linux-kernel - Re: [PATCH 2/3] mm/memory_hotplug: harden try_offline

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Mon, 6 Jul 2020 09:57:50 +0200
From:   David Hildenbrand <david@...hat.com>
To:     Jia He <justin.he@....com>,
        Catalin Marinas <catalin.marinas@....com>,
        Will Deacon <will@...nel.org>
Cc:     Andrew Morton <akpm@...ux-foundation.org>,
        Mike Rapoport <rppt@...ux.ibm.com>,
        Baoquan He <bhe@...hat.com>,
        Chuhong Yuan <hslester96@...il.com>,
        linux-arm-kernel@...ts.infradead.org, linux-kernel@...r.kernel.org,
        linux-mm@...ck.org, Kaly Xin <Kaly.Xin@....com>
Subject: Re: [PATCH 2/3] mm/memory_hotplug: harden try_offline_node against
 bogus nid

On 06.07.20 03:19, Jia He wrote:
> When testing the remove_memory path of dax pmem, there will be a panic with
> call trace:
>   try_remove_memory+0x84/0x170
>   remove_memory+0x38/0x58
>   dev_dax_kmem_remove+0x3c/0x84 [kmem]
>   device_release_driver_internal+0xfc/0x1c8
>   device_release_driver+0x28/0x38
>   bus_remove_device+0xd4/0x158
>   device_del+0x160/0x3a0
>   unregister_dev_dax+0x30/0x68
>   devm_action_release+0x20/0x30
>   release_nodes+0x150/0x240
>   devres_release_all+0x6c/0x1d0
>   device_release_driver_internal+0x10c/0x1c8
>   driver_detach+0xac/0x170
>   bus_remove_driver+0x64/0x130
>   driver_unregister+0x34/0x60
>   dax_pmem_exit+0x14/0xffc4 [dax_pmem]
>   __arm64_sys_delete_module+0x18c/0x2d0
>   el0_svc_common.constprop.2+0x78/0x168
>   do_el0_svc+0x34/0xa0
>   el0_sync_handler+0xe0/0x188
>   el0_sync+0x164/0x180
> 
> It is caused by the bogus nid (-1). Although the root cause is pmem dax
> translates from pxm to node_id incorrectly due to numa_off, it is worth
> hardening the codes in try_offline_node(), quiting if !pgdat.
> 
> Signed-off-by: Jia He <justin.he@....com>
> ---
>  mm/memory_hotplug.c | 3 +++
>  1 file changed, 3 insertions(+)
> 
> diff --git a/mm/memory_hotplug.c b/mm/memory_hotplug.c
> index da374cd3d45b..e1e290577b45 100644
> --- a/mm/memory_hotplug.c
> +++ b/mm/memory_hotplug.c
> @@ -1680,6 +1680,9 @@ void try_offline_node(int nid)
>  	pg_data_t *pgdat = NODE_DATA(nid);
>  	int rc;
>  
> +	if (WARN_ON(!pgdat))
> +		return;
> +
>  	/*
>  	 * If the node still spans pages (especially ZONE_DEVICE), don't
>  	 * offline it. A node spans memory after move_pfn_range_to_zone(),
> 

Hm. If I am not wrong, somebody used add_memory() with another nid than
try_remove_memory()?

Or did we pass the node_possible(nid) check in add_memory_resource(),
and succeeded to add to nid==-1?

Having that said, this feels somewhat wrong, especially checking against
pgdat down in try_offline_node(). It really has to be the same nid as
used when adding - and that nid has to be sane.

-- 
Thanks,

David / dhildenb