linux-kernel - Re: [PATCH v2] mm: khugepaged: Fix kernel BUG in hpage_collapse_scan

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <d513cd8d-0262-8c4e-d0d9-ec7eea45941a@gmail.com>
Date:   Mon, 17 Apr 2023 03:04:59 +0400
From:   Ivan Orlov <ivan.orlov0322@...il.com>
To:     Andrew Morton <akpm@...ux-foundation.org>,
        Zach O'Keefe <zokeefe@...gle.com>
Cc:     Yang Shi <shy828301@...il.com>, himadrispandya@...il.com,
        linux-kernel@...r.kernel.org,
        linux-kernel-mentees@...ts.linuxfoundation.org, linux-mm@...ck.org,
        skhan@...uxfoundation.org,
        syzbot+9578faa5475acb35fa50@...kaller.appspotmail.com,
        Mike Kravetz <mike.kravetz@...cle.com>,
        "Kirill A. Shutemov" <kirill.shutemov@...ux.intel.com>,
        Matthew Wilcox <willy@...radead.org>
Subject: Re: [PATCH v2] mm: khugepaged: Fix kernel BUG in
 hpage_collapse_scan_file

On 4/16/23 22:33, Andrew Morton wrote:
> 
> Circling back to this fix...
> 
> The BUG() is obviously real.  We're unsure that Ivan's fix is the best
> one.  We haven't identified a Fixes:, and as this report is against the 6.2
> kernel, a cc:stable will be needed.
> 
> According to the sysbot bisection
> (https://syzkaller.appspot.com/bug?id=7d6bb3760e026ece7524500fe44fb024a0e959fc),
> this is present in linux-5.19, so it might predate Zach's
> 58ac9a8993a13ebc changes.  But that bisection claim might be
> misleading.
> 
> And Zach is offline for a few months.  So can people please take a look
> and see if we can get this wrapped up?
> 
> Matthew, the assertion failure is in the
> 
> 	VM_BUG_ON(index != xas.xa_index);
> 
> which was added in 77da9389b9d5f, so perhaps you could take a look?
> 
> Thanks.

I tested the reproducers on the 99cb0dbd47a15 commit, and they do not 
trigger the problematic condition of shared memory truncation or 
hole-punching. I will investigate further, as there have been many 
changes in khugepaged since the 99cb0dbd47a15 commit that could 
potentially affect its behavior.