| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <4ebd0429-f715-d523-4c09-43fa2c3bc338@oracle.com>
Date: Wed, 27 May 2020 17:01:23 -0700
From: Mike Kravetz <mike.kravetz@...cle.com>
To: Miklos Szeredi <miklos@...redi.hu>
Cc: Colin Walters <walters@...bum.org>,
syzbot <syzbot+d6ec23007e951dadf3de@...kaller.appspotmail.com>,
Andrew Morton <akpm@...ux-foundation.org>,
linux-fsdevel@...r.kernel.org, linux-kernel@...r.kernel.org,
linux-mm <linux-mm@...ck.org>,
Miklos Szeredi <mszeredi@...hat.com>,
syzkaller-bugs <syzkaller-bugs@...glegroups.com>,
Al Viro <viro@...iv.linux.org.uk>,
linux-unionfs@...r.kernel.org
Subject: Re: kernel BUG at mm/hugetlb.c:LINE!
On 5/22/20 3:05 AM, Miklos Szeredi wrote:
> On Wed, May 20, 2020 at 10:27:15AM -0700, Mike Kravetz wrote:
>
>> I am fairly confident it is all about checking limits and alignment. The
>> filesystem knows if it can/should align to base or huge page size. DAX has
>> some interesting additional restrictions, and several 'traditional' filesystems
>> check if they are 'on DAX'.
>
>
> Okay, I haven't looked at DAX vs. overlay. I'm sure it's going to come up at
> some point, if it hasn't already.
>
>>
>> In a previous e-mail, you suggested hugetlb_get_unmapped_area could do the
>> length adjustment in hugetlb_get_unmapped_area (generic and arch specific).
>> I agree, although there may be the need to add length overflow checks in
>> these routines (after round up) as this is done in core code now. However,
>> this can be done as a separate cleanup patch.
>>
>> In any case, we need to get the core mmap code to call filesystem specific
>> get_unmapped_area if on a union/overlay. The patch I suggested does this
>> by simply calling real_file to determine if there is a filesystem specific
>> get_unmapped_area. The other approach would be to provide an overlayfs
>> get_unmapped_area that calls the underlying filesystem get_unmapped_area.
>
> That latter is what's done for all other stacked operations in overlayfs.
>
> Untested patch below.
>
Thanks Miklos!
We still need the 'real_file()' routine for is_file_hugepages. So combining
these, I propose the following patch. It addresses the known issue as well
as potential issues with is_file_hugepages returning incorrect information.
I don't really like a separate header file for real_file, but I can not
think of any good place to put it.
Let me know what you think,
>From 33f6bbd19406108b61a4113b1ec8e4e6888cd482 Mon Sep 17 00:00:00 2001
From: Mike Kravetz <mike.kravetz@...cle.com>
Date: Wed, 27 May 2020 16:58:58 -0700
Subject: [PATCH v2] ovl: provide real_file() and overlayfs get_unmapped_area()
If a file is on a union/overlay, then the 'struct file *' will have
overlayfs file operations. The routine is_file_hugepages() compares
f->f_op to hugetlbfs_file_operations to determine if it is a hugetlbfs
file. If a hugetlbfs file is on a union/overlay, this comparison is
false and is_file_hugepages() incorrectly indicates the underlying
file is not hugetlbfs. One result of this is a BUG as shown in [1].
mmap uses is_file_hugepages() because hugetlbfs files have different
alignment restrictions. In addition, mmap code would like to use the
filesystem specific get_unmapped_area() routine if one is defined.
To address this issue,
- Add a new routine real_file() which will return the underlying file.
- Update is_file_hugepages to get the real file.
- Add get_unmapped_area f_op to oerrlayfs to call underlying routine.
[1] https://lore.kernel.org/linux-mm/000000000000b4684e05a2968ca6@google.com/
Reported-by: syzbot+d6ec23007e951dadf3de@...kaller.appspotmail.com
Signed-off-by: Miklos Szeredi <miklos@...redi.hu>
Signed-off-by: Mike Kravetz <mike.kravetz@...cle.com>
---
fs/overlayfs/file.c | 13 +++++++++++++
include/linux/hugetlb.h | 3 +++
include/linux/overlayfs.h | 27 +++++++++++++++++++++++++++
3 files changed, 43 insertions(+)
create mode 100644 include/linux/overlayfs.h
diff --git a/fs/overlayfs/file.c b/fs/overlayfs/file.c
index 87c362f65448..cc020e1c72d5 100644
--- a/fs/overlayfs/file.c
+++ b/fs/overlayfs/file.c
@@ -12,6 +12,7 @@
#include <linux/splice.h>
#include <linux/mm.h>
#include <linux/fs.h>
+#include <linux/overlayfs.h>
#include "overlayfs.h"
struct ovl_aio_req {
@@ -757,6 +758,17 @@ static loff_t ovl_remap_file_range(struct file *file_in, loff_t pos_in,
remap_flags, op);
}
+static unsigned long ovl_get_unmapped_area(struct file *file,
+ unsigned long uaddr, unsigned long len,
+ unsigned long pgoff, unsigned long flags)
+{
+ struct file *realfile = real_file(file);
+
+ return (realfile->f_op->get_unmapped_area ?:
+ current->mm->get_unmapped_area)(realfile,
+ uaddr, len, pgoff, flags);
+}
+
const struct file_operations ovl_file_operations = {
.open = ovl_open,
.release = ovl_release,
@@ -774,6 +786,7 @@ const struct file_operations ovl_file_operations = {
.copy_file_range = ovl_copy_file_range,
.remap_file_range = ovl_remap_file_range,
+ .get_unmapped_area = ovl_get_unmapped_area,
};
int __init ovl_aio_request_cache_init(void)
diff --git a/include/linux/hugetlb.h b/include/linux/hugetlb.h
index 43a1cef8f0f1..fb22c0a7474a 100644
--- a/include/linux/hugetlb.h
+++ b/include/linux/hugetlb.h
@@ -9,6 +9,7 @@
#include <linux/cgroup.h>
#include <linux/list.h>
#include <linux/kref.h>
+#include <linux/overlayfs.h>
#include <asm/pgtable.h>
struct ctl_table;
@@ -437,6 +438,8 @@ struct file *hugetlb_file_setup(const char *name, size_t size, vm_flags_t acct,
static inline bool is_file_hugepages(struct file *file)
{
+ file = real_file(file);
+
if (file->f_op == &hugetlbfs_file_operations)
return true;
diff --git a/include/linux/overlayfs.h b/include/linux/overlayfs.h
new file mode 100644
index 000000000000..eecdfda0286f
--- /dev/null
+++ b/include/linux/overlayfs.h
@@ -0,0 +1,27 @@
+/* SPDX-License-Identifier: GPL-2.0 */
+#ifndef _LINUX_OVERLAYFS_H
+#define _LINUX_OVERLAYFS_H
+
+#include <linux/fs.h>
+
+extern const struct file_operations ovl_file_operations;
+
+#ifdef CONFIG_OVERLAY_FS
+/*
+ * If file is on a union/overlay, then return the underlying real file.
+ * Otherwise return the file itself.
+ */
+static inline struct file *real_file(struct file *file)
+{
+ while (unlikely(file->f_op == &ovl_file_operations))
+ file = file->private_data;
+ return file;
+}
+#else
+static inline struct file *real_file(struct file *file)
+{
+ return file;
+}
+#endif
+
+#endif /* _LINUX_OVERLAYFS_H */
--
2.25.4
Powered by blists - more mailing lists