| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <59672e74-37f7-ea45-19b0-4de2fee7c58d@redhat.com>
Date: Fri, 1 Feb 2019 15:27:55 +0100
From: David Hildenbrand <david@...hat.com>
To: linux-mm@...ck.org
Cc: linux-kernel@...r.kernel.org,
Andrew Morton <akpm@...ux-foundation.org>,
Mel Gorman <mgorman@...hsingularity.net>,
"Kirill A. Shutemov" <kirill.shutemov@...ux.intel.com>,
Michal Hocko <mhocko@...e.com>,
Naoya Horiguchi <n-horiguchi@...jp.nec.com>,
Jan Kara <jack@...e.cz>,
Andrea Arcangeli <aarcange@...hat.com>,
Dominik Brodowski <linux@...inikbrodowski.net>,
Matthew Wilcox <willy@...radead.org>,
Vratislav Bendel <vbendel@...hat.com>,
Rafael Aquini <aquini@...hat.com>,
Konstantin Khlebnikov <k.khlebnikov@...sung.com>,
Minchan Kim <minchan@...nel.org>,
Sasha Levin <sashal@...nel.org>, stable@...r.kernel.org
Subject: Re: [PATCH v2 for-4.4-stable] mm: migrate: don't rely on
__PageMovable() of newpage after unlocking it
On 01.02.19 14:43, David Hildenbrand wrote:
> This is the backport for 4.4-stable.
>
> We had a race in the old balloon compaction code before commit b1123ea6d3b3
> ("mm: balloon: use general non-lru movable page feature") refactored it
> that became visible after backporting commit 195a8c43e93d
> ("virtio-balloon: deflate via a page list") without the refactoring.
>
> The bug existed from commit d6d86c0a7f8d ("mm/balloon_compaction: redesign
> ballooned pages management") till commit b1123ea6d3b3 ("mm: balloon: use
> general non-lru movable page feature"). commit d6d86c0a7f8d
> ("mm/balloon_compaction: redesign ballooned pages management") was
> backported to 3.12, so the broken kernels are stable kernels [3.12 - 4.7].
>
> There was a subtle race between dropping the page lock of the newpage
> in __unmap_and_move() and checking for
> __is_movable_balloon_page(newpage).
>
> Just after dropping this page lock, virtio-balloon could go ahead and
> deflate the newpage, effectively dequeueing it and clearing PageBalloon,
> in turn making __is_movable_balloon_page(newpage) fail.
>
> This resulted in dropping the reference of the newpage via
> putback_lru_page(newpage) instead of put_page(newpage), leading to
> page->lru getting modified and a !LRU page ending up in the LRU lists.
> With commit 195a8c43e93d ("virtio-balloon: deflate via a page list")
> backported, one would suddenly get corrupted lists in
> release_pages_balloon():
> - WARNING: CPU: 13 PID: 6586 at lib/list_debug.c:59 __list_del_entry+0xa1/0xd0
> - list_del corruption. prev->next should be ffffe253961090a0, but was dead000000000100
>
> Nowadays this race is no longer possible, but it is hidden behind very
> ugly handling of __ClearPageMovable() and __PageMovable().
>
> __ClearPageMovable() will not make __PageMovable() fail, only
> PageMovable(). So the new check (__PageMovable(newpage)) will still hold
> even after newpage was dequeued by virtio-balloon.
>
> If anybody would ever change that special handling, the BUG would be
> introduced again. So instead, make it explicit and use the information
> of the original isolated page before migration.
>
> This patch can be backported fairly easy to stable kernels (in contrast
> to the refactoring).
>
> Cc: Andrew Morton <akpm@...ux-foundation.org>
> Cc: Mel Gorman <mgorman@...hsingularity.net>
> Cc: "Kirill A. Shutemov" <kirill.shutemov@...ux.intel.com>
> Cc: Michal Hocko <mhocko@...e.com>
> Cc: Naoya Horiguchi <n-horiguchi@...jp.nec.com>
> Cc: Jan Kara <jack@...e.cz>
> Cc: Andrea Arcangeli <aarcange@...hat.com>
> Cc: Dominik Brodowski <linux@...inikbrodowski.net>
> Cc: Matthew Wilcox <willy@...radead.org>
> Cc: Vratislav Bendel <vbendel@...hat.com>
> Cc: Rafael Aquini <aquini@...hat.com>
> Cc: Konstantin Khlebnikov <k.khlebnikov@...sung.com>
> Cc: Minchan Kim <minchan@...nel.org>
> Cc: Sasha Levin <sashal@...nel.org>
> Cc: stable@...r.kernel.org # 3.12 - 4.7
> Fixes: d6d86c0a7f8d ("mm/balloon_compaction: redesign ballooned pages management")
> Reported-by: Vratislav Bendel <vbendel@...hat.com>
> Acked-by: Michal Hocko <mhocko@...e.com>
> Acked-by: Rafael Aquini <aquini@...hat.com>
> Signed-off-by: David Hildenbrand <david@...hat.com>
> ---
> mm/migrate.c | 7 ++++++-
> 1 file changed, 6 insertions(+), 1 deletion(-)
>
> diff --git a/mm/migrate.c b/mm/migrate.c
> index afedcfab60e2..3304c98f9a78 100644
> --- a/mm/migrate.c
> +++ b/mm/migrate.c
> @@ -936,6 +936,7 @@ static ICE_noinline int unmap_and_move(new_page_t get_new_page,
> int rc = MIGRATEPAGE_SUCCESS;
> int *result = NULL;
> struct page *newpage;
> + bool is_lru = !isolated_balloon_page(page);
>
> newpage = get_new_page(page, private, &result);
> if (!newpage)
> @@ -984,10 +985,14 @@ out:
> * If migration was not successful and there's a freeing callback, use
> * it. Otherwise, putback_lru_page() will drop the reference grabbed
> * during isolation.
> + *
> + * Use the old state of the isolated source page to determine if we
> + * migrated a LRU page. newpage was already unlocked and possibly
> + * modified by its owner - don't rely on the page state.
> */
> if (put_new_page)
> put_new_page(newpage, private);
> - else if (unlikely(__is_movable_balloon_page(newpage))) {
And to be save, we should turn this into
else if (rc == MIGRATEPAGE_SUCCESS && unlikely(!is_lru)) {
But will resend this either way as already mentioned to Greg.
> + else if (unlikely(!is_lru)) {
> /* drop our reference, page already in the balloon */
> put_page(newpage);
> } else
>
--
Thanks,
David / dhildenb
Powered by blists - more mailing lists