linux-kernel - Re: [PATCH -next] mm/hwpoison: clear MF_COUNT_INCREASED before retrying get_any

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20211222021445.GA1534186@u2004>
Date:   Wed, 22 Dec 2021 11:14:45 +0900
From:   Naoya Horiguchi <naoya.horiguchi@...ux.dev>
To:     Liu Shixin <liushixin2@...wei.com>
Cc:     Naoya Horiguchi <naoya.horiguchi@....com>,
        Andrew Morton <akpm@...ux-foundation.org>,
        Oscar Salvador <osalvador@...e.de>, linux-mm@...ck.org,
        linux-kernel@...r.kernel.org
Subject: Re: [PATCH -next] mm/hwpoison: clear MF_COUNT_INCREASED before
 retrying get_any_page()

On Wed, Dec 22, 2021 at 09:49:18AM +0800, Liu Shixin wrote:
> 
> 
> On 2021/12/22 8:37, Naoya Horiguchi wrote:
> > On Tue, Dec 21, 2021 at 03:49:08PM +0800, Liu Shixin wrote:
> >> Hulk Robot reported a panic in put_page_testzero() when testing madvise()
> >> with MADV_SOFT_OFFLINE. The BUG() is triggered when retrying get_any_page().
> >> This is because we keep MF_COUNT_INCREASED flag in second try but the refcnt
> >> is not increased.
> > Hi Shixin, 
> >
> > Thanks you for the report.
> >
> > I'm not still sure about the logic behind the bug.
> > madvise(MADV_SOFT_OFFLINE) should not work on free pages because
> > madvise_inject_error() pins the target page with get_user_pages_fast()
> > (MF_COUNT_INCREASED means refcount is incremented by the caller).
> > The retry logic can be called when soft_offline_free_page() fails, so
> > the logic assumes that the target page is a free page.  So why does
> > clearing MF_COUNT_INCREASED affect and solve the issue?
> >
> > It seems to me that if soft_offline_page() is called on a free page
> > with MF_COUNT_INCREASED set, then it's problematic itself.
> >
> > Thanks,
> > Naoya Horiguchi
> 
> The page is not free when soft_offline_page() is called. In get_any_page(),
> if MF_COUNT_INCREASED is set and !HWPoisonHandlable(page), put_page()
> will be called firstly and then goto try_again. The page is freed in this period.

Okay, the logic is clear to me now.

> >>
> >> Fixes: b94e02822deb ("mm,hwpoison: try to narrow window race for free pages")
> >> Reported-by: Hulk Robot <hulkci@...wei.com>
> >> Signed-off-by: Liu Shixin <liushixin2@...wei.com>

Thank you very much.

Acked-by: Naoya Horiguchi <naoya.horiguchi@....com>

> >> ---
> >>  mm/memory-failure.c | 1 +
> >>  1 file changed, 1 insertion(+)
> >>
> >> diff --git a/mm/memory-failure.c b/mm/memory-failure.c
> >> index 68d9a35f8908..160526f83bcb 100644
> >> --- a/mm/memory-failure.c
> >> +++ b/mm/memory-failure.c
> >> @@ -2288,6 +2288,7 @@ int soft_offline_page(unsigned long pfn, int flags)
> >>  	} else if (ret == 0) {
> >>  		if (soft_offline_free_page(page) && try_again) {
> >>  			try_again = false;
> >> +			flags &= ~MF_COUNT_INCREASED;
> >>  			goto retry;
> >>  		}
> >>  	}
> >> -- 
> >> 2.25.1
> >>
> > .
> >
>