linux-kernel.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
	stable@vger.kernel.org, Muchun Song <songmuchun@bytedance.com>,
	Andrew Morton <akpm@linux-foundation.org>,
	Mike Kravetz <mike.kravetz@oracle.com>,
	Andi Kleen <ak@linux.intel.com>,
	Linus Torvalds <torvalds@linux-foundation.org>
Subject: [PATCH 4.9 60/71] mm/hugetlb: fix a race between hugetlb sysctl handlers
Date: Fri, 11 Sep 2020 14:46:44 +0200	[thread overview]
Message-ID: <20200911122507.908241700@linuxfoundation.org> (raw)
In-Reply-To: <20200911122504.928931589@linuxfoundation.org>

From: Muchun Song <songmuchun@bytedance.com>

commit 17743798d81238ab13050e8e2833699b54e15467 upstream.

There is a race between the assignment of `table->data` and write value
to the pointer of `table->data` in the __do_proc_doulongvec_minmax() on
the other thread.

  CPU0:                                 CPU1:
                                        proc_sys_write
  hugetlb_sysctl_handler                  proc_sys_call_handler
  hugetlb_sysctl_handler_common             hugetlb_sysctl_handler
    table->data = &tmp;                       hugetlb_sysctl_handler_common
                                                table->data = &tmp;
      proc_doulongvec_minmax
        do_proc_doulongvec_minmax           sysctl_head_finish
          __do_proc_doulongvec_minmax         unuse_table
            i = table->data;
            *i = val;  // corrupt CPU1's stack

Fix this by duplicating the `table`, and only update the duplicate of
it.  And introduce a helper of proc_hugetlb_doulongvec_minmax() to
simplify the code.

The following oops was seen:

    BUG: kernel NULL pointer dereference, address: 0000000000000000
    #PF: supervisor instruction fetch in kernel mode
    #PF: error_code(0x0010) - not-present page
    Code: Bad RIP value.
    ...
    Call Trace:
     ? set_max_huge_pages+0x3da/0x4f0
     ? alloc_pool_huge_page+0x150/0x150
     ? proc_doulongvec_minmax+0x46/0x60
     ? hugetlb_sysctl_handler_common+0x1c7/0x200
     ? nr_hugepages_store+0x20/0x20
     ? copy_fd_bitmaps+0x170/0x170
     ? hugetlb_sysctl_handler+0x1e/0x20
     ? proc_sys_call_handler+0x2f1/0x300
     ? unregister_sysctl_table+0xb0/0xb0
     ? __fd_install+0x78/0x100
     ? proc_sys_write+0x14/0x20
     ? __vfs_write+0x4d/0x90
     ? vfs_write+0xef/0x240
     ? ksys_write+0xc0/0x160
     ? __ia32_sys_read+0x50/0x50
     ? __close_fd+0x129/0x150
     ? __x64_sys_write+0x43/0x50
     ? do_syscall_64+0x6c/0x200
     ? entry_SYSCALL_64_after_hwframe+0x44/0xa9

Fixes: e5ff215941d5 ("hugetlb: multiple hstates for multiple page sizes")
Signed-off-by: Muchun Song <songmuchun@bytedance.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Reviewed-by: Mike Kravetz <mike.kravetz@oracle.com>
Cc: Andi Kleen <ak@linux.intel.com>
Link: http://lkml.kernel.org/r/20200828031146.43035-1-songmuchun@bytedance.com
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 mm/hugetlb.c |   26 ++++++++++++++++++++------
 1 file changed, 20 insertions(+), 6 deletions(-)

--- a/mm/hugetlb.c
+++ b/mm/hugetlb.c
@@ -2921,6 +2921,22 @@ static unsigned int cpuset_mems_nr(unsig
 }
 
 #ifdef CONFIG_SYSCTL
+static int proc_hugetlb_doulongvec_minmax(struct ctl_table *table, int write,
+					  void *buffer, size_t *length,
+					  loff_t *ppos, unsigned long *out)
+{
+	struct ctl_table dup_table;
+
+	/*
+	 * In order to avoid races with __do_proc_doulongvec_minmax(), we
+	 * can duplicate the @table and alter the duplicate of it.
+	 */
+	dup_table = *table;
+	dup_table.data = out;
+
+	return proc_doulongvec_minmax(&dup_table, write, buffer, length, ppos);
+}
+
 static int hugetlb_sysctl_handler_common(bool obey_mempolicy,
 			 struct ctl_table *table, int write,
 			 void __user *buffer, size_t *length, loff_t *ppos)
@@ -2932,9 +2948,8 @@ static int hugetlb_sysctl_handler_common
 	if (!hugepages_supported())
 		return -EOPNOTSUPP;
 
-	table->data = &tmp;
-	table->maxlen = sizeof(unsigned long);
-	ret = proc_doulongvec_minmax(table, write, buffer, length, ppos);
+	ret = proc_hugetlb_doulongvec_minmax(table, write, buffer, length, ppos,
+					     &tmp);
 	if (ret)
 		goto out;
 
@@ -2978,9 +2993,8 @@ int hugetlb_overcommit_handler(struct ct
 	if (write && hstate_is_gigantic(h))
 		return -EINVAL;
 
-	table->data = &tmp;
-	table->maxlen = sizeof(unsigned long);
-	ret = proc_doulongvec_minmax(table, write, buffer, length, ppos);
+	ret = proc_hugetlb_doulongvec_minmax(table, write, buffer, length, ppos,
+					     &tmp);
 	if (ret)
 		goto out;
 



  parent reply	other threads:[~2020-09-11 13:23 UTC|newest]

Thread overview: 75+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2020-09-11 12:45 [PATCH 4.9 00/71] 4.9.236-rc1 review Greg Kroah-Hartman
2020-09-11 12:45 ` [PATCH 4.9 01/71] HID: core: Correctly handle ReportSize being zero Greg Kroah-Hartman
2020-09-11 12:45 ` [PATCH 4.9 02/71] HID: core: Sanitize event code and type when mapping input Greg Kroah-Hartman
2020-09-11 12:45 ` [PATCH 4.9 03/71] perf record/stat: Explicitly call out event modifiers in the documentation Greg Kroah-Hartman
2020-09-11 12:45 ` [PATCH 4.9 04/71] hwmon: (applesmc) check status earlier Greg Kroah-Hartman
2020-09-11 12:45 ` [PATCH 4.9 05/71] nvmet: Disable keep-alive timer when kato is cleared to 0h Greg Kroah-Hartman
2020-09-11 12:45 ` [PATCH 4.9 06/71] ceph: dont allow setlease on cephfs Greg Kroah-Hartman
2020-09-11 12:45 ` [PATCH 4.9 07/71] s390: dont trace preemption in percpu macros Greg Kroah-Hartman
2020-09-11 12:45 ` [PATCH 4.9 08/71] xen/xenbus: Fix granting of vmallocd memory Greg Kroah-Hartman
2020-09-11 12:45 ` [PATCH 4.9 09/71] dmaengine: of-dma: Fix of_dma_router_xlates of_dma_xlate handling Greg Kroah-Hartman
2020-09-11 12:45 ` [PATCH 4.9 10/71] batman-adv: Avoid uninitialized chaddr when handling DHCP Greg Kroah-Hartman
2020-09-11 12:45 ` [PATCH 4.9 11/71] batman-adv: bla: use netif_rx_ni when not in interrupt context Greg Kroah-Hartman
2020-09-11 12:45 ` [PATCH 4.9 12/71] dmaengine: at_hdmac: check return value of of_find_device_by_node() in at_dma_xlate() Greg Kroah-Hartman
2020-09-11 12:45 ` [PATCH 4.9 13/71] MIPS: mm: BMIPS5000 has inclusive physical caches Greg Kroah-Hartman
2020-09-11 12:45 ` [PATCH 4.9 14/71] MIPS: BMIPS: Also call bmips_cpu_setup() for secondary cores Greg Kroah-Hartman
2020-09-11 12:45 ` [PATCH 4.9 15/71] netfilter: nf_tables: add NFTA_SET_USERDATA if not null Greg Kroah-Hartman
2020-09-11 12:46 ` [PATCH 4.9 16/71] netfilter: nf_tables: incorrect enum nft_list_attributes definition Greg Kroah-Hartman
2020-09-11 12:46 ` [PATCH 4.9 17/71] netfilter: nf_tables: fix destination register zeroing Greg Kroah-Hartman
2020-09-11 12:46 ` [PATCH 4.9 18/71] net: hns: Fix memleak in hns_nic_dev_probe Greg Kroah-Hartman
2020-09-11 12:46 ` [PATCH 4.9 19/71] ravb: Fixed to be able to unload modules Greg Kroah-Hartman
2020-09-11 12:46 ` [PATCH 4.9 20/71] net: arc_emac: Fix memleak in arc_mdio_probe Greg Kroah-Hartman
2020-09-11 12:46 ` [PATCH 4.9 21/71] dmaengine: pl330: Fix burst length if burst size is smaller than bus width Greg Kroah-Hartman
2020-09-11 12:46 ` [PATCH 4.9 22/71] bnxt_en: Check for zero dir entries in NVRAM Greg Kroah-Hartman
2020-09-11 12:46 ` [PATCH 4.9 23/71] bnxt_en: Fix PCI AER error recovery flow Greg Kroah-Hartman
2020-09-11 12:46 ` [PATCH 4.9 24/71] fix regression in "epoll: Keep a reference on files added to the check list" Greg Kroah-Hartman
2020-09-11 12:46 ` [PATCH 4.9 25/71] tg3: Fix soft lockup when tg3_reset_task() fails Greg Kroah-Hartman
2020-09-11 12:46 ` [PATCH 4.9 26/71] iommu/vt-d: Serialize IOMMU GCMD register modifications Greg Kroah-Hartman
2020-09-11 12:46 ` [PATCH 4.9 27/71] thermal: ti-soc-thermal: Fix bogus thermal shutdowns for omap4430 Greg Kroah-Hartman
2020-09-11 12:46 ` [PATCH 4.9 28/71] include/linux/log2.h: add missing () around n in roundup_pow_of_two() Greg Kroah-Hartman
2020-09-11 12:46 ` [PATCH 4.9 29/71] btrfs: drop path before adding new uuid tree entry Greg Kroah-Hartman
2020-09-11 12:46 ` [PATCH 4.9 30/71] btrfs: Remove redundant extent_buffer_get in get_old_root Greg Kroah-Hartman
2020-09-11 12:46 ` [PATCH 4.9 31/71] btrfs: Remove extraneous extent_buffer_get from tree_mod_log_rewind Greg Kroah-Hartman
2020-09-11 12:46 ` [PATCH 4.9 32/71] btrfs: set the lockdep class for log tree extent buffers Greg Kroah-Hartman
2020-09-11 12:46 ` [PATCH 4.9 33/71] uaccess: Add non-pagefault user-space read functions Greg Kroah-Hartman
2020-09-11 12:46 ` [PATCH 4.9 34/71] uaccess: Add non-pagefault user-space write function Greg Kroah-Hartman
2020-09-11 12:46 ` [PATCH 4.9 35/71] btrfs: fix potential deadlock in the search ioctl Greg Kroah-Hartman
2020-09-11 12:46 ` [PATCH 4.9 36/71] net: usb: qmi_wwan: add Telit 0x1050 composition Greg Kroah-Hartman
2020-09-11 12:46 ` [PATCH 4.9 37/71] drivers: net: usb: qmi_wwan: add QMI_QUIRK_SET_DTR for Telit PID 0x1201 Greg Kroah-Hartman
2020-09-11 12:46 ` [PATCH 4.9 38/71] qmi_wwan: new Telewell and Sierra device IDs Greg Kroah-Hartman
2020-09-11 12:46 ` [PATCH 4.9 39/71] usb: qmi_wwan: add D-Link DWM-222 A2 device ID Greg Kroah-Hartman
2020-09-11 12:46 ` [PATCH 4.9 40/71] ALSA: ca0106: fix error code handling Greg Kroah-Hartman
2020-09-11 12:46 ` [PATCH 4.9 41/71] ALSA: pcm: oss: Remove superfluous WARN_ON() for mulaw sanity check Greg Kroah-Hartman
2020-09-11 12:46 ` [PATCH 4.9 42/71] ALSA: firewire-digi00x: exclude Avid Adrenaline from detection Greg Kroah-Hartman
2020-09-11 12:46 ` [PATCH 4.9 43/71] block: allow for_each_bvec to support zero len bvec Greg Kroah-Hartman
2020-09-11 12:46 ` [PATCH 4.9 44/71] block: Move SECTOR_SIZE and SECTOR_SHIFT definitions into <linux/blkdev.h> Greg Kroah-Hartman
2020-09-11 12:46 ` [PATCH 4.9 45/71] libata: implement ATA_HORKAGE_MAX_TRIM_128M and apply to Sandisks Greg Kroah-Hartman
2020-09-11 12:46 ` [PATCH 4.9 46/71] dm cache metadata: Avoid returning cmd->bm wild pointer on error Greg Kroah-Hartman
2020-09-11 12:46 ` [PATCH 4.9 47/71] dm thin " Greg Kroah-Hartman
2020-09-11 12:46 ` [PATCH 4.9 48/71] mm: slub: fix conversion of freelist_corrupted() Greg Kroah-Hartman
2020-09-11 12:46 ` [PATCH 4.9 49/71] vfio/type1: Support faulting PFNMAP vmas Greg Kroah-Hartman
2020-09-11 12:46 ` [PATCH 4.9 50/71] vfio-pci: Fault mmaps to enable vma tracking Greg Kroah-Hartman
2020-09-11 12:46 ` [PATCH 4.9 51/71] vfio-pci: Invalidate mmaps and block MMIO access on disabled memory Greg Kroah-Hartman
2020-09-11 12:46 ` [PATCH 4.9 52/71] KVM: arm64: Add kvm_extable for vaxorcism code Greg Kroah-Hartman
2020-09-11 12:46 ` [PATCH 4.9 53/71] KVM: arm64: Defer guest entry when an asynchronous exception is pending Greg Kroah-Hartman
2020-09-11 12:46 ` [PATCH 4.9 54/71] KVM: arm64: Survive synchronous exceptions caused by AT instructions Greg Kroah-Hartman
2020-09-11 12:46 ` [PATCH 4.9 55/71] KVM: arm64: Set HCR_EL2.PTW to prevent AT taking synchronous exception Greg Kroah-Hartman
2020-09-11 12:46 ` [PATCH 4.9 56/71] net: refactor bind_bucket fastreuse into helper Greg Kroah-Hartman
2020-09-11 12:46 ` [PATCH 4.9 57/71] net: initialize fastreuse on inet_inherit_port Greg Kroah-Hartman
2020-09-11 12:46 ` [PATCH 4.9 58/71] vfio/pci: Fix SR-IOV VF handling with MMIO blocking Greg Kroah-Hartman
2020-09-11 12:46 ` [PATCH 4.9 59/71] checkpatch: fix the usage of capture group ( ... ) Greg Kroah-Hartman
2020-09-11 12:46 ` Greg Kroah-Hartman [this message]
2020-09-11 12:46 ` [PATCH 4.9 61/71] cfg80211: regulatory: reject invalid hints Greg Kroah-Hartman
2020-09-11 12:46 ` [PATCH 4.9 62/71] net: usb: Fix uninit-was-stored issue in asix_read_phy_addr() Greg Kroah-Hartman
2020-09-11 12:46 ` [PATCH 4.9 63/71] ALSA; firewire-tascam: exclude Tascam FE-8 from detection Greg Kroah-Hartman
2020-09-11 12:46 ` [PATCH 4.9 64/71] fs/affs: use octal for permissions Greg Kroah-Hartman
2020-09-11 12:46 ` [PATCH 4.9 65/71] affs: fix basic permission bits to actually work Greg Kroah-Hartman
2020-09-11 12:46 ` [PATCH 4.9 66/71] net: ethernet: mlx4: Fix memory allocation in mlx4_buddy_init() Greg Kroah-Hartman
2020-09-11 12:46 ` [PATCH 4.9 67/71] bnxt: dont enable NAPI until rings are ready Greg Kroah-Hartman
2020-09-11 12:46 ` [PATCH 4.9 68/71] netlabel: fix problems with mapping removal Greg Kroah-Hartman
2020-09-11 12:46 ` [PATCH 4.9 69/71] net: usb: dm9601: Add USB ID of Keenetic Plus DSL Greg Kroah-Hartman
2020-09-11 12:46 ` [PATCH 4.9 70/71] sctp: not disable bh in the whole sctp_get_port_local() Greg Kroah-Hartman
2020-09-11 12:46 ` [PATCH 4.9 71/71] net: disable netpoll on fresh napis Greg Kroah-Hartman
2020-09-11 22:31 ` [PATCH 4.9 00/71] 4.9.236-rc1 review Shuah Khan
2020-09-12  2:16 ` Guenter Roeck
2020-09-12  8:06 ` Naresh Kamboju

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20200911122507.908241700@linuxfoundation.org \
    --to=gregkh@linuxfoundation.org \
    --cc=ak@linux.intel.com \
    --cc=akpm@linux-foundation.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=mike.kravetz@oracle.com \
    --cc=songmuchun@bytedance.com \
    --cc=stable@vger.kernel.org \
    --cc=torvalds@linux-foundation.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).