linux-kernel - Re: [PATCH] exit: fix oops in sync_mm

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <20100331094124.43c49290.kamezawa.hiroyu@jp.fujitsu.com>
Date:	Wed, 31 Mar 2010 09:41:24 +0900
From:	KAMEZAWA Hiroyuki <kamezawa.hiroyu@...fujitsu.com>
To:	Andrew Morton <akpm@...ux-foundation.org>
Cc:	"Michael S. Tsirkin" <mst@...hat.com>, cl@...ux-foundation.org,
	lee.schermerhorn@...com, rientjes@...gle.com,
	Hugh Dickins <hugh.dickins@...cali.co.uk>,
	Rik van Riel <riel@...hat.com>,
	Minchan Kim <minchan.kim@...il.com>,
	Andrea Arcangeli <aarcange@...hat.com>,
	"David S. Miller" <davem@...emloft.net>, linux-mm@...ck.org,
	linux-kernel@...r.kernel.org,
	Troels Liebe Bentsen <tlb@...anden.dk>,
	linux-bluetooth@...r.kernel.org
Subject: Re: [PATCH] exit: fix oops in sync_mm_rss

On Tue, 30 Mar 2010 17:37:21 -0400
Andrew Morton <akpm@...ux-foundation.org> wrote:

> On Wed, 31 Mar 2010 09:28:15 +0900 KAMEZAWA Hiroyuki <kamezawa.hiroyu@...fujitsu.com> wrote:
> 
> > On Tue, 30 Mar 2010 13:56:34 -0700
> > Andrew Morton <akpm@...ux-foundation.org> wrote:
> > 
> > > That new BUG_ON() is triggering in Troels's machine when a bluetooth
> > > keyboard is enabled or disabled.  See
> > > (https://bugzilla.kernel.org/show_bug.cgi?id=15648.
> > > 
> > > I guess the question is: how did a kernel thread get a non-zero
> > > task->rss_stat.count[i]?  If that's expected and OK then we will need
> > > to take some kernel-thread-avoidance action there.
> > > 
> > It seems my fault that it's not initialized to be 0 at do_fork(), copy_process.
> > 
> > About do_exit, do_exit() does this check. So, tsk->mm can be NULL.
> > 
> >  949         if (group_dead) {
> >  950                 hrtimer_cancel(&tsk->signal->real_timer);
> >  951                 exit_itimers(tsk->signal);
> >  952                 if (tsk->mm)
> >  953                         setmax_mm_hiwater_rss(&tsk->signal->maxrss, tsk->mm);
> >  954         }
> > 
> > > Could whoever fixes this please also make __sync_task_rss_stat()
> > > static.
> > > 
> > Ah, yes. I should do so.
> > 
> > > I'll toss this over to Rafael/Maciej for tracking as a post-2.6.33
> > > regression.
> > > 
> > > Thanks.
> > > 
> > 
> > 
> > ==
> > 
> > task->rss_stat wasn't initialized to 0 at copy_process().
> > at exit, tsk->mm may be NULL.
> > And __sync_task_rss_stat() should be static.
> > 
> > Signed-off-by: KAMEZAWA Hiroyuki <kamezawa.hiroyu@...fujitsu.com>
> > ---
> >  kernel/exit.c |    3 ++-
> >  kernel/fork.c |    3 +++
> >  mm/memory.c   |    2 +-
> >  3 files changed, 6 insertions(+), 2 deletions(-)
> > 
> > Index: mmotm-2.6.34-Mar24/kernel/exit.c
> > ===================================================================
> > --- mmotm-2.6.34-Mar24.orig/kernel/exit.c
> > +++ mmotm-2.6.34-Mar24/kernel/exit.c
> > @@ -950,7 +950,8 @@ NORET_TYPE void do_exit(long code)
> >  
> >  	acct_update_integrals(tsk);
> >  	/* sync mm's RSS info before statistics gathering */
> > -	sync_mm_rss(tsk, tsk->mm);
> > +	if (tsk->mm)
> > +		sync_mm_rss(tsk, tsk->mm);
> >  	group_dead = atomic_dec_and_test(&tsk->signal->live);
> >  	if (group_dead) {
> >  		hrtimer_cancel(&tsk->signal->real_timer);
> > Index: mmotm-2.6.34-Mar24/mm/memory.c
> > ===================================================================
> > --- mmotm-2.6.34-Mar24.orig/mm/memory.c
> > +++ mmotm-2.6.34-Mar24/mm/memory.c
> > @@ -124,7 +124,7 @@ core_initcall(init_zero_pfn);
> >  
> >  #if defined(SPLIT_RSS_COUNTING)
> >  
> > -void __sync_task_rss_stat(struct task_struct *task, struct mm_struct *mm)
> > +static void __sync_task_rss_stat(struct task_struct *task, struct mm_struct *mm)
> >  {
> >  	int i;
> >  
> > Index: mmotm-2.6.34-Mar24/kernel/fork.c
> > ===================================================================
> > --- mmotm-2.6.34-Mar24.orig/kernel/fork.c
> > +++ mmotm-2.6.34-Mar24/kernel/fork.c
> > @@ -1060,6 +1060,9 @@ static struct task_struct *copy_process(
> >  	p->prev_utime = cputime_zero;
> >  	p->prev_stime = cputime_zero;
> >  #endif
> > +#if defined(SPLIT_RSS_COUNTING)
> > +	memset(&p->rss_stat, 0, sizeof(p->rss_stat));
> > +#endif
> >  
> >  	p->default_timer_slack_ns = current->timer_slack_ns;
> 
> OK, so the kenrel thread inherited a non-zero rss_stat from a userspace
> parent?
> 
I think so.

> With this fixed, the test for non-zero tsk->mm is't really needed in
> do_exit(), is it?  I guess it makes sense though - sync_mm_rss() only
> really works for kernel threads by luck..

At first, I considered so, too. But I changed my mind to show
"we know tsk->mm can be NULL here!" by code. 
Because __sync_mm_rss_stat() has BUG_ON(!mm), the code reader will think
tsk->mm shouldn't be NULL always.

Doesn't make sense ?

Thanks,
-Kame



--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/