From: Andrew Morton <akpm@linux-foundation.org>
To: "Kirill A. Shutemov" <kirill.shutemov@linux.intel.com>
Cc: Dmitry Vyukov <dvyukov@google.com>,
Oleg Nesterov <oleg@redhat.com>,
Andrea Arcangeli <aarcange@redhat.com>,
linux-mm@kvack.org, linux-kernel@vger.kernel.org,
stable@vger.kernel.org
Subject: Re: [PATCH 1/2] mm: Fix vma_is_anonymous() false-positives
Date: Tue, 10 Jul 2018 13:48:58 -0700 [thread overview]
Message-ID: <20180710134858.3506f097104859b533c81bf3@linux-foundation.org> (raw)
In-Reply-To: <20180710134821.84709-2-kirill.shutemov@linux.intel.com>
On Tue, 10 Jul 2018 16:48:20 +0300 "Kirill A. Shutemov" <kirill.shutemov@linux.intel.com> wrote:
> vma_is_anonymous() relies on ->vm_ops being NULL to detect anonymous
> VMA. This is unreliable as ->mmap may not set ->vm_ops.
>
> False-positive vma_is_anonymous() may lead to crashes:
>
> ...
>
> This can be fixed by assigning anonymous VMAs own vm_ops and not relying
> on it being NULL.
>
> If ->mmap() failed to set ->vm_ops, mmap_region() will set it to
> dummy_vm_ops. This way we will have non-NULL ->vm_ops for all VMAs.
Is there a smaller, simpler fix which we can use for backporting
purposes and save the larger rework for development kernels?
>
> ...
>
> --- a/mm/mmap.c
> +++ b/mm/mmap.c
> @@ -71,6 +71,9 @@ int mmap_rnd_compat_bits __read_mostly = CONFIG_ARCH_MMAP_RND_COMPAT_BITS;
> static bool ignore_rlimit_data;
> core_param(ignore_rlimit_data, ignore_rlimit_data, bool, 0644);
>
> +const struct vm_operations_struct anon_vm_ops = {};
> +const struct vm_operations_struct dummy_vm_ops = {};
Some nice comments here would be useful. Especially for dummy_vm_ops.
Why does it exist, what is its role, etc.
> static void unmap_region(struct mm_struct *mm,
> struct vm_area_struct *vma, struct vm_area_struct *prev,
> unsigned long start, unsigned long end);
> @@ -561,6 +564,8 @@ static unsigned long count_vma_pages_range(struct mm_struct *mm,
> void __vma_link_rb(struct mm_struct *mm, struct vm_area_struct *vma,
> struct rb_node **rb_link, struct rb_node *rb_parent)
> {
> + WARN_ONCE(!vma->vm_ops, "missing vma->vm_ops");
> +
> /* Update tracking information for the gap following the new vma. */
> if (vma->vm_next)
> vma_gap_update(vma->vm_next);
> @@ -1774,12 +1779,19 @@ unsigned long mmap_region(struct file *file, unsigned long addr,
> */
> WARN_ON_ONCE(addr != vma->vm_start);
>
> + /* All mappings must have ->vm_ops set */
> + if (!vma->vm_ops)
> + vma->vm_ops = &dummy_vm_ops;
Can this happen? Can we make it a rule that file_operations.mmap(vma)
must initialize vma->vm_ops? Should we have a WARN here to detect when
the fs implementation failed to do that?
> addr = vma->vm_start;
> vm_flags = vma->vm_flags;
> } else if (vm_flags & VM_SHARED) {
> error = shmem_zero_setup(vma);
> if (error)
> goto free_vma;
> + } else {
> + /* vma_is_anonymous() relies on this. */
> + vma->vm_ops = &anon_vm_ops;
> }
>
> vma_link(mm, vma, prev, rb_link, rb_parent);
> ...
>
next prev parent reply other threads:[~2018-07-10 20:49 UTC|newest]
Thread overview: 16+ messages / expand[flat|nested] mbox.gz Atom feed top
2018-07-10 13:48 [PATCH 0/2] Fix crash due to vma_is_anonymous() false-positives Kirill A. Shutemov
2018-07-10 13:48 ` [PATCH 1/2] mm: Fix " Kirill A. Shutemov
2018-07-10 20:48 ` Andrew Morton [this message]
2018-07-11 12:15 ` Kirill A. Shutemov
2018-07-16 13:30 ` Michal Hocko
2018-07-16 14:04 ` Kirill A. Shutemov
2018-07-16 14:22 ` Michal Hocko
2018-07-16 14:47 ` Kirill A. Shutemov
2018-07-16 17:40 ` Michal Hocko
2018-07-16 20:38 ` Kirill A. Shutemov
2018-07-17 9:00 ` Michal Hocko
2018-07-17 9:30 ` Kirill A. Shutemov
2018-07-17 10:44 ` Michal Hocko
2018-07-10 13:48 ` [PATCH 2/2] mm: Drop unneeded ->vm_ops checks Kirill A. Shutemov
2018-07-11 22:17 ` [2/2] " Guenter Roeck
2018-07-11 22:40 ` Andrew Morton
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20180710134858.3506f097104859b533c81bf3@linux-foundation.org \
--to=akpm@linux-foundation.org \
--cc=aarcange@redhat.com \
--cc=dvyukov@google.com \
--cc=kirill.shutemov@linux.intel.com \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-mm@kvack.org \
--cc=oleg@redhat.com \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).