ` [PATCH 3.18 49/58] 509: fix printing uninitialized stack memory when OID is empty Greg Kroah-Hartman
2018-02-23 18:26 ` [PATCH 3.18 50/58] spi: sun4i: disable clocks in the remove function Greg Kroah-Hartman
2018-02-23 18:26 ` [PATCH 3.18 51/58] xfrm: Fix stack-out-of-bounds with misconfigured transport mode policies Greg Kroah-Hartman
2018-02-23 18:26 ` [PATCH 3.18 52/58] dmaengine: jz4740: disable/unprepare clk if probe fails Greg Kroah-Hartman
2018-02-23 18:26 ` [PATCH 3.18 53/58] mm/early_ioremap: Fix boot hang with earlyprintk=efi,keep Greg Kroah-Hartman
2018-02-23 18:26 ` [PATCH 3.18 54/58] x86/mm/kmmio: Fix mmiotrace for page unaligned addresses Greg Kroah-Hartman
2018-02-23 18:26 ` [PATCH 3.18 55/58] xen: XEN_ACPI_PROCESSOR is Dom0-only Greg Kroah-Hartman
2018-02-23 18:26 ` [PATCH 3.18 56/58] hippi: Fix a Fix a possible sleep-in-atomic bug in rr_close Greg Kroah-Hartman
2018-02-23 18:26 ` [PATCH 3.18 57/58] KVM: async_pf: Fix #DF due to inject "Page not Present" and "Page Ready" exceptions simultaneously Greg Kroah-Hartman
2018-02-23 18:26 ` [PATCH 3.18 58/58] crypto: s5p-sss - Fix kernel Oops in AES-ECB mode Greg Kroah-Hartman
2018-02-23 22:17 ` [PATCH 3.18 00/58] 3.18.96-stable review kernelci.org bot
2018-02-24 0:37 ` Shuah Khan
2018-02-24 11:41 ` Harsh Shandilya
2018-02-24 18:38 ` Greg Kroah-Hartman
2018-02-24 17:54 ` Guenter Roeck
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20180223170209.676970355@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=akaraliou.dev@gmail.com \
--cc=glauber@scylladb.com \
--cc=linux-kernel@vger.kernel.org \
--cc=penguin-kernel@I-love.SAKURA.ne.jp \
--cc=stable@vger.kernel.org \
--cc=syzkaller@googlegroups.com \
--cc=viro@zeniv.linux.org.uk \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).