linux-kernel - Re: [PATCH 4.4 05/48] mm: fix devm_memremap_pages crash, use mem_hotplug

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Thu, 9 Feb 2017 21:00:19 -0800
From:   Dan Williams <dan.j.williams@...el.com>
To:     Ben Hutchings <ben@...adent.org.uk>
Cc:     Andrew Morton <akpm@...ux-foundation.org>,
        "stable@...r.kernel.org" <stable@...r.kernel.org>,
        Christoph Hellwig <hch@....de>,
        Linus Torvalds <torvalds@...ux-foundation.org>,
        Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
        Linux MM <linux-mm@...ck.org>,
        "linux-nvdimm@...ts.01.org" <linux-nvdimm@...ts.01.org>
Subject: Re: [PATCH 4.4 05/48] mm: fix devm_memremap_pages crash, use
 mem_hotplug_{begin, done}

On Thu, Feb 9, 2017 at 7:26 AM, Ben Hutchings <ben@...adent.org.uk> wrote:
> On Wed, 2017-01-18 at 11:46 +0100, Greg Kroah-Hartman wrote:
>> 4.4-stable review patch.  If anyone has any objections, please let me know.
>>
>> ------------------
>>
>> From: Dan Williams <dan.j.williams@...el.com>
>>
>> commit f931ab479dd24cf7a2c6e2df19778406892591fb upstream.
>>
>> Both arch_add_memory() and arch_remove_memory() expect a single threaded
>> context.
> [...]
>> The result is that two threads calling devm_memremap_pages()
>> simultaneously can end up colliding on pgd initialization.  This leads
>> to crash signatures like the following where the loser of the race
>> initializes the wrong pgd entry:
> [...]
>> Hold the standard memory hotplug mutex over calls to
>> arch_{add,remove}_memory().
> [...]
>
> This is not a sufficient fix, because memory_hotplug.c still assumes
> there's only one 'writer':
>
> void put_online_mems(void)
> {
>         ...
>         if (!--mem_hotplug.refcount && unlikely(mem_hotplug.active_writer))
>                 wake_up_process(mem_hotplug.active_writer);
>         ...
> }
>
> void mem_hotplug_begin(void)
> {
>         mem_hotplug.active_writer = current;
>
>         memhp_lock_acquire();
>         for (;;) {
>                 mutex_lock(&mem_hotplug.lock);
>                 if (likely(!mem_hotplug.refcount))
>                         break;
>                 __set_current_state(TASK_UNINTERRUPTIBLE);
>                 mutex_unlock(&mem_hotplug.lock);
>                 schedule();
>         }
> }
>
> With multiple writers, one or more of them may hang or
> {get,put}_online_mems() may mess up the hotplug reference count.

You're right. We need to hold lock_device_hotplug_sysfs() before
calling mem_hotplug_begin().  I'll take a look at a follow-on fix and
also add an assert_held_device_hotplug() helper to catch this in the
future.