linux-kernel - Re: [PATCH] mm: fix potential pte_unmap

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <8b1e52b7a07b9ff1be9badb73209abda@suse.de>
Date:   Fri, 16 Oct 2020 16:05:37 +0200
From:   osalvador@...e.de
To:     Michal Hocko <mhocko@...e.com>
Cc:     Shijie Luo <luoshijie1@...wei.com>, akpm@...ux-foundation.org,
        linux-mm@...ck.org, linux-kernel@...r.kernel.org,
        linmiaohe@...wei.com, linfeilong@...wei.com
Subject: Re: [PATCH] mm: fix potential pte_unmap_unlock pte error

On 2020-10-16 15:42, Michal Hocko wrote:
> OK, I finally managed to convince my friday brain to think and grasped
> what the code is intended to do. The loop is hairy and we want to
> prevent from spurious EIO when all the pages are on a proper node. So
> the check has to be done inside the loop. Anyway I would find the
> following fix less error prone and easier to follow
> diff --git a/mm/mempolicy.c b/mm/mempolicy.c
> index eddbe4e56c73..8cc1fc9c4d13 100644
> --- a/mm/mempolicy.c
> +++ b/mm/mempolicy.c
> @@ -525,7 +525,7 @@ static int queue_pages_pte_range(pmd_t *pmd,
> unsigned long addr,
>  	unsigned long flags = qp->flags;
>  	int ret;
>  	bool has_unmovable = false;
> -	pte_t *pte;
> +	pte_t *pte, *mapped_pte;
>  	spinlock_t *ptl;
> 
>  	ptl = pmd_trans_huge_lock(pmd, vma);
> @@ -539,7 +539,7 @@ static int queue_pages_pte_range(pmd_t *pmd,
> unsigned long addr,
>  	if (pmd_trans_unstable(pmd))
>  		return 0;
> 
> -	pte = pte_offset_map_lock(walk->mm, pmd, addr, &ptl);
> +	mapped_pte = pte = pte_offset_map_lock(walk->mm, pmd, addr, &ptl);
>  	for (; addr != end; pte++, addr += PAGE_SIZE) {
>  		if (!pte_present(*pte))
>  			continue;
> @@ -571,7 +571,7 @@ static int queue_pages_pte_range(pmd_t *pmd,
> unsigned long addr,
>  		} else
>  			break;
>  	}
> -	pte_unmap_unlock(pte - 1, ptl);
> +	pte_unmap_unlock(mapped_pte, ptl);
>  	cond_resched();
> 
>  	if (has_unmovable)

It is more clear to grasp, definitely.