linux-kernel - is this a bug?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <AANLkTikipA3__OX3sZd-VBS2Hvg5BSE=B9s+0RTyiVVQ@mail.gmail.com>
Date:	Wed, 23 Mar 2011 17:46:56 -0700
From:	Jay <jinshan.xiong@...mcloud.com>
To:	linux-kernel@...r.kernel.org
Subject: is this a bug?

Hi,

Assuming vmscan is doing its job to steal the last page from an
inode's namespace, so:

shrink_page_list -> remove_mapping -> __remove_from_page_cache:

void __remove_from_page_cache(struct page *page)

{

        ...

        radix_tree_delete(&mapping->page_tree, page->index);

        page->mapping = NULL;

>>> after removing the page from radix tree, it stuck at here.

        mapping->nrpages--;

        ...

}

then another process just calls iput_final to release the inode, so
iput_final -> evict:

static void evict(struct inode *inode)

{

       ...

        } else {

                if (inode->i_data.nrpages)

>>> here it finds that nrpage is 1, so go into truncate_inode_pages() but it won't find any page in the page tree.

                        truncate_inode_pages(&inode->i_data, 0);

>>> here nrpages remains 1.

                end_writeback(inode);

>>> hit  BUG_ON(inode->i_data.nrpages) in end_writeback().

        }

        ...

}

The root cause of this problem is that nrpages is accessed w/o holding
mapping->page_tree. The fix is also easy, just grab ->tree_lock inside
truncate_inode_pages_range:

+       spin_lock_irq(&mapping->tree_lock);

-         if (mapping->nrpages == 0)

+        if (mapping->nrpages == 0) {

+               spin_unlock_irq(&mapping->tree_lock);

                return;

+        }

+        spin_unlock_irq(&mapping->tree_lock);

Am I missed anything?

Thanks
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/