linux-kernel - Re: [Regression] Bug 216911 - get_unmapped_area returns addresses below mmap_min

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <df59eaf6-ae77-adb7-295a-15997950f1f5@leemhuis.info>
Date:   Wed, 11 Jan 2023 11:54:41 +0100
From:   "Linux kernel regression tracking (Thorsten Leemhuis)" 
        <regressions@...mhuis.info>
To:     "Liam R. Howlett" <Liam.Howlett@...cle.com>,
        "Matthew Wilcox (Oracle)" <willy@...radead.org>
Cc:     "regressions@...ts.linux.dev" <regressions@...ts.linux.dev>,
        LKML <linux-kernel@...r.kernel.org>,
        Linux-MM <linux-mm@...ck.org>,
        Amanieu d'Antras <amanieu@...il.com>,
        "maple-tree@...ts.infradead.org" <maple-tree@...ts.infradead.org>,
        Andrew Morton <akpm@...ux-foundation.org>
Subject: Re: [Regression] Bug 216911 - get_unmapped_area returns addresses below mmap_min_addr

[resent with akpm's proper email address (either me or my mailer did
something stupid; sorry for the noise)]

On 11.01.23 11:46, Linux kernel regression tracking (Thorsten Leemhuis)
wrote:
> Hi, I noticed a regression report in bugzilla.kernel.org. As many
> (most?) kernel developer don't keep an eye on it, I decided to forward
> it by mail. Quoting from
> https://bugzilla.kernel.org/show_bug.cgi?id=216911 :
> 
>>  Amanieu d'Antras 2023-01-11 02:10:02 UTC
>>
>> Created attachment 303572 [details]
>> Program which demonstrates this issue
>>
>> The vm_unmapped_area function doesn't seem to respect info.low_limit and will sometimes return an address below this limit. This can result in addresses below mmap_min_addr being returned.
>>
>> I bisected it down to this range of commits (I stopped since I was hitting kernel crashes):
>> 3499a13168da mm/mmap: use maple tree for unmapped_area{_topdown}
>> 7fdbd37da5c6 mm/mmap: use the maple tree for find_vma_prev() instead of the rbtree
>> be8432e7166e mm/mmap: use the maple tree in find_vma() instead of the rbtree.
>> 2e3af1db1744 mmap: use the VMA iterator in count_vma_pages_range()
>> f39af05949a4 mm: add VMA iterator
>> d4af56c5c7c6 mm: start tracking VMAs with maple tree
> 
> [those are all from the Maple Tree introduction series]
> 
>> I've attached a test program which attempts to allocate the entire address space. On affected kernels, this triggers one of the 2 assertions (depending on whether you are running as root):
>> - NULL is returned, which means memory below mmap_min_addr was allocated.
>> - EPERM is returned, which really shouldn't happen when MAP_FIXED is not used (ENOMEM should be returned instead).
> 
> See the ticket for more details.
> 
> BTW, let me use this mail to also add the report to the list of tracked
> regressions to ensure it's doesn't fall through the cracks:
> 
> #regzbot introduced: d4af56c5c7c6..3499a13168da
> https://bugzilla.kernel.org/show_bug.cgi?id=216911
> #regzbot title: mm: get_unmapped_area returns addresses below mmap_min_addr
> #regzbot ignore-activity
> 
> Ciao, Thorsten (wearing his 'the Linux kernel's regression tracker' hat)
> --
> Everything you wanna know about Linux kernel regression tracking:
> https://linux-regtracking.leemhuis.info/about/#tldr
> If I did something stupid, please tell me, as explained on that page.