From: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp> To: Matthew Wilcox <willy@infradead.org> Cc: syzbot <syzbot+d8a8e42dfba0454286ff@syzkaller.appspotmail.com>, bigeasy@linutronix.de, linux-kernel@vger.kernel.org, matt@codeblueprint.co.uk, mingo@kernel.org, peterz@infradead.org, syzkaller-bugs@googlegroups.com, tglx@linutronix.de, linux-mm <linux-mm@kvack.org> Subject: Re: BUG: corrupted list in cpu_stop_queue_work Date: Mon, 9 Jul 2018 21:55:17 +0900 [thread overview] Message-ID: <1271c58e-876b-0df3-3224-319d82634663@I-love.SAKURA.ne.jp> (raw) In-Reply-To: <000000000000693c7d057087caf3@google.com> Hello Matthew, It seems to me that there are other locations which do not check xas_store() failure. Is that really OK? If they are OK, I think we want a comment like /* This never fails. */ or /* Failure is OK because ... */ for each call without failure check. From d6f24d6eecd79836502527624f8086f4e3e4c331 Mon Sep 17 00:00:00 2001 From: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp> Date: Mon, 9 Jul 2018 15:58:44 +0900 Subject: [PATCH] shmem: Fix crash upon xas_store() failure. syzbot is reporting list corruption [1]. This is because xas_store() from shmem_add_to_page_cache() is not handling memory allocation failure. Fix this by checking xas_error() after xas_store(). [1] https://syzkaller.appspot.com/bug?id=ccf34b892706ff6f3321da526329476eab23d5a0 Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp> Reported-by: syzbot+d8a8e42dfba0454286ff@syzkaller.appspotmail.com Fixes: "shmem: Convert shmem_add_to_page_cache to XArray" --- mm/shmem.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/mm/shmem.c b/mm/shmem.c index 0f151c8..382aeb3 100644 --- a/mm/shmem.c +++ b/mm/shmem.c @@ -606,6 +606,8 @@ static int shmem_add_to_page_cache(struct page *page, } next: xas_store(&xas, page + i); + if (xas_error(&xas)) + goto unlock; if (++i < nr) { xas_next(&xas); goto next; -- 1.8.3.1
WARNING: multiple messages have this Message-ID (diff)
From: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp> To: Matthew Wilcox <willy@infradead.org> Cc: syzbot <syzbot+d8a8e42dfba0454286ff@syzkaller.appspotmail.com>, bigeasy@linutronix.de, linux-kernel@vger.kernel.org, matt@codeblueprint.co.uk, mingo@kernel.org, peterz@infradead.org, syzkaller-bugs@googlegroups.com, tglx@linutronix.de, linux-mm <linux-mm@kvack.org> Subject: Re: BUG: corrupted list in cpu_stop_queue_work Date: Mon, 9 Jul 2018 21:55:17 +0900 [thread overview] Message-ID: <1271c58e-876b-0df3-3224-319d82634663@I-love.SAKURA.ne.jp> (raw) In-Reply-To: <000000000000693c7d057087caf3@google.com> Hello Matthew, It seems to me that there are other locations which do not check xas_store() failure. Is that really OK? If they are OK, I think we want a comment like /* This never fails. */ or /* Failure is OK because ... */ for each call without failure check.
next prev parent reply other threads:[~2018-07-09 12:55 UTC|newest] Thread overview: 8+ messages / expand[flat|nested] mbox.gz Atom feed top 2018-07-07 11:46 BUG: corrupted list in cpu_stop_queue_work syzbot 2018-07-09 2:30 ` syzbot 2018-07-09 12:55 ` Tetsuo Handa [this message] 2018-07-09 12:55 ` Tetsuo Handa 2018-07-09 13:32 ` Matthew Wilcox 2018-07-09 14:15 ` Tetsuo Handa 2018-07-09 14:24 ` Matthew Wilcox 2018-07-09 14:34 ` Tetsuo Handa
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=1271c58e-876b-0df3-3224-319d82634663@I-love.SAKURA.ne.jp \ --to=penguin-kernel@i-love.sakura.ne.jp \ --cc=bigeasy@linutronix.de \ --cc=linux-kernel@vger.kernel.org \ --cc=linux-mm@kvack.org \ --cc=matt@codeblueprint.co.uk \ --cc=mingo@kernel.org \ --cc=peterz@infradead.org \ --cc=syzbot+d8a8e42dfba0454286ff@syzkaller.appspotmail.com \ --cc=syzkaller-bugs@googlegroups.com \ --cc=tglx@linutronix.de \ --cc=willy@infradead.org \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: linkBe sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.