linux-kernel - [PATCH] mm/mempolicy: add node_empty check in SYSC_migrate

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <1508290660-60619-1-git-send-email-xieyisheng1@huawei.com>
Date:   Wed, 18 Oct 2017 09:37:40 +0800
From:   Yisheng Xie <xieyisheng1@...wei.com>
To:     <akpm@...ux-foundation.org>, <vbabka@...e.cz>, <mhocko@...e.com>,
        <mingo@...nel.org>, <rientjes@...gle.com>,
        <n-horiguchi@...jp.nec.com>, <salls@...ucsb.edu>
CC:     <linux-mm@...ck.org>, <linux-kernel@...r.kernel.org>,
        <will.deacon@....com>, <tanxiaojun@...wei.com>
Subject: [PATCH] mm/mempolicy: add node_empty check in SYSC_migrate_pages

As Xiaojun reported the ltp of migrate_pages01 will failed on ARCH arm64
system whoes has 4 nodes[0...3], all have memory and CONFIG_NODES_SHIFT=2:

migrate_pages01    0  TINFO  :  test_invalid_nodes
migrate_pages01   14  TFAIL  :  migrate_pages_common.c:45: unexpected failure - returned value = 0, expected: -1
migrate_pages01   15  TFAIL  :  migrate_pages_common.c:55: call succeeded unexpectedly

In this case the test_invalid_nodes of migrate_pages01 will call:
SYSC_migrate_pages as:

migrate_pages(0, , {0x0000000000000001}, 64, , {0x0000000000000010}, 64) = 0

For MAX_NUMNODES is 4, so 0x10 nodemask will tread as empty set which makes
	nodes_subset(*new, node_states[N_MEMORY])

return true, as empty set is subset of any set.

So this is a common issue which also can happens in X86_64 system eg. 8 nodes[0..7],
all with memory and CONFIG_NODES_SHIFT=3. Fix it by adding node_empty check in
SYSC_migrate_pages.

Reported-by: Tan Xiaojun <tanxiaojun@...wei.com>
Signed-off-by: Yisheng Xie <xieyisheng1@...wei.com>
---
 mm/mempolicy.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/mm/mempolicy.c b/mm/mempolicy.c
index a2af6d5..1dfd3cc 100644
--- a/mm/mempolicy.c
+++ b/mm/mempolicy.c
@@ -1388,6 +1388,11 @@ static int copy_nodes_to_user(unsigned long __user *mask, unsigned long maxnode,
 	if (err)
 		goto out;
 
+	if (nodes_empty(*new)) {
+		err = -EINVAL;
+		goto out;
+	}
+
 	/* Find the mm_struct */
 	rcu_read_lock();
 	task = pid ? find_task_by_vpid(pid) : current;
-- 
1.7.12.4