linux-kernel - Re: [PATCH 2/3] hugetlbfs: close race between MADV

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Tue, 03 Oct 2023 15:35:25 -0400
From:   Rik van Riel <riel@...riel.com>
To:     Mike Kravetz <mike.kravetz@...cle.com>
Cc:     linux-kernel@...r.kernel.org, kernel-team@...a.com,
        linux-mm@...ck.org, akpm@...ux-foundation.org,
        muchun.song@...ux.dev, leit@...a.com, willy@...radead.org
Subject: Re: [PATCH 2/3] hugetlbfs: close race between MADV_DONTNEED and
 page fault

On Sun, 2023-10-01 at 21:39 -0700, Mike Kravetz wrote:
> 
> Something is not right here.  I have not looked closely at the patch,
> but running libhugetlbfs test suite hits this NULL deref in misalign
> (2M: 32).

Hi Mike,

fixing the null dereference was easy, but I continued running
into a test case failure with linkhuge_rw. After tweaking the
code in my patches quite a few times, I finally ran out of
ideas and tried it on a tree without my patches.

I still see the test failure on upstream
2cf0f7156238 ("Merge tag 'nfs-for-6.6-2' of git://git.linux-
nfs.org/projects/anna/linux-nfs")

This is with a modern glibc, and the __morecore assignments
in libhugetlbfs/morecore.c commented out.


HUGETLB_ELFMAP=R HUGETLB_SHARE=1 linkhuge_rw (2M: 32):	Pool state:
(('hugepages-2048kB', (('free_hugepages', 1), ('resv_hugepages', 0),
('surplus_hugepages', 0), ('nr_hugepages_mempolicy', 1),
('nr_hugepages', 1), ('nr_overcommit_hugepages', 0))),)
Hugepage pool state not preserved!
BEFORE: (('hugepages-2048kB', (('free_hugepages', 1),
('resv_hugepages', 0), ('surplus_hugepages', 0),
('nr_hugepages_mempolicy', 1), ('nr_hugepages', 1),
('nr_overcommit_hugepages', 0))),)
AFTER: (('hugepages-2048kB', (('free_hugepages', 0), ('resv_hugepages',
0), ('surplus_hugepages', 0), ('nr_hugepages_mempolicy', 1),
('nr_hugepages', 1), ('nr_overcommit_hugepages', 0))),)


It may take a little while to figure this one out. I did some
bpftracing, but don't have a real smoking gun yet. The trace
certainly shows the last user of the leaked huge page going
into __unmap_hugepage_range.

-- 
All Rights Reversed.