linux-kernel - Re: [PATCH] mm, madvise: Ensure poisoned pages are removed from per-cpu lists

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Tue, 29 Aug 2017 13:55:26 +0200
From:   Vlastimil Babka <vbabka@...e.cz>
To:     Mel Gorman <mgorman@...hsingularity.net>,
        Andrew Morton <akpm@...ux-foundation.org>
Cc:     "Hansen, Dave" <dave.hansen@...el.com>,
        "Luck, Tony" <tony.luck@...el.com>, Linux MM <linux-mm@...ck.org>,
        LKML <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH] mm, madvise: Ensure poisoned pages are removed from
 per-cpu lists

On 08/28/2017 03:34 PM, Mel Gorman wrote:
> Wendy Wang reported off-list that a RAS HWPOISON-SOFT test case failed and
> bisected it to the commit 479f854a207c ("mm, page_alloc: defer debugging
> checks of pages allocated from the PCP"). The problem is that a page that
> was poisoned with madvise() is reused. The commit removed a check that
> would trigger if DEBUG_VM was enabled but re-enabling the check only
> fixes the problem as a side-effect by printing a bad_page warning and
> recovering.
> 
> The root of the problem is that a madvise() can leave a poisoned on
> the per-cpu list.  This patch drains all per-cpu lists after pages are
> poisoned so that they will not be reused. Wendy reports that the test case
> in question passes with this patch applied.  While this could be done in
> a targeted fashion, it is over-complicated for such a rare operation.
> 
> Fixes: 479f854a207c ("mm, page_alloc: defer debugging checks of pages allocated from the PCP")
> Reported-and-tested-by: Wang, Wendy <wendy.wang@...el.com>
> Cc: stable@...nel.org
> Signed-off-by: Mel Gorman <mgorman@...hsingularity.net>

Acked-by: Vlastimil Babka <vbabka@...e.cz>

> ---
>  mm/madvise.c | 6 ++++++
>  1 file changed, 6 insertions(+)
> 
> diff --git a/mm/madvise.c b/mm/madvise.c
> index 23ed525bc2bc..4d7d1e5ddba9 100644
> --- a/mm/madvise.c
> +++ b/mm/madvise.c
> @@ -613,6 +613,7 @@ static int madvise_inject_error(int behavior,
>  		unsigned long start, unsigned long end)
>  {
>  	struct page *page;
> +	struct zone *zone;
>  
>  	if (!capable(CAP_SYS_ADMIN))
>  		return -EPERM;
> @@ -646,6 +647,11 @@ static int madvise_inject_error(int behavior,
>  		if (ret)
>  			return ret;
>  	}
> +
> +	/* Ensure that all poisoned pages are removed from per-cpu lists */
> +	for_each_populated_zone(zone)
> +		drain_all_pages(zone);
> +
>  	return 0;
>  }
>  #endif
> 
> --
> To unsubscribe, send a message with 'unsubscribe linux-mm' in
> the body to majordomo@...ck.org.  For more info on Linux MM,
> see: http://www.linux-mm.org/ .
> Don't email: <a href=mailto:"dont@...ck.org"> email@...ck.org </a>
>