linux-kernel - Re: [PATCH] Revalidate page->mapping in do_generic_file

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Thu, 4 Nov 2010 14:54:13 +0100
From:	Johannes Weiner <hannes@...xchg.org>
To:	Dave Hansen <dave@...ux.vnet.ibm.com>
Cc:	linux-kernel@...r.kernel.org, linux-mm@...ck.org,
	arunabal@...ibm.com, sbest@...ibm.com, stable <stable@...nel.org>,
	Andrew Morton <akpm@...ux-foundation.org>,
	Christoph Hellwig <hch@....de>,
	Al Viro <viro@...iv.linux.org.uk>,
	Rik van Riel <riel@...hat.com>,
	Minchan Kim <minchan.kim@...il.com>
Subject: Re: [PATCH] Revalidate page->mapping in do_generic_file_read()

On Wed, Nov 03, 2010 at 03:09:41PM -0700, Dave Hansen wrote:
> 
> 70 hours into some stress tests of a 2.6.32-based enterprise kernel,
> we ran into a NULL dereference in here:
> 
> 	int block_is_partially_uptodate(struct page *page, read_descriptor_t *desc,
> 	                                        unsigned long from)
> 	{
> ---->		struct inode *inode = page->mapping->host;
> 
> It looks like page->mapping was the culprit.  (xmon trace is below).
> After closer examination, I realized that do_generic_file_read() does
> a find_get_page(), and eventually locks the page before calling
> block_is_partially_uptodate().  However, it doesn't revalidate the
> page->mapping after the page is locked.  So, there's a small window
> between the find_get_page() and ->is_partially_uptodate() where the
> page could get truncated and page->mapping cleared.
> 
> We _have_ a reference, so it can't get reclaimed, but it certainly
> can be truncated.
> 
> I think the correct thing is to check page->mapping after the
> trylock_page(), and jump out if it got truncated.  This patch has
> been running in the test environment for a month or so now, and we
> have not seen this bug pop up again.

[...]

> diff -puN mm/filemap.c~is_partially_uptodate-revalidate-page mm/filemap.c
> --- linux-2.6.git/mm/filemap.c~is_partially_uptodate-revalidate-page	2010-11-03 13:49:21.000000000 -0700
> +++ linux-2.6.git-dave/mm/filemap.c	2010-11-03 14:01:07.000000000 -0700
> @@ -1016,6 +1016,8 @@ find_page:
>  				goto page_not_up_to_date;
>  			if (!trylock_page(page))
>  				goto page_not_up_to_date;
> +			if (page->mapping != mapping)
> +				goto page_not_up_to_date_locked;

My understanding is that the page can only get truncated but not moved
to another mapping.  So I would find it more straight-forward to just
check for !page->mapping instead (like the code you jump to does, too)

It should not stand in the way of this very important bug fix, though!

Reviewed-by: Johannes Weiner <hannes@...xchg.org>
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/