linux-kernel - Re: mm: BUG in mempolicy's sp

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Tue, 26 Feb 2013 19:39:03 +0800
From:	Hillf Danton <dhillf@...il.com>
To:	Sasha Levin <sasha.levin@...cle.com>
Cc:	KOSAKI Motohiro <kosaki.motohiro@...fujitsu.com>,
	Andrew Morton <akpm@...ux-foundation.org>,
	Hugh Dickins <hughd@...gle.com>, Mel Gorman <mgorman@...e.de>,
	Dave Jones <davej@...hat.com>, linux-mm <linux-mm@...ck.org>,
	"linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
	Hillf Danton <dhillf@...il.com>
Subject: Re: mm: BUG in mempolicy's sp_insert

On Tue, Feb 26, 2013 at 9:54 AM, Sasha Levin <sasha.levin@...cle.com> wrote:
> On 02/25/2013 08:52 PM, KOSAKI Motohiro wrote:
>> On Mon, Feb 25, 2013 at 8:30 AM, Sasha Levin <sasha.levin@...cle.com> wrote:
>>> Hi all,
>>>
>>> While fuzzing with trinity inside a KVM tools guest running latest -next kernel,
>>> I've stumbled on the following BUG:
>>>
>>> [13551.830090] ------------[ cut here ]------------
>>> [13551.830090] kernel BUG at mm/mempolicy.c:2187!
>>> [13551.830090] invalid opcode: 0000 [#1] PREEMPT SMP DEBUG_PAGEALLOC
>>
>> Unfortunately, I didn't reproduce this. I'll try it tonight.
>
> I've actually managed to reproduce it again since then, so it's not a one time
> fluke (which is a good sign a I guess).
>
> It did require about an hour of fuzzing just mm with trinity.
>
Insert new node after updating node in tree.

Hillf

--- a/mm/mempolicy.c	Tue Feb 26 19:33:20 2013
+++ b/mm/mempolicy.c	Tue Feb 26 19:35:38 2013
@@ -2391,8 +2391,8 @@ restart:
 				*mpol_new = *n->policy;
 				atomic_set(&mpol_new->refcnt, 1);
 				sp_node_init(n_new, n->end, end, mpol_new);
-				sp_insert(sp, n_new);
 				n->end = start;
+				sp_insert(sp, n_new);
 				n_new = NULL;
 				mpol_new = NULL;
 				break;
--
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/