* [PATCH] mm/hugetlb: Fix use after free when subpool max_hpages accounting is not enabled
@ 2021-01-26 11:55 Miaohe Lin
2021-01-27 0:06 ` Mike Kravetz
0 siblings, 1 reply; 5+ messages in thread
From: Miaohe Lin @ 2021-01-26 11:55 UTC (permalink / raw)
To: akpm, mike.kravetz; +Cc: linux-mm, linux-kernel, linmiaohe
When subpool max_hpages accounting is not enabled, used_hpages is always 0
and might lead to release subpool prematurely because it indicates no pages
are used now while there might be.
In order to fix this issue, we should check used_hpages == 0 iff max_hpages
accounting is enabled. As max_hpages accounting should be enabled in most
common case, this is not worth a Cc stable.
Signed-off-by: Hongxiang Lou <louhongxiang@huawei.com>
Signed-off-by: Miaohe Lin <linmiaohe@huawei.com>
---
mm/hugetlb.c | 16 +++++++++++++---
1 file changed, 13 insertions(+), 3 deletions(-)
diff --git a/mm/hugetlb.c b/mm/hugetlb.c
index 777bc0e45bf3..53ea65d1c5ab 100644
--- a/mm/hugetlb.c
+++ b/mm/hugetlb.c
@@ -97,16 +97,26 @@ static inline void ClearPageHugeFreed(struct page *head)
/* Forward declaration */
static int hugetlb_acct_memory(struct hstate *h, long delta);
-static inline void unlock_or_release_subpool(struct hugepage_subpool *spool)
+static inline bool subpool_is_free(struct hugepage_subpool *spool)
{
- bool free = (spool->count == 0) && (spool->used_hpages == 0);
+ if (spool->count)
+ return false;
+ if (spool->max_hpages != -1)
+ return spool->used_hpages == 0;
+ if (spool->min_hpages != -1)
+ return spool->rsv_hpages == spool->min_hpages;
+ return true;
+}
+
+static inline void unlock_or_release_subpool(struct hugepage_subpool *spool)
+{
spin_unlock(&spool->lock);
/* If no pages are used, and no other handles to the subpool
* remain, give up any reservations based on minimum size and
* free the subpool */
- if (free) {
+ if (subpool_is_free(spool)) {
if (spool->min_hpages != -1)
hugetlb_acct_memory(spool->hstate,
-spool->min_hpages);
--
2.19.1
^ permalink raw reply related [flat|nested] 5+ messages in thread
* Re: [PATCH] mm/hugetlb: Fix use after free when subpool max_hpages accounting is not enabled
2021-01-26 11:55 [PATCH] mm/hugetlb: Fix use after free when subpool max_hpages accounting is not enabled Miaohe Lin
@ 2021-01-27 0:06 ` Mike Kravetz
2021-01-27 2:08 ` Miaohe Lin
0 siblings, 1 reply; 5+ messages in thread
From: Mike Kravetz @ 2021-01-27 0:06 UTC (permalink / raw)
To: Miaohe Lin, akpm; +Cc: linux-mm, linux-kernel
On 1/26/21 3:55 AM, Miaohe Lin wrote:
> When subpool max_hpages accounting is not enabled, used_hpages is always 0
> and might lead to release subpool prematurely because it indicates no pages
> are used now while there might be.
It might be good to say that you need min_hpages accounting (min_size mount
option) enabled for this issue to occur. Or, perhaps say this is possible
if a hugetlbfs filesystem is created with the min_size option and without
the size option.
That might better explain the conditions in which a user could see the issue.
> In order to fix this issue, we should check used_hpages == 0 iff max_hpages
> accounting is enabled. As max_hpages accounting should be enabled in most
> common case, this is not worth a Cc stable.
I agree that such a combination of mount options is very uncommon.
>
> Signed-off-by: Hongxiang Lou <louhongxiang@huawei.com>
> Signed-off-by: Miaohe Lin <linmiaohe@huawei.com>
> ---
> mm/hugetlb.c | 16 +++++++++++++---
> 1 file changed, 13 insertions(+), 3 deletions(-)
Thanks,
Reviewed-by: Mike Kravetz <mike.kravetz@oracle.com>
--
Mike Kravetz
>
> diff --git a/mm/hugetlb.c b/mm/hugetlb.c
> index 777bc0e45bf3..53ea65d1c5ab 100644
> --- a/mm/hugetlb.c
> +++ b/mm/hugetlb.c
> @@ -97,16 +97,26 @@ static inline void ClearPageHugeFreed(struct page *head)
> /* Forward declaration */
> static int hugetlb_acct_memory(struct hstate *h, long delta);
>
> -static inline void unlock_or_release_subpool(struct hugepage_subpool *spool)
> +static inline bool subpool_is_free(struct hugepage_subpool *spool)
> {
> - bool free = (spool->count == 0) && (spool->used_hpages == 0);
> + if (spool->count)
> + return false;
> + if (spool->max_hpages != -1)
> + return spool->used_hpages == 0;
> + if (spool->min_hpages != -1)
> + return spool->rsv_hpages == spool->min_hpages;
>
> + return true;
> +}
> +
> +static inline void unlock_or_release_subpool(struct hugepage_subpool *spool)
> +{
> spin_unlock(&spool->lock);
>
> /* If no pages are used, and no other handles to the subpool
> * remain, give up any reservations based on minimum size and
> * free the subpool */
> - if (free) {
> + if (subpool_is_free(spool)) {
> if (spool->min_hpages != -1)
> hugetlb_acct_memory(spool->hstate,
> -spool->min_hpages);
>
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [PATCH] mm/hugetlb: Fix use after free when subpool max_hpages accounting is not enabled
2021-01-27 0:06 ` Mike Kravetz
@ 2021-01-27 2:08 ` Miaohe Lin
2021-01-28 0:17 ` Andrew Morton
0 siblings, 1 reply; 5+ messages in thread
From: Miaohe Lin @ 2021-01-27 2:08 UTC (permalink / raw)
To: Mike Kravetz, akpm; +Cc: linux-mm, linux-kernel
On 2021/1/27 8:06, Mike Kravetz wrote:
> On 1/26/21 3:55 AM, Miaohe Lin wrote:
>> When subpool max_hpages accounting is not enabled, used_hpages is always 0
>> and might lead to release subpool prematurely because it indicates no pages
>> are used now while there might be.
>
> It might be good to say that you need min_hpages accounting (min_size mount
> option) enabled for this issue to occur. Or, perhaps say this is possible
> if a hugetlbfs filesystem is created with the min_size option and without
> the size option.
>
> That might better explain the conditions in which a user could see the issue.
So commit log might looks like this ?
"""
If a hugetlbfs filesystem is created with the min_size option and without
the size option, used_hpages is always 0 and might lead to release subpool
prematurely because it indicates no pages are used now while there might
be.
In order to fix this issue, we should check used_hpages == 0 iff max_hpages
accounting is enabled. As max_hpages accounting should be enabled in most
common case, this is not worth a Cc stable.
"""
If so, should I send a V2 or Andrew would kindly do this?
Many thanks.
>
>> In order to fix this issue, we should check used_hpages == 0 iff max_hpages
>> accounting is enabled. As max_hpages accounting should be enabled in most
>> common case, this is not worth a Cc stable.
>
> I agree that such a combination of mount options is very uncommon.
>
>>
>> Signed-off-by: Hongxiang Lou <louhongxiang@huawei.com>
>> Signed-off-by: Miaohe Lin <linmiaohe@huawei.com>
>> ---
>> mm/hugetlb.c | 16 +++++++++++++---
>> 1 file changed, 13 insertions(+), 3 deletions(-)
>
> Thanks,
>
> Reviewed-by: Mike Kravetz <mike.kravetz@oracle.com>
>
Many thanks for review.
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [PATCH] mm/hugetlb: Fix use after free when subpool max_hpages accounting is not enabled
2021-01-27 2:08 ` Miaohe Lin
@ 2021-01-28 0:17 ` Andrew Morton
2021-01-28 1:46 ` Miaohe Lin
0 siblings, 1 reply; 5+ messages in thread
From: Andrew Morton @ 2021-01-28 0:17 UTC (permalink / raw)
To: Miaohe Lin; +Cc: Mike Kravetz, linux-mm, linux-kernel
On Wed, 27 Jan 2021 10:08:22 +0800 Miaohe Lin <linmiaohe@huawei.com> wrote:
> On 2021/1/27 8:06, Mike Kravetz wrote:
> > On 1/26/21 3:55 AM, Miaohe Lin wrote:
> >> When subpool max_hpages accounting is not enabled, used_hpages is always 0
> >> and might lead to release subpool prematurely because it indicates no pages
> >> are used now while there might be.
> >
> > It might be good to say that you need min_hpages accounting (min_size mount
> > option) enabled for this issue to occur. Or, perhaps say this is possible
> > if a hugetlbfs filesystem is created with the min_size option and without
> > the size option.
> >
> > That might better explain the conditions in which a user could see the issue.
>
> So commit log might looks like this ?
> """
> If a hugetlbfs filesystem is created with the min_size option and without
> the size option, used_hpages is always 0 and might lead to release subpool
> prematurely because it indicates no pages are used now while there might
> be.
>
> In order to fix this issue, we should check used_hpages == 0 iff max_hpages
> accounting is enabled. As max_hpages accounting should be enabled in most
> common case, this is not worth a Cc stable.
> """
>
> If so, should I send a V2 or Andrew would kindly do this?
> Many thanks.
I made that change, thanks.
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [PATCH] mm/hugetlb: Fix use after free when subpool max_hpages accounting is not enabled
2021-01-28 0:17 ` Andrew Morton
@ 2021-01-28 1:46 ` Miaohe Lin
0 siblings, 0 replies; 5+ messages in thread
From: Miaohe Lin @ 2021-01-28 1:46 UTC (permalink / raw)
To: Andrew Morton; +Cc: Mike Kravetz, linux-mm, linux-kernel
Hi:
On 2021/1/28 8:17, Andrew Morton wrote:
> On Wed, 27 Jan 2021 10:08:22 +0800 Miaohe Lin <linmiaohe@huawei.com> wrote:
>
>> On 2021/1/27 8:06, Mike Kravetz wrote:
>>> On 1/26/21 3:55 AM, Miaohe Lin wrote:
>>>> When subpool max_hpages accounting is not enabled, used_hpages is always 0
>>>> and might lead to release subpool prematurely because it indicates no pages
>>>> are used now while there might be.
>>>
>>> It might be good to say that you need min_hpages accounting (min_size mount
>>> option) enabled for this issue to occur. Or, perhaps say this is possible
>>> if a hugetlbfs filesystem is created with the min_size option and without
>>> the size option.
>>>
>>> That might better explain the conditions in which a user could see the issue.
>>
>> So commit log might looks like this ?
>> """
>> If a hugetlbfs filesystem is created with the min_size option and without
>> the size option, used_hpages is always 0 and might lead to release subpool
>> prematurely because it indicates no pages are used now while there might
>> be.
>>
>> In order to fix this issue, we should check used_hpages == 0 iff max_hpages
>> accounting is enabled. As max_hpages accounting should be enabled in most
>> common case, this is not worth a Cc stable.
>> """
>>
>> If so, should I send a V2 or Andrew would kindly do this?
>> Many thanks.
>
> I made that change, thanks.>
It's very kind of you. Many thanks.:)
> .
>
^ permalink raw reply [flat|nested] 5+ messages in thread
end of thread, other threads:[~2021-01-28 1:47 UTC | newest]
Thread overview: 5+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2021-01-26 11:55 [PATCH] mm/hugetlb: Fix use after free when subpool max_hpages accounting is not enabled Miaohe Lin
2021-01-27 0:06 ` Mike Kravetz
2021-01-27 2:08 ` Miaohe Lin
2021-01-28 0:17 ` Andrew Morton
2021-01-28 1:46 ` Miaohe Lin
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).