linux-kernel - Re: [PATCH v2] mm, futex: Fix shared futex pgoff on shmem huge page

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <YMXdjhwpRzP6r8Uj@casper.infradead.org>
Date:   Sun, 13 Jun 2021 11:27:26 +0100
From:   Matthew Wilcox <willy@...radead.org>
To:     Hugh Dickins <hughd@...gle.com>
Cc:     Andrew Morton <akpm@...ux-foundation.org>,
        "Kirill A. Shutemov" <kirill.shutemov@...ux.intel.com>,
        Zhang Yi <wetpzy@...il.com>,
        Mel Gorman <mgorman@...hsingularity.net>,
        Mike Kravetz <mike.kravetz@...cle.com>,
        Thomas Gleixner <tglx@...utronix.de>,
        Ingo Molnar <mingo@...hat.com>,
        Peter Zijlstra <peterz@...radead.org>,
        Darren Hart <dvhart@...radead.org>,
        Davidlohr Bueso <dave@...olabs.net>,
        Neel Natu <neelnatu@...gle.com>, linux-mm@...ck.org,
        linux-kernel@...r.kernel.org
Subject: Re: [PATCH v2] mm, futex: Fix shared futex pgoff on shmem huge page

On Sat, Jun 12, 2021 at 08:16:58PM -0700, Hugh Dickins wrote:
> If more than one futex is placed on a shmem huge page, it can happen that
> waking the second wakes the first instead, and leaves the second waiting:
> the key's shared.pgoff is wrong.
> 
> When 3.11 commit 13d60f4b6ab5 ("futex: Take hugepages into account when
> generating futex_key"), the only shared huge pages came from hugetlbfs,
> and the code added to deal with its exceptional page->index was put into
> hugetlb source.  Then that was missed when 4.8 added shmem huge pages.
> 
> page_to_pgoff() is what others use for this nowadays: except that, as
> currently written, it gives the right answer on hugetlbfs head, but
> nonsense on hugetlbfs tails.  Fix that by calling hugetlbfs-specific
> hugetlb_basepage_index() on PageHuge tails as well as on head.
> 
> Yes, it's unconventional to declare hugetlb_basepage_index() there in
> pagemap.h, rather than in hugetlb.h; but I do not expect anything but
> page_to_pgoff() ever to need it.
> 
> Fixes: 800d8c63b2e9 ("shmem: add huge pages support")
> Reported-by: Neel Natu <neelnatu@...gle.com>
> Signed-off-by: Hugh Dickins <hughd@...gle.com>
> Cc: <stable@...r.kernel.org>

Reviewed-by: Matthew Wilcox (Oracle) <willy@...radead.org>