linux-kernel - Re: [PATCH -V9 07/21] swap: Support PMD swap mapping when splitting huge PMD

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Tue, 18 Dec 2018 12:54:44 -0800
From:   Daniel Jordan <daniel.m.jordan@...cle.com>
To:     Huang Ying <ying.huang@...el.com>
Cc:     Andrew Morton <akpm@...ux-foundation.org>, linux-mm@...ck.org,
        linux-kernel@...r.kernel.org,
        "Kirill A. Shutemov" <kirill.shutemov@...ux.intel.com>,
        Andrea Arcangeli <aarcange@...hat.com>,
        Michal Hocko <mhocko@...nel.org>,
        Johannes Weiner <hannes@...xchg.org>,
        Shaohua Li <shli@...nel.org>, Hugh Dickins <hughd@...gle.com>,
        Minchan Kim <minchan@...nel.org>,
        Rik van Riel <riel@...hat.com>,
        Dave Hansen <dave.hansen@...ux.intel.com>,
        Naoya Horiguchi <n-horiguchi@...jp.nec.com>,
        Zi Yan <zi.yan@...rutgers.edu>,
        Daniel Jordan <daniel.m.jordan@...cle.com>,
        aneesh.kumar@...ux.vnet.ibm.com
Subject: Re: [PATCH -V9 07/21] swap: Support PMD swap mapping when splitting
 huge PMD

+Aneesh

On Fri, Dec 14, 2018 at 02:27:40PM +0800, Huang Ying wrote:
> diff --git a/mm/huge_memory.c b/mm/huge_memory.c
> index bd2543e10938..49df3e7c96c7 100644
> --- a/mm/huge_memory.c
> +++ b/mm/huge_memory.c

> +int split_swap_cluster_map(swp_entry_t entry)
        ...
> +	VM_BUG_ON(!IS_ALIGNED(offset, SWAPFILE_CLUSTER));

Hi Ying, I crashed on this in v6 as reported and it still dies on me now.

> @@ -2150,6 +2185,9 @@ static void __split_huge_pmd_locked(struct vm_area_struct *vma, pmd_t *pmd,
        ...
> +	if (IS_ENABLED(CONFIG_THP_SWAP) && is_swap_pmd(old_pmd))
> +		return __split_huge_swap_pmd(vma, haddr, pmd);

Problem is 'pmd' is passed here, which has been pmdp_invalidate()ed under the
assumption that it is not a swap entry.  pmd's pfn bits get inverted for L1TF,
so the swap entry gets corrupted and this BUG is the first place that notices.

I don't see a reason to invalidate so soon, so what about just moving the
invalidation down, past the migration/swap checks?