linux-kernel - Re: could you clarify mm/mempolicy: fix !vma in new_vma

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Tue, 7 Jan 2014 11:22:12 +0100
From:	Michal Hocko <mhocko@...e.cz>
To:	Bob Liu <lliubbo@...il.com>
Cc:	Wanpeng Li <liwanp@...ux.vnet.ibm.com>,
	Naoya Horiguchi <n-horiguchi@...jp.nec.com>,
	Bob Liu <bob.liu@...cle.com>, Linux-MM <linux-mm@...ck.org>,
	LKML <linux-kernel@...r.kernel.org>
Subject: Re: could you clarify mm/mempolicy: fix !vma in new_vma_page()

On Tue 07-01-14 13:29:31, Bob Liu wrote:
> On Mon, Jan 6, 2014 at 10:18 PM, Michal Hocko <mhocko@...e.cz> wrote:
> > On Mon 06-01-14 20:45:54, Bob Liu wrote:
> > [...]
> >>  544         if (PageAnon(page)) {
> >>  545                 struct anon_vma *page__anon_vma = page_anon_vma(page);
> >>  546                 /*
> >>  547                  * Note: swapoff's unuse_vma() is more efficient with this
> >>  548                  * check, and needs it to match anon_vma when KSM is active.
> >>  549                  */
> >>  550                 if (!vma->anon_vma || !page__anon_vma ||
> >>  551                     vma->anon_vma->root != page__anon_vma->root)
> >>  552                         return -EFAULT;
> >>  553         } else if (page->mapping && !(vma->vm_flags & VM_NONLINEAR)) {
> >>  554                 if (!vma->vm_file ||
> >>  555                     vma->vm_file->f_mapping != page->mapping)
> >>  556                         return -EFAULT;
> >>  557         } else
> >>  558                 return -EFAULT;
> >>
> >> That's the "other conditions" and the reason why we can't use
> >> BUG_ON(!vma) in new_vma_page().
> >
> > Sorry, I wasn't clear with my question. I was interested in which of
> > these triggered and why only for hugetlb pages?
> >
> 
> Sorry I didn't analyse the root cause. They are several checks in
> page_address_in_vma() so I think it might be not difficult to hit one
> of them.

I would be really curious when anon_vma or f_mapping would be out of
sync, that's why I've asked in the first place.

> For example, if the page was mapped to vma by nonlinear
> mapping?

Hmm, ok !private shmem/hugetlbfs might be remapped as non-linear. For
some reason I thought that migration for non-linear mappings is not
allowed. This is not the case and it would explain why the BUG_ON
triggered.

> Anyway, some debug code is needed to verify what really happened here.

That would be prefferable before the patch had been submitted and
merged...

> alloc_page_vma() can handle the vma=NULL case while
> alloc_huge_page_noerr() can't, so we return NULL instead of call down
> to alloc_huge_page().

OK, I see.

Thanks!
-- 
Michal Hocko
SUSE Labs
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/