linux-kernel - Re: kernel BUG at mm/hugetlb.c:LINE!

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAJfpegsy5vzO5e3DJGTrpXoGRTzjegoLaDdzheDeQhw+uokYnQ@mail.gmail.com>
Date:   Mon, 18 May 2020 13:12:47 +0200
From:   Miklos Szeredi <miklos@...redi.hu>
To:     Mike Kravetz <mike.kravetz@...cle.com>
Cc:     syzbot <syzbot+d6ec23007e951dadf3de@...kaller.appspotmail.com>,
        Andrew Morton <akpm@...ux-foundation.org>,
        linux-fsdevel@...r.kernel.org, linux-kernel@...r.kernel.org,
        linux-mm@...ck.org, Miklos Szeredi <mszeredi@...hat.com>,
        syzkaller-bugs <syzkaller-bugs@...glegroups.com>,
        Al Viro <viro@...iv.linux.org.uk>
Subject: Re: kernel BUG at mm/hugetlb.c:LINE!

On Sat, May 16, 2020 at 12:15 AM Mike Kravetz <mike.kravetz@...cle.com> wrote:

> I started going down the path of creating a get_unmapped_area f_op for
> overlayfs.  That is pretty straight forward and works well.  But that
> did not take care of the is_file_hugepages() routine.  Recall that
> is_file_hugepages simply does if (file->f_op == &hugetlbfs_file_operations).
>
> I suppose I could add a specific overlayfs check like real_file here.  But,
> that does not seem like a clean solution.
>
> I also discovered other routines doing comparisons like
> if (file->f_op == <expected_fops>), they are:
> is_dma_buf_file()
> is_file_shm_hugepages()
> get_pipe_info()
> is_file_epoll()
>
> So, it seems that these routines are also impacted if operating on files
> in an overlayfs?

Those are non-filesystems, with the exception of
is_file_shm_hugepages(), the only caller of which is
is_file_hugepages().

> Any suggestions on how to move forward?  It seems like there may be the
> need for a real_file() routine?  I see a d_real dentry_op was added to
> deal with this issue for dentries.  Might we need something similiar for
> files (f_real)?
>
> Looking for suggestions as I do not normally work with this code.

And I'm not so familiar with hugepages code.  I'd suggest moving
length alignment into f_op->get_unmapped_area() and cleaning up other
special casing of hugetlb mappings, but it's probably far from
trivial...

So yeah, that leaves a real_file() helper or something similar.
Unlike the example I gave first it actually needs to be recursive:

static inline struct file *real_file(struct file *file)
{
    whole (unlikely(file->f_op == ovl_file_operations))
        file = file->private_data;
    return file;
}

Thanks,
Miklos