linux-kernel - [PATCH 0/2] Fix prep_compound_gigantic

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-Id: <20210622021423.154662-1-mike.kravetz@oracle.com>
Date:   Mon, 21 Jun 2021 19:14:21 -0700
From:   Mike Kravetz <mike.kravetz@...cle.com>
To:     linux-mm@...ck.org, linux-kernel@...r.kernel.org
Cc:     Jann Horn <jannh@...gle.com>,
        Youquan Song <youquan.song@...el.com>,
        Andrea Arcangeli <aarcange@...hat.com>,
        Jan Kara <jack@...e.cz>, John Hubbard <jhubbard@...dia.com>,
        "Kirill A . Shutemov" <kirill@...temov.name>,
        Matthew Wilcox <willy@...radead.org>,
        Michal Hocko <mhocko@...nel.org>,
        Andrew Morton <akpm@...ux-foundation.org>,
        Mike Kravetz <mike.kravetz@...cle.com>
Subject: [PATCH 0/2] Fix prep_compound_gigantic_page ref count adjustment

These patches address the possible race between prep_compound_gigantic_page
and __page_cache_add_speculative as described by Jann Horn in [1].

The first patch simply removes the unnecessary/obsolete helper routine
prep_compound_huge_page to make the actual fix a little simpler.

The second patch is the actual fix and has a detailed explanation in the
commit message.

This potential issue has existed for almost 10 years and I am unaware of
anyone actually hitting the race.  I did not cc stable, but would be
happy to squash the patches and send to stable if anyone thinks that is
a good idea.

I could not think of a reliable way to recreate the issue for testing.
Rather, I 'simulated errors' to exercise all the error paths.

Mike Kravetz (2):
  hugetlb: remove prep_compound_huge_page cleanup
  hugetlb: address ref count racing in prep_compound_gigantic_page

 mm/hugetlb.c    | 99 ++++++++++++++++++++++++++++++++++++-------------
 mm/page_alloc.c |  1 -
 2 files changed, 73 insertions(+), 27 deletions(-)

-- 
2.31.1