lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Thu, 17 Jul 2014 15:55:40 -0700 (PDT) From: Hugh Dickins <hughd@...gle.com> To: Naoya Horiguchi <n-horiguchi@...jp.nec.com> cc: Guillaume Morin <guillaume@...infr.org>, Andrew Morton <akpm@...ux-foundation.org>, Hugh Dickins <hughd@...gle.com>, linux-kernel@...r.kernel.org, stable@...r.kernel.org, Naoya Horiguchi <nao.horiguchi@...il.com>, linux-mm@...ck.org Subject: Re: [PATCH] mm: hugetlb: fix copy_hugetlb_page_range() (Re: [BUG] new copy_hugetlb_page_range() causing crashes) On Thu, 17 Jul 2014, Naoya Horiguchi wrote: > # CCed Andrew, and linux-mm > > On Thu, Jul 17, 2014 at 11:59:36PM +0200, Guillaume Morin wrote: > > On 17 Jul 17:33, Naoya Horiguchi wrote: > ... > > > And it seems that this also happens on v3.16-rc5. > > > So it might be an upstream bug, not a stable-specific matter. > > > > That's my understanding as well. I just reported it for 3.4 and 3.14 > > since these were the kernels I could easily try my original test with. > > OK. I've checked the fix you suggested below on mainline, and > it passed our test program. > > > > It looks strange to me that the problem is gone by removing the commit > > > 4a705fef98 (although I confirmed it is,) because the kernel's behavior > > > shouldn't change unless (is_hugetlb_entry_migration(entry) || > > > is_hugetlb_entry_hwpoisoned(entry)) is true. And I checked with systemtap > > > that both these check returned false in the above test program. > > > So I'm wondering why the commit makes difference for this test program. > > > > I don't know why I am just thinking about that now. Isn't this the fact > > that your patch moved the huge_ptep_get() before > > huge_ptep_set_wrprotect() in the pte_present() cow case? > > Ah, right. I was really blind :( > > > > > Actually, I've just tried to re-add the huge_ptep_get call for that > > case and it's fixing the problem for me... > > > > Hmm, want a patch? > > Thanks, but it's just a oneliner, so I wrote the one. > > Naoya Horiguchi > --- > From: Naoya Horiguchi <n-horiguchi@...jp.nec.com> > Date: Thu, 17 Jul 2014 18:11:22 -0400 > Subject: [PATCH] mm: hugetlb: fix copy_hugetlb_page_range() > > commit 4a705fef98 ("hugetlb: fix copy_hugetlb_page_range() to handle > migration/hwpoisoned entry") changed the order of huge_ptep_set_wrprotect() > and huge_ptep_get(), which leads to break some workload like hugepage-backed > heap allocation via libhugetlbfs. This patch fixes it. > > The test program for the problem is shown below: > > $ cat heap.c > #include <unistd.h> > #include <stdlib.h> > #include <string.h> > > #define HPS 0x200000 > > int main() { > int i; > char *p = malloc(HPS); > memset(p, '1', HPS); > for (i = 0; i < 5; i++) { > if (!fork()) { > memset(p, '2', HPS); > p = malloc(HPS); > memset(p, '3', HPS); > free(p); > return 0; > } > } > sleep(1); > free(p); > return 0; > } > > $ export HUGETLB_MORECORE=yes ; export HUGETLB_NO_PREFAULT= ; hugectl --heap ./heap > > Reported-by: Guillaume Morin <guillaume@...infr.org> > Suggested-by: Guillaume Morin <guillaume@...infr.org> > Signed-off-by: Naoya Horiguchi <n-horiguchi@...jp.nec.com> Acked-by: Hugh Dickins <hughd@...gle.com> Yes, indeed: I'm ashamed not to have noticed that - sorry. > Cc: stable@...r.kernel.org > --- > mm/hugetlb.c | 1 + > 1 file changed, 1 insertion(+) > > diff --git a/mm/hugetlb.c b/mm/hugetlb.c > index a8d4155eb019..7263c770e9b3 100644 > --- a/mm/hugetlb.c > +++ b/mm/hugetlb.c > @@ -2597,6 +2597,7 @@ int copy_hugetlb_page_range(struct mm_struct *dst, struct mm_struct *src, > } else { > if (cow) > huge_ptep_set_wrprotect(src, addr, src_pte); > + entry = huge_ptep_get(src_pte); > ptepage = pte_page(entry); > get_page(ptepage); > page_dup_rmap(ptepage); > -- > 1.9.3 -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@...r.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
Powered by blists - more mailing lists