linux-kernel - Re: [PATCH 2/3] staging: erofs: fix illegal address access under memory pressure

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Wed, 27 Feb 2019 20:43:54 +0800
From:   Chao Yu <yuchao0@...wei.com>
To:     Gao Xiang <gaoxiang25@...wei.com>,
        Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
        <devel@...verdev.osuosl.org>
CC:     LKML <linux-kernel@...r.kernel.org>,
        <linux-erofs@...ts.ozlabs.org>, "Chao Yu" <chao@...nel.org>,
        Miao Xie <miaoxie@...wei.com>, <weidu.du@...wei.com>,
        Fang Wei <fangwei1@...wei.com>, <stable@...r.kernel.org>
Subject: Re: [PATCH 2/3] staging: erofs: fix illegal address access under
 memory pressure

On 2019/2/27 13:33, Gao Xiang wrote:
> Considering a read request with two decompressed file pages,
> If a decompression work cannot be started on the previous page
> due to memory pressure but in-memory LTP map lookup is done,
> builder->work should be still NULL.
> 
> Moreover, if the current page also belongs to the same map,
> it won't try to start the decompression work again and then
> run into trouble.
> 
> This patch aims to solve the above issue only with little changes
> as much as possible in order to make the fix backport easier.
> 
> kernel message is:
> <4>[1051408.015930s]SLUB: Unable to allocate memory on node -1, gfp=0x2408040(GFP_NOFS|__GFP_ZERO)
> <4>[1051408.015930s]  cache: erofs_compress, object size: 144, buffer size: 144, default order: 0, min order: 0
> <4>[1051408.015930s]  node 0: slabs: 98, objs: 2744, free: 0
>   * Cannot allocate the decompression work
> 
> <3>[1051408.015960s]erofs: z_erofs_vle_normalaccess_readpages, readahead error at page 1008 of nid 5391488
>   * Note that the previous page was failed to read
> 
> <0>[1051408.015960s]Internal error: Accessing user space memory outside uaccess.h routines: 96000005 [#1] PREEMPT SMP
> ...
> <4>[1051408.015991s]Hardware name: kirin710 (DT)
> ...
> <4>[1051408.016021s]PC is at z_erofs_vle_work_add_page+0xa0/0x17c
> <4>[1051408.016021s]LR is at z_erofs_do_read_page+0x12c/0xcf0
> ...
> <4>[1051408.018096s][<ffffff80c6fb0fd4>] z_erofs_vle_work_add_page+0xa0/0x17c
> <4>[1051408.018096s][<ffffff80c6fb3814>] z_erofs_vle_normalaccess_readpages+0x1a0/0x37c
> <4>[1051408.018096s][<ffffff80c6d670b8>] read_pages+0x70/0x190
> <4>[1051408.018127s][<ffffff80c6d6736c>] __do_page_cache_readahead+0x194/0x1a8
> <4>[1051408.018127s][<ffffff80c6d59318>] filemap_fault+0x398/0x684
> <4>[1051408.018127s][<ffffff80c6d8a9e0>] __do_fault+0x8c/0x138
> <4>[1051408.018127s][<ffffff80c6d8f90c>] handle_pte_fault+0x730/0xb7c
> <4>[1051408.018127s][<ffffff80c6d8fe04>] __handle_mm_fault+0xac/0xf4
> <4>[1051408.018157s][<ffffff80c6d8fec8>] handle_mm_fault+0x7c/0x118
> <4>[1051408.018157s][<ffffff80c8c52998>] do_page_fault+0x354/0x474
> <4>[1051408.018157s][<ffffff80c8c52af8>] do_translation_fault+0x40/0x48
> <4>[1051408.018157s][<ffffff80c6c002f4>] do_mem_abort+0x80/0x100
> <4>[1051408.018310s]---[ end trace 9f4009a3283bd78b ]---
> 
> Fixes: 3883a79abd02 ("staging: erofs: introduce VLE decompression support")
> Cc: <stable@...r.kernel.org> # 4.19+
> Signed-off-by: Gao Xiang <gaoxiang25@...wei.com>

Reviewed-by: Chao Yu <yuchao0@...wei.com>

Thanks,