lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Sat, 7 Oct 2017 03:31:52 +0100 From: Al Viro <viro@...IV.linux.org.uk> To: Jia-Ju Bai <baijiaju1990@....com> Cc: bcrl@...ck.org, linux-aio@...ck.org, linux-fsdevel@...r.kernel.org, linux-kernel@...r.kernel.org Subject: Re: [BUG] fs/aio: A possible sleep-in-atomic bug in aio_migratepage On Sat, Oct 07, 2017 at 09:36:48AM +0800, Jia-Ju Bai wrote: > According to fs/aio.c, cond_resched is called under a spinlock, > and the function call path is: > aio_migratepage (acquire the spinlock) > migrate_page_copy > copy_huge_page > __copy_gigantic_page > cond_resched > might_sleep > > This bug is found by my static analysis tool and my code review. > A possible fix is to remove cond_resched in __copy_gigantic_page. How the hell would a huge page end up in page cache of inode created by aio_private_file()???
Powered by blists - more mailing lists