linux-kernel - Re: BUG Re: mm: vma_merge: fix vm_page_prot SMP race condition against rmap

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <CAJVOszADPn=H4Mgk-kTPh08X18ppxu5zix9b22CstG5KQSwMCw@mail.gmail.com>
Date:   Tue, 27 Sep 2016 15:05:26 -0500
From:   Shaun Tancheff <shaun.tancheff@...gate.com>
To:     Andrea Arcangeli <aarcange@...hat.com>
Cc:     Shaun Tancheff <shaun@...cheff.com>,
        Andrew Morton <akpm@...ux-foundation.org>,
        "Kirill A. Shutemov" <kirill.shutemov@...ux.intel.com>,
        Vlastimil Babka <vbabka@...e.cz>,
        Michal Hocko <mhocko@...e.com>, Ingo Molnar <mingo@...nel.org>,
        Dave Hansen <dave.hansen@...ux.intel.com>,
        Dan Williams <dan.j.williams@...el.com>,
        Johannes Weiner <hannes@...xchg.org>,
        Joonsoo Kim <iamjoonsoo.kim@....com>,
        Konstantin Khlebnikov <koct9i@...il.com>,
        Chen Gang <gang.chen.5i5j@...il.com>,
        Andrey Ryabinin <aryabinin@...tuozzo.com>,
        Thomas Gleixner <tglx@...utronix.de>,
        Mel Gorman <mgorman@...hsingularity.net>,
        Piotr Kwapulinski <kwapulinski.piotr@...il.com>,
        linux-mm@...ck.org, LKML <linux-kernel@...r.kernel.org>
Subject: Re: BUG Re: mm: vma_merge: fix vm_page_prot SMP race condition
 against rmap_walk

Confirmed:
  - Removing DEBUG_VM_RB fixes the hang.

Also confirmed:
 - Above patch fixes the hang when DEBUG_VM_RB is re-enabled.

Thanks!



On Tue, Sep 27, 2016 at 11:05 AM, Andrea Arcangeli <aarcange@...hat.com> wrote:
> Hello,
>
> On Tue, Sep 27, 2016 at 05:16:15AM -0500, Shaun Tancheff wrote:
>> git bisect points at commit  c9634dcf00c9c93b ("mm: vma_merge: fix
>> vm_page_prot SMP race condition against rmap_walk")
>
> I assume linux-next? But I can't find the commit, but I should know
> what this is.
>
>>
>> Last lines to console are [transcribed]:
>>
>> vma ffff8c3d989a7c78 start 00007fe02ed4c000 end 00007fe02ed52000
>> next ffff8c3d96de0c38 prev ffff8c3d989a6e40 mm ffff8c3d071cbac0
>> prot 8000000000000025 anon_vma ffff8c3d96fc9b28 vm_ops           (null)
>> pgoff 7fe02ed4c file           (null) private_data           (null)
>> flags: 0x8100073(read|write|mayread|maywrite|mayexec|account|softdirty)
>
> It's a false positive, you have DEBUG_VM_RB=y, you can disable it or
> cherry-pick the fix:
>
> https://urldefense.proofpoint.com/v2/url?u=https-3A__git.kernel.org_cgit_linux_kernel_git_andrea_aa.git_commit_-3Fid-3D74d8b44224f31153e23ca8a7f7f0700091f5a9b2&d=DQIBAg&c=IGDlg0lD0b-nebmJJ0Kp8A&r=Wg5NqlNlVTT7Ugl8V50qIHLe856QW0qfG3WVYGOrWzA&m=mhyVFRknYnKxpypFw43nt0xMGGZX0r4k-qe6PIyp5ew&s=QjS2W4fUFnnJl4YxCk4WB30v5281AC4B7bAQeP8KWlQ&e=
>
> The assumption validate_mm_rb did isn't valid anymore on the new code
> during __vma_unlink, the validation code must be updated to skip the
> next vma instead of the current one after this change. It's a bug in
> DEBUG_VM_RB=y, if you keep DEBUG_VM_RB=n there's no bug.
>
>> Reproducer is an Ubuntu 16.04.1 LTS x86_64 running on a VM (VirtualBox).
>> Symptom is a solid hang after boot and switch to starting gnome session.
>>
>> Hang at about 35s.
>>
>> kdbg traceback is all null entries.
>>
>> Let me know what additional information I can provide.
>
> I already submitted the fix to Andrew last week:
>
> https://urldefense.proofpoint.com/v2/url?u=https-3A__marc.info_-3Fl-3Dlinux-2Dmm-26m-3D147449253801920-26w-3D2&d=DQIBAg&c=IGDlg0lD0b-nebmJJ0Kp8A&r=Wg5NqlNlVTT7Ugl8V50qIHLe856QW0qfG3WVYGOrWzA&m=mhyVFRknYnKxpypFw43nt0xMGGZX0r4k-qe6PIyp5ew&s=EIo2P9JsNNIZSPoTgxO2vC5DJE4p6-HeOznwL1qhowo&e=
>
> I assume it's pending for merging in -mm.
>
> If you can test this patch and confirm the problem goes away with
> DEBUG_VM_RB=y it'd be great.
>
> Thanks,
> Andrea



-- 
Shaun Tancheff