* [PATCHv3 0/3] Fix crash due to vma_is_anonymous() false-positives
@ 2018-07-24 12:11 Kirill A. Shutemov
2018-07-24 12:11 ` [PATCHv3 1/3] mm: Introduce vma_init() Kirill A. Shutemov
` (3 more replies)
0 siblings, 4 replies; 12+ messages in thread
From: Kirill A. Shutemov @ 2018-07-24 12:11 UTC (permalink / raw)
To: Andrew Morton, Linus Torvalds
Cc: Dmitry Vyukov, Oleg Nesterov, Andrea Arcangeli, linux-mm,
linux-kernel, Kirill A. Shutemov
Fix crash found by syzkaller.
Build on top of Linus' changes in 4.18-rc6.
Andrew, could you please drop mm-drop-unneeded-vm_ops-checks-v2.patch for
now. Infiniband drivers have to be fixed first.
Kirill A. Shutemov (3):
mm: Introduce vma_init()
mm: Use vma_init() to initialize VMAs on stack and data segments
mm: Fix vma_is_anonymous() false-positives
arch/arm/kernel/process.c | 1 +
arch/arm/mach-rpc/ecard.c | 2 +-
arch/arm64/include/asm/tlb.h | 4 +++-
arch/arm64/mm/hugetlbpage.c | 7 +++++--
arch/ia64/include/asm/tlb.h | 2 +-
arch/ia64/mm/init.c | 2 +-
arch/x86/um/mem_32.c | 2 +-
drivers/char/mem.c | 1 +
fs/exec.c | 1 +
fs/hugetlbfs/inode.c | 2 ++
include/linux/mm.h | 14 ++++++++++++++
kernel/fork.c | 6 ++----
mm/mempolicy.c | 1 +
mm/mmap.c | 3 +++
mm/nommu.c | 2 ++
mm/shmem.c | 1 +
16 files changed, 40 insertions(+), 11 deletions(-)
--
2.18.0
^ permalink raw reply [flat|nested] 12+ messages in thread
* [PATCHv3 1/3] mm: Introduce vma_init()
2018-07-24 12:11 [PATCHv3 0/3] Fix crash due to vma_is_anonymous() false-positives Kirill A. Shutemov
@ 2018-07-24 12:11 ` Kirill A. Shutemov
2018-07-24 20:03 ` Andrew Morton
2018-07-24 12:11 ` [PATCHv3 2/3] mm: Use vma_init() to initialize VMAs on stack and data segments Kirill A. Shutemov
` (2 subsequent siblings)
3 siblings, 1 reply; 12+ messages in thread
From: Kirill A. Shutemov @ 2018-07-24 12:11 UTC (permalink / raw)
To: Andrew Morton, Linus Torvalds
Cc: Dmitry Vyukov, Oleg Nesterov, Andrea Arcangeli, linux-mm,
linux-kernel, Kirill A. Shutemov
Not all VMAs allocated with vm_area_alloc(). Some of them allocated on
stack or in data segment.
The new helper can be use to initialize VMA properly regardless where
it was allocated.
Signed-off-by: Kirill A. Shutemov <kirill.shutemov@linux.intel.com>
---
include/linux/mm.h | 6 ++++++
kernel/fork.c | 6 ++----
2 files changed, 8 insertions(+), 4 deletions(-)
diff --git a/include/linux/mm.h b/include/linux/mm.h
index d3a3842316b8..31540f166987 100644
--- a/include/linux/mm.h
+++ b/include/linux/mm.h
@@ -452,6 +452,12 @@ struct vm_operations_struct {
unsigned long addr);
};
+static inline void vma_init(struct vm_area_struct *vma, struct mm_struct *mm)
+{
+ vma->vm_mm = mm;
+ INIT_LIST_HEAD(&vma->anon_vma_chain);
+}
+
struct mmu_gather;
struct inode;
diff --git a/kernel/fork.c b/kernel/fork.c
index a191c05e757d..1b27babc4c78 100644
--- a/kernel/fork.c
+++ b/kernel/fork.c
@@ -312,10 +312,8 @@ struct vm_area_struct *vm_area_alloc(struct mm_struct *mm)
{
struct vm_area_struct *vma = kmem_cache_zalloc(vm_area_cachep, GFP_KERNEL);
- if (vma) {
- vma->vm_mm = mm;
- INIT_LIST_HEAD(&vma->anon_vma_chain);
- }
+ if (vma)
+ vma_init(vma, mm);
return vma;
}
--
2.18.0
^ permalink raw reply related [flat|nested] 12+ messages in thread
* [PATCHv3 2/3] mm: Use vma_init() to initialize VMAs on stack and data segments
2018-07-24 12:11 [PATCHv3 0/3] Fix crash due to vma_is_anonymous() false-positives Kirill A. Shutemov
2018-07-24 12:11 ` [PATCHv3 1/3] mm: Introduce vma_init() Kirill A. Shutemov
@ 2018-07-24 12:11 ` Kirill A. Shutemov
2018-07-24 12:11 ` [PATCHv3 3/3] mm: Fix vma_is_anonymous() false-positives Kirill A. Shutemov
2018-07-24 17:33 ` [PATCHv3 0/3] Fix crash due to " Linus Torvalds
3 siblings, 0 replies; 12+ messages in thread
From: Kirill A. Shutemov @ 2018-07-24 12:11 UTC (permalink / raw)
To: Andrew Morton, Linus Torvalds
Cc: Dmitry Vyukov, Oleg Nesterov, Andrea Arcangeli, linux-mm,
linux-kernel, Kirill A. Shutemov
Make sure to initialize all VMAs properly, not only which comes from
vm_area_cachep.
Signed-off-by: Kirill A. Shutemov <kirill.shutemov@linux.intel.com>
---
arch/arm/kernel/process.c | 1 +
arch/arm/mach-rpc/ecard.c | 2 +-
arch/arm64/include/asm/tlb.h | 4 +++-
arch/arm64/mm/hugetlbpage.c | 7 +++++--
arch/ia64/include/asm/tlb.h | 2 +-
arch/ia64/mm/init.c | 2 +-
arch/x86/um/mem_32.c | 2 +-
fs/hugetlbfs/inode.c | 2 ++
mm/mempolicy.c | 1 +
mm/shmem.c | 1 +
10 files changed, 17 insertions(+), 7 deletions(-)
diff --git a/arch/arm/kernel/process.c b/arch/arm/kernel/process.c
index 225d1c58d2de..d9c299133111 100644
--- a/arch/arm/kernel/process.c
+++ b/arch/arm/kernel/process.c
@@ -338,6 +338,7 @@ static struct vm_area_struct gate_vma = {
static int __init gate_vma_init(void)
{
+ vma_init(&gate_vma, NULL);
gate_vma.vm_page_prot = PAGE_READONLY_EXEC;
return 0;
}
diff --git a/arch/arm/mach-rpc/ecard.c b/arch/arm/mach-rpc/ecard.c
index 39aef4876ed4..8db62cc54a6a 100644
--- a/arch/arm/mach-rpc/ecard.c
+++ b/arch/arm/mach-rpc/ecard.c
@@ -237,8 +237,8 @@ static void ecard_init_pgtables(struct mm_struct *mm)
memcpy(dst_pgd, src_pgd, sizeof(pgd_t) * (EASI_SIZE / PGDIR_SIZE));
+ vma_init(&vma, mm);
vma.vm_flags = VM_EXEC;
- vma.vm_mm = mm;
flush_tlb_range(&vma, IO_START, IO_START + IO_SIZE);
flush_tlb_range(&vma, EASI_START, EASI_START + EASI_SIZE);
diff --git a/arch/arm64/include/asm/tlb.h b/arch/arm64/include/asm/tlb.h
index ffdaea7954bb..d87f2d646caa 100644
--- a/arch/arm64/include/asm/tlb.h
+++ b/arch/arm64/include/asm/tlb.h
@@ -37,7 +37,9 @@ static inline void __tlb_remove_table(void *_table)
static inline void tlb_flush(struct mmu_gather *tlb)
{
- struct vm_area_struct vma = { .vm_mm = tlb->mm, };
+ struct vm_area_struct vma;
+
+ vma_init(&vma, tlb->mm);
/*
* The ASID allocator will either invalidate the ASID or mark
diff --git a/arch/arm64/mm/hugetlbpage.c b/arch/arm64/mm/hugetlbpage.c
index ecc6818191df..1854e49aa18a 100644
--- a/arch/arm64/mm/hugetlbpage.c
+++ b/arch/arm64/mm/hugetlbpage.c
@@ -108,11 +108,13 @@ static pte_t get_clear_flush(struct mm_struct *mm,
unsigned long pgsize,
unsigned long ncontig)
{
- struct vm_area_struct vma = { .vm_mm = mm };
+ struct vm_area_struct vma;
pte_t orig_pte = huge_ptep_get(ptep);
bool valid = pte_valid(orig_pte);
unsigned long i, saddr = addr;
+ vma_init(&vma, mm);
+
for (i = 0; i < ncontig; i++, addr += pgsize, ptep++) {
pte_t pte = ptep_get_and_clear(mm, addr, ptep);
@@ -145,9 +147,10 @@ static void clear_flush(struct mm_struct *mm,
unsigned long pgsize,
unsigned long ncontig)
{
- struct vm_area_struct vma = { .vm_mm = mm };
+ struct vm_area_struct vma;
unsigned long i, saddr = addr;
+ vma_init(&vma, mm);
for (i = 0; i < ncontig; i++, addr += pgsize, ptep++)
pte_clear(mm, addr, ptep);
diff --git a/arch/ia64/include/asm/tlb.h b/arch/ia64/include/asm/tlb.h
index 44f0ac0df308..db89e7306081 100644
--- a/arch/ia64/include/asm/tlb.h
+++ b/arch/ia64/include/asm/tlb.h
@@ -120,7 +120,7 @@ ia64_tlb_flush_mmu_tlbonly(struct mmu_gather *tlb, unsigned long start, unsigned
*/
struct vm_area_struct vma;
- vma.vm_mm = tlb->mm;
+ vma_init(&vma, tlb->mm);
/* flush the address range from the tlb: */
flush_tlb_range(&vma, start, end);
/* now flush the virt. page-table area mapping the address range: */
diff --git a/arch/ia64/mm/init.c b/arch/ia64/mm/init.c
index bdb14a369137..e6c6dfd98de2 100644
--- a/arch/ia64/mm/init.c
+++ b/arch/ia64/mm/init.c
@@ -273,7 +273,7 @@ static struct vm_area_struct gate_vma;
static int __init gate_vma_init(void)
{
- gate_vma.vm_mm = NULL;
+ vma_init(&gate_vma, NULL);
gate_vma.vm_start = FIXADDR_USER_START;
gate_vma.vm_end = FIXADDR_USER_END;
gate_vma.vm_flags = VM_READ | VM_MAYREAD | VM_EXEC | VM_MAYEXEC;
diff --git a/arch/x86/um/mem_32.c b/arch/x86/um/mem_32.c
index 744afdc18cf3..56c44d865f7b 100644
--- a/arch/x86/um/mem_32.c
+++ b/arch/x86/um/mem_32.c
@@ -16,7 +16,7 @@ static int __init gate_vma_init(void)
if (!FIXADDR_USER_START)
return 0;
- gate_vma.vm_mm = NULL;
+ vma_init(&gate_vma, NULL);
gate_vma.vm_start = FIXADDR_USER_START;
gate_vma.vm_end = FIXADDR_USER_END;
gate_vma.vm_flags = VM_READ | VM_MAYREAD | VM_EXEC | VM_MAYEXEC;
diff --git a/fs/hugetlbfs/inode.c b/fs/hugetlbfs/inode.c
index d508c7844681..40d4c66c7751 100644
--- a/fs/hugetlbfs/inode.c
+++ b/fs/hugetlbfs/inode.c
@@ -411,6 +411,7 @@ static void remove_inode_hugepages(struct inode *inode, loff_t lstart,
bool truncate_op = (lend == LLONG_MAX);
memset(&pseudo_vma, 0, sizeof(struct vm_area_struct));
+ vma_init(&pseudo_vma, current->mm);
pseudo_vma.vm_flags = (VM_HUGETLB | VM_MAYSHARE | VM_SHARED);
pagevec_init(&pvec);
next = start;
@@ -595,6 +596,7 @@ static long hugetlbfs_fallocate(struct file *file, int mode, loff_t offset,
* as input to create an allocation policy.
*/
memset(&pseudo_vma, 0, sizeof(struct vm_area_struct));
+ vma_init(&pseudo_vma, mm);
pseudo_vma.vm_flags = (VM_HUGETLB | VM_MAYSHARE | VM_SHARED);
pseudo_vma.vm_file = file;
diff --git a/mm/mempolicy.c b/mm/mempolicy.c
index 9ac49ef17b4e..01f1a14facc4 100644
--- a/mm/mempolicy.c
+++ b/mm/mempolicy.c
@@ -2505,6 +2505,7 @@ void mpol_shared_policy_init(struct shared_policy *sp, struct mempolicy *mpol)
/* Create pseudo-vma that contains just the policy */
memset(&pvma, 0, sizeof(struct vm_area_struct));
+ vma_init(&pvma, NULL);
pvma.vm_end = TASK_SIZE; /* policy covers entire file */
mpol_set_shared_policy(sp, &pvma, new); /* adds ref */
diff --git a/mm/shmem.c b/mm/shmem.c
index 2cab84403055..41b9bbf24e16 100644
--- a/mm/shmem.c
+++ b/mm/shmem.c
@@ -1421,6 +1421,7 @@ static void shmem_pseudo_vma_init(struct vm_area_struct *vma,
{
/* Create a pseudo vma that just contains the policy */
memset(vma, 0, sizeof(*vma));
+ vma_init(vma, NULL);
/* Bias interleave by inode number to distribute better across nodes */
vma->vm_pgoff = index + info->vfs_inode.i_ino;
vma->vm_policy = mpol_shared_policy_lookup(&info->policy, index);
--
2.18.0
^ permalink raw reply related [flat|nested] 12+ messages in thread
* [PATCHv3 3/3] mm: Fix vma_is_anonymous() false-positives
2018-07-24 12:11 [PATCHv3 0/3] Fix crash due to vma_is_anonymous() false-positives Kirill A. Shutemov
2018-07-24 12:11 ` [PATCHv3 1/3] mm: Introduce vma_init() Kirill A. Shutemov
2018-07-24 12:11 ` [PATCHv3 2/3] mm: Use vma_init() to initialize VMAs on stack and data segments Kirill A. Shutemov
@ 2018-07-24 12:11 ` Kirill A. Shutemov
2018-07-24 17:33 ` [PATCHv3 0/3] Fix crash due to " Linus Torvalds
3 siblings, 0 replies; 12+ messages in thread
From: Kirill A. Shutemov @ 2018-07-24 12:11 UTC (permalink / raw)
To: Andrew Morton, Linus Torvalds
Cc: Dmitry Vyukov, Oleg Nesterov, Andrea Arcangeli, linux-mm,
linux-kernel, Kirill A. Shutemov, stable
vma_is_anonymous() relies on ->vm_ops being NULL to detect anonymous
VMA. This is unreliable as ->mmap may not set ->vm_ops.
False-positive vma_is_anonymous() may lead to crashes:
next ffff8801ce5e7040 prev ffff8801d20eca50 mm ffff88019c1e13c0
prot 27 anon_vma ffff88019680cdd8 vm_ops 0000000000000000
pgoff 0 file ffff8801b2ec2d00 private_data 0000000000000000
flags: 0xff(read|write|exec|shared|mayread|maywrite|mayexec|mayshare)
------------[ cut here ]------------
kernel BUG at mm/memory.c:1422!
invalid opcode: 0000 [#1] SMP KASAN
CPU: 0 PID: 18486 Comm: syz-executor3 Not tainted 4.18.0-rc3+ #136
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google
01/01/2011
RIP: 0010:zap_pmd_range mm/memory.c:1421 [inline]
RIP: 0010:zap_pud_range mm/memory.c:1466 [inline]
RIP: 0010:zap_p4d_range mm/memory.c:1487 [inline]
RIP: 0010:unmap_page_range+0x1c18/0x2220 mm/memory.c:1508
Code: ff 31 ff 4c 89 e6 42 c6 04 33 f8 e8 92 dd d0 ff 4d 85 e4 0f 85 4a eb ff
ff e8 54 dc d0 ff 48 8b bd 10 fc ff ff e8 82 95 fe ff <0f> 0b e8 41 dc d0 ff
0f 0b 4c 89 ad 18 fc ff ff c7 85 7c fb ff ff
RSP: 0018:ffff8801b0587330 EFLAGS: 00010286
RAX: 000000000000013c RBX: 1ffff100360b0e9c RCX: ffffc90002620000
RDX: 0000000000000000 RSI: ffffffff81631851 RDI: 0000000000000001
RBP: ffff8801b05877c8 R08: ffff880199d40300 R09: ffffed003b5c4fc0
R10: ffffed003b5c4fc0 R11: ffff8801dae27e07 R12: 0000000000000000
R13: ffff88019c1e13c0 R14: dffffc0000000000 R15: 0000000020e01000
FS: 00007fca32251700(0000) GS:ffff8801dae00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f04c540d000 CR3: 00000001ac1f0000 CR4: 00000000001426f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
unmap_single_vma+0x1a0/0x310 mm/memory.c:1553
zap_page_range_single+0x3cc/0x580 mm/memory.c:1644
unmap_mapping_range_vma mm/memory.c:2792 [inline]
unmap_mapping_range_tree mm/memory.c:2813 [inline]
unmap_mapping_pages+0x3a7/0x5b0 mm/memory.c:2845
unmap_mapping_range+0x48/0x60 mm/memory.c:2880
truncate_pagecache+0x54/0x90 mm/truncate.c:800
truncate_setsize+0x70/0xb0 mm/truncate.c:826
simple_setattr+0xe9/0x110 fs/libfs.c:409
notify_change+0xf13/0x10f0 fs/attr.c:335
do_truncate+0x1ac/0x2b0 fs/open.c:63
do_sys_ftruncate+0x492/0x560 fs/open.c:205
__do_sys_ftruncate fs/open.c:215 [inline]
__se_sys_ftruncate fs/open.c:213 [inline]
__x64_sys_ftruncate+0x59/0x80 fs/open.c:213
do_syscall_64+0x1b9/0x820 arch/x86/entry/common.c:290
entry_SYSCALL_64_after_hwframe+0x49/0xbe
Reproducer:
#include <stdio.h>
#include <stddef.h>
#include <stdint.h>
#include <stdlib.h>
#include <string.h>
#include <sys/types.h>
#include <sys/stat.h>
#include <sys/ioctl.h>
#include <sys/mman.h>
#include <unistd.h>
#include <fcntl.h>
#define KCOV_INIT_TRACE _IOR('c', 1, unsigned long)
#define KCOV_ENABLE _IO('c', 100)
#define KCOV_DISABLE _IO('c', 101)
#define COVER_SIZE (1024<<10)
#define KCOV_TRACE_PC 0
#define KCOV_TRACE_CMP 1
int main(int argc, char **argv)
{
int fd;
unsigned long *cover;
system("mount -t debugfs none /sys/kernel/debug");
fd = open("/sys/kernel/debug/kcov", O_RDWR);
ioctl(fd, KCOV_INIT_TRACE, COVER_SIZE);
cover = mmap(NULL, COVER_SIZE * sizeof(unsigned long),
PROT_READ | PROT_WRITE, MAP_SHARED, fd, 0);
munmap(cover, COVER_SIZE * sizeof(unsigned long));
cover = mmap(NULL, COVER_SIZE * sizeof(unsigned long),
PROT_READ | PROT_WRITE, MAP_PRIVATE, fd, 0);
memset(cover, 0, COVER_SIZE * sizeof(unsigned long));
ftruncate(fd, 3UL << 20);
return 0;
}
This can be fixed by assigning anonymous VMAs own vm_ops and not relying
on it being NULL.
If ->mmap() failed to set ->vm_ops, mmap_region() will set it to
dummy_vm_ops. This way we will have non-NULL ->vm_ops for all VMAs.
Signed-off-by: Kirill A. Shutemov <kirill.shutemov@linux.intel.com>
Reported-by: syzbot+3f84280d52be9b7083cc@syzkaller.appspotmail.com
Cc: stable@vger.kernel.org
Cc: Dmitry Vyukov <dvyukov@google.com>
Cc: Oleg Nesterov <oleg@redhat.com>
Cc: Andrea Arcangeli <aarcange@redhat.com>
---
drivers/char/mem.c | 1 +
fs/exec.c | 1 +
include/linux/mm.h | 8 ++++++++
mm/mmap.c | 3 +++
mm/nommu.c | 2 ++
5 files changed, 15 insertions(+)
diff --git a/drivers/char/mem.c b/drivers/char/mem.c
index ffeb60d3434c..df66a9dd0aae 100644
--- a/drivers/char/mem.c
+++ b/drivers/char/mem.c
@@ -708,6 +708,7 @@ static int mmap_zero(struct file *file, struct vm_area_struct *vma)
#endif
if (vma->vm_flags & VM_SHARED)
return shmem_zero_setup(vma);
+ vma_set_anonymous(vma);
return 0;
}
diff --git a/fs/exec.c b/fs/exec.c
index 72e961a62adb..bdd0eacefdf5 100644
--- a/fs/exec.c
+++ b/fs/exec.c
@@ -293,6 +293,7 @@ static int __bprm_mm_init(struct linux_binprm *bprm)
bprm->vma = vma = vm_area_alloc(mm);
if (!vma)
return -ENOMEM;
+ vma_set_anonymous(vma);
if (down_write_killable(&mm->mmap_sem)) {
err = -EINTR;
diff --git a/include/linux/mm.h b/include/linux/mm.h
index 31540f166987..7ba6d356d18f 100644
--- a/include/linux/mm.h
+++ b/include/linux/mm.h
@@ -454,10 +454,18 @@ struct vm_operations_struct {
static inline void vma_init(struct vm_area_struct *vma, struct mm_struct *mm)
{
+ static const struct vm_operations_struct dummy_vm_ops = {};
+
vma->vm_mm = mm;
+ vma->vm_ops = &dummy_vm_ops;
INIT_LIST_HEAD(&vma->anon_vma_chain);
}
+static inline void vma_set_anonymous(struct vm_area_struct *vma)
+{
+ vma->vm_ops = NULL;
+}
+
struct mmu_gather;
struct inode;
diff --git a/mm/mmap.c b/mm/mmap.c
index ff1944d8d458..17bbf4d3e24f 100644
--- a/mm/mmap.c
+++ b/mm/mmap.c
@@ -1778,6 +1778,8 @@ unsigned long mmap_region(struct file *file, unsigned long addr,
error = shmem_zero_setup(vma);
if (error)
goto free_vma;
+ } else {
+ vma_set_anonymous(vma);
}
vma_link(mm, vma, prev, rb_link, rb_parent);
@@ -2983,6 +2985,7 @@ static int do_brk_flags(unsigned long addr, unsigned long len, unsigned long fla
return -ENOMEM;
}
+ vma_set_anonymous(vma);
vma->vm_start = addr;
vma->vm_end = addr + len;
vma->vm_pgoff = pgoff;
diff --git a/mm/nommu.c b/mm/nommu.c
index 1d22fdbf7d7c..9fc9e43335b6 100644
--- a/mm/nommu.c
+++ b/mm/nommu.c
@@ -1145,6 +1145,8 @@ static int do_mmap_private(struct vm_area_struct *vma,
if (ret < len)
memset(base + ret, 0, len - ret);
+ } else {
+ vma_set_anonymous(vma);
}
return 0;
--
2.18.0
^ permalink raw reply related [flat|nested] 12+ messages in thread
* Re: [PATCHv3 0/3] Fix crash due to vma_is_anonymous() false-positives
2018-07-24 12:11 [PATCHv3 0/3] Fix crash due to vma_is_anonymous() false-positives Kirill A. Shutemov
` (2 preceding siblings ...)
2018-07-24 12:11 ` [PATCHv3 3/3] mm: Fix vma_is_anonymous() false-positives Kirill A. Shutemov
@ 2018-07-24 17:33 ` Linus Torvalds
3 siblings, 0 replies; 12+ messages in thread
From: Linus Torvalds @ 2018-07-24 17:33 UTC (permalink / raw)
To: Kirill A. Shutemov
Cc: Andrew Morton, Dmitry Vyukov, Oleg Nesterov, Andrea Arcangeli,
linux-mm, Linux Kernel Mailing List
On Tue, Jul 24, 2018 at 5:11 AM Kirill A. Shutemov
<kirill.shutemov@linux.intel.com> wrote:
>
> Fix crash found by syzkaller.
>
> Build on top of Linus' changes in 4.18-rc6.
>
> Andrew, could you please drop mm-drop-unneeded-vm_ops-checks-v2.patch for
> now. Infiniband drivers have to be fixed first.
Ack, these look good to me.
We still need to have the rdma people fix up their vma mis-use, but
that's a related, but independent issue.
Linus
^ permalink raw reply [flat|nested] 12+ messages in thread
* Re: [PATCHv3 1/3] mm: Introduce vma_init()
2018-07-24 12:11 ` [PATCHv3 1/3] mm: Introduce vma_init() Kirill A. Shutemov
@ 2018-07-24 20:03 ` Andrew Morton
2018-07-24 20:16 ` Linus Torvalds
0 siblings, 1 reply; 12+ messages in thread
From: Andrew Morton @ 2018-07-24 20:03 UTC (permalink / raw)
To: Kirill A. Shutemov
Cc: Linus Torvalds, Dmitry Vyukov, Oleg Nesterov, Andrea Arcangeli,
linux-mm, linux-kernel
On Tue, 24 Jul 2018 15:11:37 +0300 "Kirill A. Shutemov" <kirill.shutemov@linux.intel.com> wrote:
> Not all VMAs allocated with vm_area_alloc(). Some of them allocated on
> stack or in data segment.
>
> The new helper can be use to initialize VMA properly regardless where
> it was allocated.
>
> ...
>
> --- a/include/linux/mm.h
> +++ b/include/linux/mm.h
> @@ -452,6 +452,12 @@ struct vm_operations_struct {
> unsigned long addr);
> };
>
> +static inline void vma_init(struct vm_area_struct *vma, struct mm_struct *mm)
> +{
> + vma->vm_mm = mm;
> + INIT_LIST_HEAD(&vma->anon_vma_chain);
> +}
> +
> struct mmu_gather;
> struct inode;
>
> diff --git a/kernel/fork.c b/kernel/fork.c
> index a191c05e757d..1b27babc4c78 100644
> --- a/kernel/fork.c
> +++ b/kernel/fork.c
> @@ -312,10 +312,8 @@ struct vm_area_struct *vm_area_alloc(struct mm_struct *mm)
> {
> struct vm_area_struct *vma = kmem_cache_zalloc(vm_area_cachep, GFP_KERNEL);
I'd sleep better if this became a kmem_cache_alloc() and the memset
was moved into vma_init(). A bunch of the vma_init() callers are
already doing the memset and the others risk leaving uninitialized
stack fields in the vma.
>
> - if (vma) {
> - vma->vm_mm = mm;
> - INIT_LIST_HEAD(&vma->anon_vma_chain);
> - }
> + if (vma)
> + vma_init(vma, mm);
> return vma;
> }
^ permalink raw reply [flat|nested] 12+ messages in thread
* Re: [PATCHv3 1/3] mm: Introduce vma_init()
2018-07-24 20:03 ` Andrew Morton
@ 2018-07-24 20:16 ` Linus Torvalds
2018-07-24 20:41 ` Andrew Morton
0 siblings, 1 reply; 12+ messages in thread
From: Linus Torvalds @ 2018-07-24 20:16 UTC (permalink / raw)
To: Andrew Morton
Cc: Kirill A. Shutemov, Dmitry Vyukov, Oleg Nesterov,
Andrea Arcangeli, linux-mm, Linux Kernel Mailing List
On Tue, Jul 24, 2018 at 1:03 PM Andrew Morton <akpm@linux-foundation.org> wrote:
>
>
> I'd sleep better if this became a kmem_cache_alloc() and the memset
> was moved into vma_init().
Yeah, with the vma_init(), I guess the advantage of using
kmem_cache_zalloc() is pretty dubious.
Make it so.
Linus
^ permalink raw reply [flat|nested] 12+ messages in thread
* Re: [PATCHv3 1/3] mm: Introduce vma_init()
2018-07-24 20:16 ` Linus Torvalds
@ 2018-07-24 20:41 ` Andrew Morton
2018-07-25 12:39 ` Kirill A. Shutemov
0 siblings, 1 reply; 12+ messages in thread
From: Andrew Morton @ 2018-07-24 20:41 UTC (permalink / raw)
To: Linus Torvalds
Cc: Kirill A. Shutemov, Dmitry Vyukov, Oleg Nesterov,
Andrea Arcangeli, linux-mm, Linux Kernel Mailing List
On Tue, 24 Jul 2018 13:16:33 -0700 Linus Torvalds <torvalds@linux-foundation.org> wrote:
> On Tue, Jul 24, 2018 at 1:03 PM Andrew Morton <akpm@linux-foundation.org> wrote:
> >
> >
> > I'd sleep better if this became a kmem_cache_alloc() and the memset
> > was moved into vma_init().
>
> Yeah, with the vma_init(), I guess the advantage of using
> kmem_cache_zalloc() is pretty dubious.
>
> Make it so.
>
Did I get everything?
From: Andrew Morton <akpm@linux-foundation.org>
Subject: mm: zero out the vma in vma_init()
Rather than in vm_area_alloc(). To ensure that the various oddball
stack-based vmas are in a good state. Some of the callers were zeroing
them out, others were not.
Cc: Russell King <rmk+kernel@arm.linux.org.uk>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: "Kirill A. Shutemov" <kirill.shutemov@linux.intel.com>
Cc: Dmitry Vyukov <dvyukov@google.com>
Cc: Oleg Nesterov <oleg@redhat.com>
Cc: Andrea Arcangeli <aarcange@redhat.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
---
arch/arm/kernel/process.c | 9 ++++-----
fs/hugetlbfs/inode.c | 2 --
include/linux/mm.h | 1 +
kernel/fork.c | 3 ++-
mm/mempolicy.c | 1 -
mm/shmem.c | 1 -
6 files changed, 7 insertions(+), 10 deletions(-)
diff -puN arch/arm/kernel/process.c~mm-zero-out-the-vma-in-vma_init arch/arm/kernel/process.c
--- a/arch/arm/kernel/process.c~mm-zero-out-the-vma-in-vma_init
+++ a/arch/arm/kernel/process.c
@@ -330,16 +330,15 @@ unsigned long arch_randomize_brk(struct
* atomic helpers. Insert it into the gate_vma so that it is visible
* through ptrace and /proc/<pid>/mem.
*/
-static struct vm_area_struct gate_vma = {
- .vm_start = 0xffff0000,
- .vm_end = 0xffff0000 + PAGE_SIZE,
- .vm_flags = VM_READ | VM_EXEC | VM_MAYREAD | VM_MAYEXEC,
-};
+static struct vm_area_struct gate_vma;
static int __init gate_vma_init(void)
{
vma_init(&gate_vma, NULL);
gate_vma.vm_page_prot = PAGE_READONLY_EXEC;
+ gate_vma.vm_start = 0xffff0000;
+ gate_vma.vm_end = 0xffff0000 + PAGE_SIZE;
+ gate_vma.vm_flags = VM_READ | VM_EXEC | VM_MAYREAD | VM_MAYEXEC;
return 0;
}
arch_initcall(gate_vma_init);
diff -puN fs/hugetlbfs/inode.c~mm-zero-out-the-vma-in-vma_init fs/hugetlbfs/inode.c
--- a/fs/hugetlbfs/inode.c~mm-zero-out-the-vma-in-vma_init
+++ a/fs/hugetlbfs/inode.c
@@ -410,7 +410,6 @@ static void remove_inode_hugepages(struc
int i, freed = 0;
bool truncate_op = (lend == LLONG_MAX);
- memset(&pseudo_vma, 0, sizeof(struct vm_area_struct));
vma_init(&pseudo_vma, current->mm);
pseudo_vma.vm_flags = (VM_HUGETLB | VM_MAYSHARE | VM_SHARED);
pagevec_init(&pvec);
@@ -595,7 +594,6 @@ static long hugetlbfs_fallocate(struct f
* allocation routines. If NUMA is configured, use page index
* as input to create an allocation policy.
*/
- memset(&pseudo_vma, 0, sizeof(struct vm_area_struct));
vma_init(&pseudo_vma, mm);
pseudo_vma.vm_flags = (VM_HUGETLB | VM_MAYSHARE | VM_SHARED);
pseudo_vma.vm_file = file;
diff -puN include/linux/mm.h~mm-zero-out-the-vma-in-vma_init include/linux/mm.h
--- a/include/linux/mm.h~mm-zero-out-the-vma-in-vma_init
+++ a/include/linux/mm.h
@@ -456,6 +456,7 @@ static inline void vma_init(struct vm_ar
{
static const struct vm_operations_struct dummy_vm_ops = {};
+ memset(vma, 0, sizeof(*vma));
vma->vm_mm = mm;
vma->vm_ops = &dummy_vm_ops;
INIT_LIST_HEAD(&vma->anon_vma_chain);
diff -puN kernel/fork.c~mm-zero-out-the-vma-in-vma_init kernel/fork.c
--- a/kernel/fork.c~mm-zero-out-the-vma-in-vma_init
+++ a/kernel/fork.c
@@ -310,8 +310,9 @@ static struct kmem_cache *mm_cachep;
struct vm_area_struct *vm_area_alloc(struct mm_struct *mm)
{
- struct vm_area_struct *vma = kmem_cache_zalloc(vm_area_cachep, GFP_KERNEL);
+ struct vm_area_struct *vma;
+ vma = kmem_cache_alloc(vm_area_cachep, GFP_KERNEL);
if (vma)
vma_init(vma, mm);
return vma;
diff -puN mm/mempolicy.c~mm-zero-out-the-vma-in-vma_init mm/mempolicy.c
--- a/mm/mempolicy.c~mm-zero-out-the-vma-in-vma_init
+++ a/mm/mempolicy.c
@@ -2504,7 +2504,6 @@ void mpol_shared_policy_init(struct shar
goto put_new;
/* Create pseudo-vma that contains just the policy */
- memset(&pvma, 0, sizeof(struct vm_area_struct));
vma_init(&pvma, NULL);
pvma.vm_end = TASK_SIZE; /* policy covers entire file */
mpol_set_shared_policy(sp, &pvma, new); /* adds ref */
diff -puN mm/shmem.c~mm-zero-out-the-vma-in-vma_init mm/shmem.c
--- a/mm/shmem.c~mm-zero-out-the-vma-in-vma_init
+++ a/mm/shmem.c
@@ -1421,7 +1421,6 @@ static void shmem_pseudo_vma_init(struct
struct shmem_inode_info *info, pgoff_t index)
{
/* Create a pseudo vma that just contains the policy */
- memset(vma, 0, sizeof(*vma));
vma_init(vma, NULL);
/* Bias interleave by inode number to distribute better across nodes */
vma->vm_pgoff = index + info->vfs_inode.i_ino;
_
^ permalink raw reply [flat|nested] 12+ messages in thread
* Re: [PATCHv3 1/3] mm: Introduce vma_init()
2018-07-24 20:41 ` Andrew Morton
@ 2018-07-25 12:39 ` Kirill A. Shutemov
2018-07-25 17:33 ` Linus Torvalds
2018-07-25 19:42 ` Andrew Morton
0 siblings, 2 replies; 12+ messages in thread
From: Kirill A. Shutemov @ 2018-07-25 12:39 UTC (permalink / raw)
To: Andrew Morton
Cc: Linus Torvalds, Kirill A. Shutemov, Dmitry Vyukov, Oleg Nesterov,
Andrea Arcangeli, linux-mm, Linux Kernel Mailing List
On Tue, Jul 24, 2018 at 01:41:58PM -0700, Andrew Morton wrote:
> On Tue, 24 Jul 2018 13:16:33 -0700 Linus Torvalds <torvalds@linux-foundation.org> wrote:
>
> > On Tue, Jul 24, 2018 at 1:03 PM Andrew Morton <akpm@linux-foundation.org> wrote:
> > >
> > >
> > > I'd sleep better if this became a kmem_cache_alloc() and the memset
> > > was moved into vma_init().
> >
> > Yeah, with the vma_init(), I guess the advantage of using
> > kmem_cache_zalloc() is pretty dubious.
> >
> > Make it so.
> >
>
> Did I get everything?
There are few more:
arch/arm64/include/asm/tlb.h: struct vm_area_struct vma = { .vm_mm = tlb->mm, };
arch/arm64/mm/hugetlbpage.c: struct vm_area_struct vma = { .vm_mm = mm };
arch/arm64/mm/hugetlbpage.c: struct vm_area_struct vma = { .vm_mm = mm };
--
Kirill A. Shutemov
^ permalink raw reply [flat|nested] 12+ messages in thread
* Re: [PATCHv3 1/3] mm: Introduce vma_init()
2018-07-25 12:39 ` Kirill A. Shutemov
@ 2018-07-25 17:33 ` Linus Torvalds
2018-07-25 19:42 ` Andrew Morton
1 sibling, 0 replies; 12+ messages in thread
From: Linus Torvalds @ 2018-07-25 17:33 UTC (permalink / raw)
To: Kirill A. Shutemov
Cc: Andrew Morton, Kirill A. Shutemov, Dmitry Vyukov, Oleg Nesterov,
Andrea Arcangeli, linux-mm, Linux Kernel Mailing List
On Wed, Jul 25, 2018 at 5:39 AM Kirill A. Shutemov <kirill@shutemov.name> wrote:
>
> There are few more:
>
> arch/arm64/include/asm/tlb.h: struct vm_area_struct vma = { .vm_mm = tlb->mm, };
> arch/arm64/mm/hugetlbpage.c: struct vm_area_struct vma = { .vm_mm = mm };
> arch/arm64/mm/hugetlbpage.c: struct vm_area_struct vma = { .vm_mm = mm };
We probably do not care. These are not "real" vma's and are never used
as such. They are literally just fake vmas for the "flush_tlb()"
machinery, which won't ever really cause any VM activity and will just
call back to the architecture TLB flushing routines.
They initialize vm_mm exactly because that's how the mm is passed down
to the tlb flushing (we pass the whole vma because some architectures
than have special flags in vm_flags too that can affect how the TLB
gets flushed - ie "only flush ITLB if it's an execute-only vma" etc).
Using "vma_init()" on them is only confusing, I think.
Linus
^ permalink raw reply [flat|nested] 12+ messages in thread
* Re: [PATCHv3 1/3] mm: Introduce vma_init()
2018-07-25 12:39 ` Kirill A. Shutemov
2018-07-25 17:33 ` Linus Torvalds
@ 2018-07-25 19:42 ` Andrew Morton
2018-07-26 15:14 ` Kirill A. Shutemov
1 sibling, 1 reply; 12+ messages in thread
From: Andrew Morton @ 2018-07-25 19:42 UTC (permalink / raw)
To: Kirill A. Shutemov
Cc: Linus Torvalds, Kirill A. Shutemov, Dmitry Vyukov, Oleg Nesterov,
Andrea Arcangeli, linux-mm, Linux Kernel Mailing List
On Wed, 25 Jul 2018 15:39:24 +0300 "Kirill A. Shutemov" <kirill@shutemov.name> wrote:
> There are few more:
>
> arch/arm64/include/asm/tlb.h: struct vm_area_struct vma = { .vm_mm = tlb->mm, };
> arch/arm64/mm/hugetlbpage.c: struct vm_area_struct vma = { .vm_mm = mm };
> arch/arm64/mm/hugetlbpage.c: struct vm_area_struct vma = { .vm_mm = mm };
I'n not understanding. Your "mm: use vma_init() to initialize VMAs on
stack and data segments" addressed all those?
--- a/arch/arm64/include/asm/tlb.h~mm-use-vma_init-to-initialize-vmas-on-stack-and-data-segments
+++ a/arch/arm64/include/asm/tlb.h
@@ -37,7 +37,9 @@ static inline void __tlb_remove_table(vo
static inline void tlb_flush(struct mmu_gather *tlb)
{
- struct vm_area_struct vma = { .vm_mm = tlb->mm, };
+ struct vm_area_struct vma;
+
+ vma_init(&vma, tlb->mm);
/*
* The ASID allocator will either invalidate the ASID or mark
--- a/arch/arm64/mm/hugetlbpage.c~mm-use-vma_init-to-initialize-vmas-on-stack-and-data-segments
+++ a/arch/arm64/mm/hugetlbpage.c
@@ -108,11 +108,13 @@ static pte_t get_clear_flush(struct mm_s
unsigned long pgsize,
unsigned long ncontig)
{
- struct vm_area_struct vma = { .vm_mm = mm };
+ struct vm_area_struct vma;
pte_t orig_pte = huge_ptep_get(ptep);
bool valid = pte_valid(orig_pte);
unsigned long i, saddr = addr;
+ vma_init(&vma, mm);
+
for (i = 0; i < ncontig; i++, addr += pgsize, ptep++) {
pte_t pte = ptep_get_and_clear(mm, addr, ptep);
@@ -145,9 +147,10 @@ static void clear_flush(struct mm_struct
unsigned long pgsize,
unsigned long ncontig)
{
- struct vm_area_struct vma = { .vm_mm = mm };
+ struct vm_area_struct vma;
unsigned long i, saddr = addr;
+ vma_init(&vma, mm);
for (i = 0; i < ncontig; i++, addr += pgsize, ptep++)
pte_clear(mm, addr, ptep);
^ permalink raw reply [flat|nested] 12+ messages in thread
* Re: [PATCHv3 1/3] mm: Introduce vma_init()
2018-07-25 19:42 ` Andrew Morton
@ 2018-07-26 15:14 ` Kirill A. Shutemov
0 siblings, 0 replies; 12+ messages in thread
From: Kirill A. Shutemov @ 2018-07-26 15:14 UTC (permalink / raw)
To: Andrew Morton
Cc: Kirill A. Shutemov, Linus Torvalds, Dmitry Vyukov, Oleg Nesterov,
Andrea Arcangeli, linux-mm, Linux Kernel Mailing List
On Wed, Jul 25, 2018 at 07:42:01PM +0000, Andrew Morton wrote:
> On Wed, 25 Jul 2018 15:39:24 +0300 "Kirill A. Shutemov" <kirill@shutemov.name> wrote:
>
> > There are few more:
> >
> > arch/arm64/include/asm/tlb.h: struct vm_area_struct vma = { .vm_mm = tlb->mm, };
> > arch/arm64/mm/hugetlbpage.c: struct vm_area_struct vma = { .vm_mm = mm };
> > arch/arm64/mm/hugetlbpage.c: struct vm_area_struct vma = { .vm_mm = mm };
>
> I'n not understanding. Your "mm: use vma_init() to initialize VMAs on
> stack and data segments" addressed all those?
Yeah, sorry. Looked at wrong tree.
--
Kirill A. Shutemov
^ permalink raw reply [flat|nested] 12+ messages in thread
end of thread, other threads:[~2018-07-26 15:14 UTC | newest]
Thread overview: 12+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2018-07-24 12:11 [PATCHv3 0/3] Fix crash due to vma_is_anonymous() false-positives Kirill A. Shutemov
2018-07-24 12:11 ` [PATCHv3 1/3] mm: Introduce vma_init() Kirill A. Shutemov
2018-07-24 20:03 ` Andrew Morton
2018-07-24 20:16 ` Linus Torvalds
2018-07-24 20:41 ` Andrew Morton
2018-07-25 12:39 ` Kirill A. Shutemov
2018-07-25 17:33 ` Linus Torvalds
2018-07-25 19:42 ` Andrew Morton
2018-07-26 15:14 ` Kirill A. Shutemov
2018-07-24 12:11 ` [PATCHv3 2/3] mm: Use vma_init() to initialize VMAs on stack and data segments Kirill A. Shutemov
2018-07-24 12:11 ` [PATCHv3 3/3] mm: Fix vma_is_anonymous() false-positives Kirill A. Shutemov
2018-07-24 17:33 ` [PATCHv3 0/3] Fix crash due to " Linus Torvalds
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).