linux-kernel - Re: [PATCH] mm/hugetlb: Do not call vma_add

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Wed, 29 May 2024 08:43:06 -0700
From: Breno Leitao <leitao@...ian.org>
To: Oscar Salvador <osalvador@...e.de>
Cc: Andrew Morton <akpm@...ux-foundation.org>, linux-kernel@...r.kernel.org,
	linux-mm@...ck.org, Muchun Song <muchun.song@...ux.dev>,
	syzbot+d3fe2dc5ffe9380b714b@...kaller.appspotmail.com
Subject: Re: [PATCH] mm/hugetlb: Do not call vma_add_reservation upon ENOMEM

On Tue, May 28, 2024 at 10:53:23PM +0200, Oscar Salvador wrote:
> sysbot reported a splat [1] on __unmap_hugepage_range().
> This is because vma_needs_reservation() can return -ENOMEM if
> allocate_file_region_entries() fails to allocate the file_region struct for
> the reservation.
> Check for that and do not call vma_add_reservation() if that is the case,
> otherwise region_abort() and region_del() will see that we do not have any
> file_regions.
> 
> If we detect that vma_needs_reservation() returned -ENOMEM, we clear the
> hugetlb_restore_reserve flag as if this reservation was still consumed,
> so free_huge_folio() will not increment the resv count.
> 
> [1] https://lore.kernel.org/linux-mm/0000000000004096100617c58d54@google.com/T/#ma5983bc1ab18a54910da83416b3f89f3c7ee43aa
> 
> Fixes: df7a6d1f6405 ("mm/hugetlb: restore the reservation if needed")
> Reported-and-tested-by: syzbot+d3fe2dc5ffe9380b714b@...kaller.appspotmail.com
> Closes: https://lore.kernel.org/linux-mm/0000000000004096100617c58d54@google.com/
> Signed-off-by: Oscar Salvador <osalvador@...e.de>
> ---
>  mm/hugetlb.c | 16 ++++++++++++++--
>  1 file changed, 14 insertions(+), 2 deletions(-)
> 
> diff --git a/mm/hugetlb.c b/mm/hugetlb.c
> index 6be78e7d4f6e..f35abff8be60 100644
> --- a/mm/hugetlb.c
> +++ b/mm/hugetlb.c
> @@ -5768,8 +5768,20 @@ void __unmap_hugepage_range(struct mmu_gather *tlb, struct vm_area_struct *vma,
>  		 * do_exit() will not see it, and will keep the reservation
>  		 * forever.
>  		 */
> -		if (adjust_reservation && vma_needs_reservation(h, vma, address))
> -			vma_add_reservation(h, vma, address);
> +		if (adjust_reservation) {
> +			int rc = vma_needs_reservation(h, vma, address);

vma_needs_reservation returns a long.

	static long vma_needs_reservation(struct hstate *h,
				struct vm_area_struct *vma, unsigned long addr)
				
Other than that, this is reviewed.

Reviewed-by: Breno Leitao <leitao@...ian.org>

Thanks for fixing it.