linux-kernel - Re: [PATCH] mm/mempolicy: add node_empty check in SYSC_migrate

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <7086c6ea-b721-684e-fe3d-ff59ae1d78ed@suse.cz>
Date:   Wed, 18 Oct 2017 09:54:05 +0200
From:   Vlastimil Babka <vbabka@...e.cz>
To:     Yisheng Xie <xieyisheng1@...wei.com>, akpm@...ux-foundation.org,
        mhocko@...e.com, mingo@...nel.org, rientjes@...gle.com,
        n-horiguchi@...jp.nec.com, salls@...ucsb.edu
Cc:     linux-mm@...ck.org, linux-kernel@...r.kernel.org,
        will.deacon@....com, tanxiaojun@...wei.com,
        Linux API <linux-api@...r.kernel.org>
Subject: Re: [PATCH] mm/mempolicy: add node_empty check in SYSC_migrate_pages

+CC linux-api

On 10/18/2017 03:37 AM, Yisheng Xie wrote:
> As Xiaojun reported the ltp of migrate_pages01 will failed on ARCH arm64
> system whoes has 4 nodes[0...3], all have memory and CONFIG_NODES_SHIFT=2:
> 
> migrate_pages01    0  TINFO  :  test_invalid_nodes
> migrate_pages01   14  TFAIL  :  migrate_pages_common.c:45: unexpected failure - returned value = 0, expected: -1
> migrate_pages01   15  TFAIL  :  migrate_pages_common.c:55: call succeeded unexpectedly
> 
> In this case the test_invalid_nodes of migrate_pages01 will call:
> SYSC_migrate_pages as:
> 
> migrate_pages(0, , {0x0000000000000001}, 64, , {0x0000000000000010}, 64) = 0

is 64 here the maxnode parameter of migrate_pages() ?

> For MAX_NUMNODES is 4, so 0x10 nodemask will tread as empty set which makes
> 	nodes_subset(*new, node_states[N_MEMORY])

According to manpage of migrate_pages:

        EINVAL The value specified by maxnode exceeds a kernel-imposed
limit.  Or, old_nodes or new_nodes specifies one or more node IDs that
are greater than the maximum supported node ID.  Or, none of the node
IDs specified by new_nodes are on-line and allowed by the process's
current cpuset context, or none of the specified nodes contain memory.

if maxnode parameter is 64, but MAX_NUMNODES ("kernel-imposed limit") is
4, we should get EINVAL just because of that. I don't see such check in
the migrate_pages implementation though. But then at least the
"new_nodes specifies one or more node IDs that are greater than the
maximum supported node ID" part should trigger here, because you have
node number 8 set in the new_nodes nodemask, right?
get_nodes() should be checking this according to comment:

        /* When the user specified more nodes than supported just check
           if the non supported part is all zero. */

Somehow that doesn't seem to work then? I think we should look into
this. Your patch may still be needed, or not, after that is resolved.

> return true, as empty set is subset of any set.
> 
> So this is a common issue which also can happens in X86_64 system eg. 8 nodes[0..7],
> all with memory and CONFIG_NODES_SHIFT=3. Fix it by adding node_empty check in
> SYSC_migrate_pages.
> 
> Reported-by: Tan Xiaojun <tanxiaojun@...wei.com>
> Signed-off-by: Yisheng Xie <xieyisheng1@...wei.com>
> ---
>  mm/mempolicy.c | 5 +++++
>  1 file changed, 5 insertions(+)
> 
> diff --git a/mm/mempolicy.c b/mm/mempolicy.c
> index a2af6d5..1dfd3cc 100644
> --- a/mm/mempolicy.c
> +++ b/mm/mempolicy.c
> @@ -1388,6 +1388,11 @@ static int copy_nodes_to_user(unsigned long __user *mask, unsigned long maxnode,
>  	if (err)
>  		goto out;
>  
> +	if (nodes_empty(*new)) {
> +		err = -EINVAL;
> +		goto out;
> +	}
> +
>  	/* Find the mm_struct */
>  	rcu_read_lock();
>  	task = pid ? find_task_by_vpid(pid) : current;
>