From: Kefeng Wang <wangkefeng.wang@huawei.com>
To: Andrew Morton <akpm@linux-foundation.org>, <linux-mm@kvack.org>
Cc: <muchun.song@linux.dev>, <linux-kernel@vger.kernel.org>,
Kefeng Wang <wangkefeng.wang@huawei.com>
Subject: [PATCH 1/2] mm: fix null-ptr-deref in kswapd_is_running()
Date: Wed, 24 Aug 2022 15:19:08 +0800 [thread overview]
Message-ID: <20220824071909.192535-1-wangkefeng.wang@huawei.com> (raw)
The kswapd_run/stop() will set pgdat->kswapd to NULL, which
could race with kswapd_is_running() in kcompactd(),
kswapd_run/stop() kcompactd()
kswapd_is_running()
if (pgdat->kswapd) // load non-NULL pgdat->kswapd
pgdat->kswapd = NULL
task_is_running(pgdat->kswapd) // Null pointer derefence
The KASAN report the null-ptr-deref shown below,
vmscan: Failed to start kswapd on node 0
...
BUG: KASAN: null-ptr-deref in kcompactd+0x440/0x504
Read of size 8 at addr 0000000000000024 by task kcompactd0/37
CPU: 0 PID: 37 Comm: kcompactd0 Kdump: loaded Tainted: G OE 5.10.60 #1
Hardware name: QEMU KVM Virtual Machine, BIOS 0.0.0 02/06/2015
Call trace:
dump_backtrace+0x0/0x394
show_stack+0x34/0x4c
dump_stack+0x158/0x1e4
__kasan_report+0x138/0x140
kasan_report+0x44/0xdc
__asan_load8+0x94/0xd0
kcompactd+0x440/0x504
kthread+0x1a4/0x1f0
ret_from_fork+0x10/0x18
For race between kswapd_run() and kcompactd(), adding a temporary value
when create a kthread, and only set it to pgdat->kswapd if kthread_run()
return successful task_struct to fix the issue.
For race between kswapd_stop() and kcompactd(), let's call kcompactd_stop()
before kswapd_stop() to fix the issue.
Signed-off-by: Kefeng Wang <wangkefeng.wang@huawei.com>
---
mm/memory_hotplug.c | 2 +-
mm/vmscan.c | 8 +++++---
2 files changed, 6 insertions(+), 4 deletions(-)
diff --git a/mm/memory_hotplug.c b/mm/memory_hotplug.c
index fad6d1f2262a..2fd45ccbce45 100644
--- a/mm/memory_hotplug.c
+++ b/mm/memory_hotplug.c
@@ -1940,8 +1940,8 @@ int __ref offline_pages(unsigned long start_pfn, unsigned long nr_pages,
node_states_clear_node(node, &arg);
if (arg.status_change_nid >= 0) {
- kswapd_stop(node);
kcompactd_stop(node);
+ kswapd_stop(node);
}
writeback_set_ratelimit();
diff --git a/mm/vmscan.c b/mm/vmscan.c
index b2b1431352dc..08c6497f76c3 100644
--- a/mm/vmscan.c
+++ b/mm/vmscan.c
@@ -4642,16 +4642,18 @@ unsigned long shrink_all_memory(unsigned long nr_to_reclaim)
void kswapd_run(int nid)
{
pg_data_t *pgdat = NODE_DATA(nid);
+ struct task_struct *t;
if (pgdat->kswapd)
return;
- pgdat->kswapd = kthread_run(kswapd, pgdat, "kswapd%d", nid);
- if (IS_ERR(pgdat->kswapd)) {
+ t = kthread_run(kswapd, pgdat, "kswapd%d", nid);
+ if (IS_ERR(t)) {
/* failure at boot is fatal */
BUG_ON(system_state < SYSTEM_RUNNING);
pr_err("Failed to start kswapd on node %d\n", nid);
- pgdat->kswapd = NULL;
+ } else {
+ pgdat->kswapd = t;
}
}
--
2.35.3
next reply other threads:[~2022-08-24 7:14 UTC|newest]
Thread overview: 8+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-08-24 7:19 Kefeng Wang [this message]
2022-08-24 7:19 ` [PATCH 2/2] mm: slince possible data races about pgdat->kswapd Kefeng Wang
2022-08-24 8:24 ` David Hildenbrand
2022-08-24 9:51 ` Kefeng Wang
2022-08-25 2:34 ` Kefeng Wang
2022-08-25 8:22 ` David Hildenbrand
2022-08-25 9:48 ` Kefeng Wang
2022-08-24 7:56 ` [PATCH 1/2] mm: fix null-ptr-deref in kswapd_is_running() David Hildenbrand
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20220824071909.192535-1-wangkefeng.wang@huawei.com \
--to=wangkefeng.wang@huawei.com \
--cc=akpm@linux-foundation.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-mm@kvack.org \
--cc=muchun.song@linux.dev \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.