linux-kernel - Re: [BUG] Invalid return address of mmap() followed by mbind() in multithreaded context

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20110627171842.GA7554@solar.cslab.ece.ntua.gr>
Date:	Mon, 27 Jun 2011 20:18:42 +0300
From:	Kornilios Kourtis <kkourt@...ab.ece.ntua.gr>
To:	Vasileios Karakasis <bkk@...ab.ece.ntua.gr>,
	KOSAKI Motohiro <kosaki.motohiro@...fujitsu.com>
Cc:	linux-kernel@...r.kernel.org, linux-mm@...ck.org,
	linux-numa@...r.kernel.org
Subject: Re: [BUG] Invalid return address of mmap() followed by mbind() in
 multithreaded context

Hi,

On Fri, Jun 17, 2011 at 06:21:49PM +0300, Vasileios Karakasis wrote:
> Hi,
> 
> I am implementing a multithreaded numa aware code where each thread
> mmap()'s an anonymous private region and then mbind()'s it to its local
> node. The threads are performing a series of such mmap() + mbind()
> operations. My program crashed with SIGSEGV and I noticed that mmap()
> returned an invalid address.

I've taken a closer look at this issue.

As Vasileios said, it can be reproduced by having two threads doing the
following loop:
| for {
| 	addr = mmap(4096, MAP_ANONUMOUS)
| 	if (addr == (void *)-1)
| 		continue
| 	mbind(addr, 4096, 0x1) // do mbind on first NUMA node
| }
After a couple of iterations, mbind() will return EFAULT, although the addr is
valid.

Doing a bisect, pins it down to the following commit (Author added to To:):
	9d8cebd4bcd7c3878462fdfda34bbcdeb4df7ef4
	mm: fix mbind vma merge problem
Which adds merging of vmas in the mbind() path.
Reverting this commit, seems to fix the issue.

I 've added some printks to track down the issue, and EFAULT is returned on:
mm/mempolicy.c: mbind_range()
|   vma = find_vma_prev(mm. start, &prev);
|   if (!vma |vma->vm_start > start)
|       return EFAULT;
Where: vma->start > start

I am not sure what exactly happens, but concurrent merges and splits
of (already mapped) VMAs do not seem to work well together.

cheers,
-Kornilios

-- 
Kornilios Kourtis
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/