linux-kernel - Re: [PATCH] mm: do not call do_fault

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Tue, 15 Jul 2014 13:42:06 -0700
From:	Andrew Morton <akpm@...ux-foundation.org>
To:	Konstantin Khlebnikov <k.khlebnikov@...sung.com>
Cc:	linux-mm@...ck.org, Hugh Dickins <hughd@...gle.com>,
	linux-kernel@...r.kernel.org, Sasha Levin <sasha.levin@...cle.com>,
	Ingo Korb <ingo.korb@...dortmund.de>,
	"Kirill A. Shutemov" <kirill.shutemov@...ux.intel.com>,
	Dave Jones <davej@...hat.com>, Ning Qu <quning@...gle.com>,
	Konstantin Khlebnikov <koct9i@...il.com>
Subject: Re: [PATCH] mm: do not call do_fault_around for non-linear fault

On Tue, 15 Jul 2014 15:58:32 +0400 Konstantin Khlebnikov <k.khlebnikov@...sung.com> wrote:

> From: Konstantin Khlebnikov <koct9i@...il.com>
> 
> Faulting around non-linear page-fault has no sense and
> breaks logic in do_fault_around because pgoff is shifted.
> 

Please be a lot more careful with the changelogs?  This one failed to
describe the effects of the bug, failed to adequately describe the bug
itself, failed to describe the offending commits and failed to identify
which kernel versions need the patch.

Sigh.  I went back and assembled the necessary information, below. 
Please check it.



From: Konstantin Khlebnikov <koct9i@...il.com>
Subject: mm: do not call do_fault_around for non-linear fault

Ingo Korb reported that "repeated mapping of the same file on tmpfs using
remap_file_pages sometimes triggers a BUG at mm/filemap.c:202 when the
process exits".  He bisected the bug to d7c1755179b82d ("mm: implement
->map_pages for shmem/tmpfs"), although the bug was actually added by
8c6e50b0290c4 ("mm: introduce vm_ops->map_pages()").

Problem is caused by calling do_fault_around for _non-linear_ faiult.  In
this case pgoff is shifted and might become negative during calculation.

Faulting around non-linear page-fault has no sense and breaks logic in
do_fault_around because pgoff is shifted.

Signed-off-by: Konstantin Khlebnikov <koct9i@...il.com>
Reported-by: "Ingo Korb" <ingo.korb@...dortmund.de>
Tested-by: "Ingo Korb" <ingo.korb@...dortmund.de>
Cc: Hugh Dickins <hughd@...gle.com>
Cc: Sasha Levin <sasha.levin@...cle.com>
Cc: Dave Jones <davej@...hat.com>
Cc: Ning Qu <quning@...gle.com>
Cc: "Kirill A. Shutemov" <kirill.shutemov@...ux.intel.com>
Cc: <stable@...r.kernel.org>	[3.15.x]
Signed-off-by: Andrew Morton <akpm@...ux-foundation.org>
---

 mm/memory.c |    3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff -puN mm/memory.c~mm-do-not-call-do_fault_around-for-non-linear-fault mm/memory.c
--- a/mm/memory.c~mm-do-not-call-do_fault_around-for-non-linear-fault
+++ a/mm/memory.c
@@ -2882,7 +2882,8 @@ static int do_read_fault(struct mm_struc
 	 * if page by the offset is not ready to be mapped (cold cache or
 	 * something).
 	 */
-	if (vma->vm_ops->map_pages && fault_around_pages() > 1) {
+	if (vma->vm_ops->map_pages && !(flags & FAULT_FLAG_NONLINEAR) &&
+	    fault_around_pages() > 1) {
 		pte = pte_offset_map_lock(mm, pmd, address, &ptl);
 		do_fault_around(vma, address, pte, pgoff, flags);
 		if (!pte_same(*pte, orig_pte))
_

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/