linux-kernel - [PATCH] fs/dax: Fix pmd vs pte conflict detection

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:   Sat, 19 Oct 2019 09:26:19 -0700
From:   Dan Williams <dan.j.williams@...el.com>
To:     linux-fsdevel@...r.kernel.org
Cc:     Jeff Smits <jeff.smits@...el.com>,
        Doug Nelson <doug.nelson@...el.com>, stable@...r.kernel.org,
        Jan Kara <jack@...e.cz>,
        "Matthew Wilcox \(Oracle\)" <willy@...radead.org>,
        linux-nvdimm@...ts.01.org, linux-kernel@...r.kernel.org
Subject: [PATCH] fs/dax: Fix pmd vs pte conflict detection

Check for NULL entries before checking the entry order, otherwise NULL
is misinterpreted as a present pte conflict. The 'order' check needs to
happen before the locked check as an unlocked entry at the wrong order
must fallback to lookup the correct order.

Reported-by: Jeff Smits <jeff.smits@...el.com>
Reported-by: Doug Nelson <doug.nelson@...el.com>
Cc: <stable@...r.kernel.org>
Fixes: 23c84eb78375 ("dax: Fix missed wakeup with PMD faults")
Cc: Jan Kara <jack@...e.cz>
Cc: Matthew Wilcox (Oracle) <willy@...radead.org>
Signed-off-by: Dan Williams <dan.j.williams@...el.com>
---
 fs/dax.c |    5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/fs/dax.c b/fs/dax.c
index a71881e77204..08160011d94c 100644
--- a/fs/dax.c
+++ b/fs/dax.c
@@ -221,10 +221,11 @@ static void *get_unlocked_entry(struct xa_state *xas, unsigned int order)
 
 	for (;;) {
 		entry = xas_find_conflict(xas);
+		if (!entry || WARN_ON_ONCE(!xa_is_value(entry)))
+			return entry;
 		if (dax_entry_order(entry) < order)
 			return XA_RETRY_ENTRY;
-		if (!entry || WARN_ON_ONCE(!xa_is_value(entry)) ||
-				!dax_is_locked(entry))
+		if (!dax_is_locked(entry))
 			return entry;
 
 		wq = dax_entry_waitqueue(xas, entry, &ewait.key);