linux-kernel - Re: kernel BUG at mm/truncate.c:475!

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <alpine.LSU.2.00.1012151542480.7987@tigran.mtv.corp.google.com>
Date:	Wed, 15 Dec 2010 16:26:11 -0800 (PST)
From:	Hugh Dickins <hughd@...gle.com>
To:	Miklos Szeredi <miklos@...redi.hu>
cc:	akpm@...ux-foundation.org, robert@...ecki.net,
	lkml20101129@...ton.leun.net, linux-kernel@...r.kernel.org,
	linux-mm@...ck.org
Subject: Re: kernel BUG at mm/truncate.c:475!

On Wed, 15 Dec 2010, Miklos Szeredi wrote:
> On Tue, 14 Dec 2010, Hugh Dickins wrote:
> > I'd feel rather happier about it if I thought it would also fix
> > Robert's kernel BUG at /build/buildd/linux-2.6.35/mm/filemap.c:128!
> > but I've still not found time to explain that one.
> 
> Me neither, all unmap_mapping_range() calls from shmfs are either with
> i_mutex or from evict_inode.

And the page returned by shmem_fault is already locked.

> 
> Hmm, is there anything preventing remap_file_pages() installing a pte
> at an address that unmap_mapping_range() has already processed?

Interesting line of thought: nothing I think, but isn't that okay?

Though its zap_pte can take out present ptes pointing to actual pages,
all populate_range ever installs is non-present pte_file entries: and a
fault on one of those goes through the same checks as in a linear mapping.

(I thought I was going to find an inconsistency with zap_pte_range there,
but no: truncation does not remove pte_file entries beyond end of file,
I remember now thinking that we need to keep SIGBUS-beyond-EOF on them,
instead of letting truncation silently revert those offsets to linear.)

Or am I missing something?
(Well, we know I am, because I've not explained Robert's BUG.)

Hugh
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/