linux-kernel - Re: [PATCH 3/3] mm: catch memory commitment underflow

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Sun, 18 Jan 2015 22:36:43 +0400
From:	Konstantin Khlebnikov <koct9i@...il.com>
To:	Sasha Levin <sasha.levin@...cle.com>
Cc:	"linux-mm@...ck.org" <linux-mm@...ck.org>,
	Andrew Morton <akpm@...ux-foundation.org>,
	Hugh Dickins <hughd@...gle.com>,
	Linux Kernel Mailing List <linux-kernel@...r.kernel.org>,
	Dave Hansen <dave.hansen@...el.com>
Subject: Re: [PATCH 3/3] mm: catch memory commitment underflow

On Sun, Jan 18, 2015 at 2:34 PM, Sasha Levin <sasha.levin@...cle.com> wrote:
> On 06/24/2014 04:16 PM, Konstantin Khlebnikov wrote:
>> This patch prints warning (if CONFIG_DEBUG_VM=y) when
>> memory commitment becomes too negative.
>>
>> Signed-off-by: Konstantin Khlebnikov <koct9i@...il.com>
>
> Hi Konstantin,
>
> I seem to be hitting this warning when fuzzing on the latest -next kernel:

That might be unexpected change of shmem file which holds anon-vma data,
thanks to checkpoint-restore they are expoted via /proc/.../map_files

I've fixed truncate (https://lkml.org/lkml/2014/6/24/729) but there
are some other ways
to change i_size: write, fallocate and maybe something else.

We could seal this promblem (literally).

--- a/mm/shmem.c
+++ b/mm/shmem.c
@@ -3355,6 +3355,9 @@ static struct file *__shmem_file_setup(const
char *name, loff_t size,
        if (!inode)
                goto put_memory;

+       if (!(flags & VM_NORESERVE))
+               SHMEM_I(inode)->seals |= F_SEAL_SHRINK | F_SEAL_GROW;
+
        inode->i_flags |= i_flags;
        d_instantiate(path.dentry, inode);
        inode->i_size = size;



>
> [  683.674323] ------------[ cut here ]------------
> [  683.675552] WARNING: CPU: 12 PID: 25654 at mm/mmap.c:157 __vm_enough_memory+0x1b7/0x1d0()
> [  683.676972] memory commitment underflow
> [  683.678212] Modules linked in:
> [  683.678219] CPU: 12 PID: 25654 Comm: trinity-c373 Not tainted 3.19.0-rc4-next-20150116-sasha-00054-g4ad498c-dirty #1744
> [  683.678227]  ffffffff9c6f7e73 ffff8802c0883a58 ffffffff9b439fb2 0000000000000000
> [  683.678231]  ffff8802c0883aa8 ffff8802c0883a98 ffffffff98159e1a ffff8802c0883ae8
> [  683.678236]  0000000000000001 0000000000000000 ffffffffffff76f1 ffff8802a9749000
> [  683.678243] Call Trace:
> [  683.678288] dump_stack (lib/dump_stack.c:52)
> [  683.678297] warn_slowpath_common (kernel/panic.c:447)
> [  683.678302] warn_slowpath_fmt (kernel/panic.c:461)
> [  683.678307] __vm_enough_memory (mm/mmap.c:157 (discriminator 3))
> [  683.678317] cap_vm_enough_memory (security/commoncap.c:958)
> [  683.678323] security_vm_enough_memory_mm (security/security.c:212)
> [  683.678331] shmem_getpage_gfp (mm/shmem.c:1161)
> [  683.678337] shmem_write_begin (mm/shmem.c:1495)
> [  683.678343] generic_perform_write (mm/filemap.c:2491)
> [  683.678447] __generic_file_write_iter (mm/filemap.c:2632)
> [  683.678452] generic_file_write_iter (mm/filemap.c:2659)
> [  683.678458] do_iter_readv_writev (fs/read_write.c:680)
> [  683.678461] do_readv_writev (fs/read_write.c:848)
> [  683.678512] vfs_writev (fs/read_write.c:893)
> [  683.678515] SyS_writev (fs/read_write.c:926 fs/read_write.c:917)
> [  683.678520] tracesys_phase2 (arch/x86/kernel/entry_64.S:529)
>
>
> Thanks,
> Sasha
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/