linux-kernel - Re: [PATCH] mm,madvise: bugfix of madvise systemcall infinite loop under special circumstances.

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Mon, 27 Nov 2017 12:58:47 +0100
From:   Michal Hocko <mhocko@...nel.org>
To:     guoxuenan <guoxuenan@...wei.com>
Cc:     akpm@...ux-foundation.org, minchan@...nel.org, linux-mm@...ck.org,
        linux-kernel@...r.kernel.org, yi.zhang@...wei.com,
        miaoxie@...wei.com, rppt@...ux.vnet.ibm.com, shli@...com,
        aarcange@...hat.com, mgorman@...hsingularity.net,
        kirill.shutemov@...ux.intel.com, rientjes@...gle.com,
        khandual@...ux.vnet.ibm.com, riel@...hat.com
Subject: Re: [PATCH] mm,madvise: bugfix of madvise systemcall infinite loop
 under special circumstances.

On Mon 27-11-17 19:53:18, guoxuenan wrote:
> From: chenjie <chenjie6@...wei.com>
> 
> The madvise() system call supported a set of "conventional" advice values,
> the MADV_WILLNEED parameter has possibility of triggering an infinite loop under
> direct access mode(DAX).
> 
> Infinite loop situation:
> 1、initial state [ start = vam->vm_start < vam->vm_end < end ].
> 2、madvise_vma() using MADV_WILLNEED parameter;
>    madvise_vma() -> madvise_willneed() -> return 0 && the value of [prev] is not updated.
> 
> In function SYSCALL_DEFINE3(madvise,...)
> When [start = vam->vm_start] the program enters "for" loop,
> find_vma_prev() will set the pointer vma and the pointer prev(prev = vam->vm_prev).
> Normally ,madvise_vma() will always move the pointer prev ,but when use DAX mode,
> it will never update the value of [prev].
> 
> =======================================================================
> SYSCALL_DEFINE3(madvise,...)
> {
> 	[...]
> 	//start = vam->start  => prev=vma->prev
>     vma = find_vma_prev(current->mm, start, &prev);
> 	[...]
> 	for(;;)
> 	{
> 	      update [start = vma->vm_start]
> 
> 	con0: if (start >= end)                 //false always;
> 	    goto out;
> 	       tmp = vma->vm_end;
> 
> 	//do not update [prev] and always return 0;
> 	       error = madvise_willneed();
> 
> 	con1: if (error)                        //false always;
> 	    goto out;
> 
> 	//[ vam->vm_start < start = vam->vm_end  <end ]
> 	       update [start = tmp ]
> 
> 	con2: if (start >= end)                 //false always ;
> 	    goto out;
> 
> 	//because of pointer [prev] did not change,[vma] keep as it was;
> 	       update [ vma = prev->vm_next ]
> 	}
> 	[...]
> }
> =======================================================================
> After the first cycle ;it will always keep
> vam->vm_start < start = vam->vm_end  < end  && vma = prev->vm_next;
> since Circulation exit conditions (con{0,1,2}) will never meet ,the
> program stuck in infinite loop.

I find your changelog a bit hard to parse. What would you think about
the following:
"
MADVISE_WILLNEED has always been a noop for DAX (formerly XIP) mappings.
Unfortunatelly madvise_willneed doesn't communicate this information
properly to the generic madvise syscall implementation. The calling
converion is quite subtle there. madvise_vma is supposed to either
return an error or update &prev otherwise the main loop will never
advance to the next vma and it will keep looping for ever without a way
to get out of the kernel.

It seems this has been broken since introduced. Nobody has noticed
because nobody seems to be using MADVISE_WILLNEED on these DAX mappings.

Fixes: fe77ba6f4f97 ("[PATCH] xip: madvice/fadvice: execute in place")
Cc: stable
"

> Signed-off-by: chenjie <chenjie6@...wei.com>
> Signed-off-by: guoxuenan <guoxuenan@...wei.com>

Other than that
Acked-by: Michal Hocko <mhocko@...e.com>

> ---
>  mm/madvise.c | 4 +---
>  1 file changed, 1 insertion(+), 3 deletions(-)
> 
> diff --git a/mm/madvise.c b/mm/madvise.c
> index 375cf32..751e97a 100644
> --- a/mm/madvise.c
> +++ b/mm/madvise.c
> @@ -276,15 +276,14 @@ static long madvise_willneed(struct vm_area_struct *vma,
>  {
>  	struct file *file = vma->vm_file;
>  
> +	*prev = vma;
>  #ifdef CONFIG_SWAP
>  	if (!file) {
> -		*prev = vma;
>  		force_swapin_readahead(vma, start, end);
>  		return 0;
>  	}
>  
>  	if (shmem_mapping(file->f_mapping)) {
> -		*prev = vma;
>  		force_shm_swapin_readahead(vma, start, end,
>  					file->f_mapping);
>  		return 0;
> @@ -299,7 +298,6 @@ static long madvise_willneed(struct vm_area_struct *vma,
>  		return 0;
>  	}
>  
> -	*prev = vma;
>  	start = ((start - vma->vm_start) >> PAGE_SHIFT) + vma->vm_pgoff;
>  	if (end > vma->vm_end)
>  		end = vma->vm_end;
> -- 
> 2.9.5
> 

-- 
Michal Hocko
SUSE Labs