linux-kernel - [PATCH v2 2/2] mm/gup: memfd: stop leaking pinned pages in low memory conditions

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20241018011711.183642-3-jhubbard@nvidia.com>
Date: Thu, 17 Oct 2024 18:17:11 -0700
From: John Hubbard <jhubbard@...dia.com>
To: Andrew Morton <akpm@...ux-foundation.org>
Cc: LKML <linux-kernel@...r.kernel.org>,
	linux-mm@...ck.org,
	John Hubbard <jhubbard@...dia.com>,
	David Hildenbrand <david@...hat.com>,
	Alistair Popple <apopple@...dia.com>,
	Vivek Kasireddy <vivek.kasireddy@...el.com>,
	Jason Gunthorpe <jgg@...dia.com>,
	Christoph Hellwig <hch@....de>,
	Dave Airlie <airlied@...hat.com>,
	Gerd Hoffmann <kraxel@...hat.com>,
	"Matthew Wilcox (Oracle)" <willy@...radead.org>,
	Daniel Vetter <daniel.vetter@...ll.ch>,
	Hugh Dickins <hughd@...gle.com>,
	Peter Xu <peterx@...hat.com>,
	Dongwon Kim <dongwon.kim@...el.com>,
	Junxiao Chang <junxiao.chang@...el.com>,
	Arnd Bergmann <arnd@...db.de>,
	Christoph Hellwig <hch@...radead.org>,
	Mike Kravetz <mike.kravetz@...cle.com>,
	Oscar Salvador <osalvador@...e.de>
Subject: [PATCH v2 2/2] mm/gup: memfd: stop leaking pinned pages in low memory conditions

If check_and_migrate_movable_pages() fails, typically with -ENOMEM, then
memfd_pin_folios() will leave pages pinned. Those are leaked forever,
and are visible to user space as a memory leak.

Fix this by unpinning the folios that try_grab_folio(FOLL_PIN) has
pinned, in such error cases.

Fixes: 89c1905d9c14 ("mm/gup: introduce memfd_pin_folios() for pinning memfd folios")
Suggested-by: David Hildenbrand <david@...hat.com>
Cc: Alistair Popple <apopple@...dia.com>
Cc: Vivek Kasireddy <vivek.kasireddy@...el.com>
Cc: Jason Gunthorpe <jgg@...dia.com>
Cc: Christoph Hellwig <hch@....de>
Cc: Dave Airlie <airlied@...hat.com>
Cc: Gerd Hoffmann <kraxel@...hat.com>
Cc: Matthew Wilcox (Oracle) <willy@...radead.org>
Cc: Daniel Vetter <daniel.vetter@...ll.ch>
Cc: Hugh Dickins <hughd@...gle.com>
Cc: Peter Xu <peterx@...hat.com>
Cc: Dongwon Kim <dongwon.kim@...el.com>
Cc: Junxiao Chang <junxiao.chang@...el.com>
Cc: Arnd Bergmann <arnd@...db.de>
Cc: Christoph Hellwig <hch@...radead.org>
Cc: Mike Kravetz <mike.kravetz@...cle.com>
Cc: Oscar Salvador <osalvador@...e.de>
Signed-off-by: John Hubbard <jhubbard@...dia.com>
---
 mm/gup.c | 8 +++-----
 1 file changed, 3 insertions(+), 5 deletions(-)

diff --git a/mm/gup.c b/mm/gup.c
index 233c284e8e66..dc4906243b97 100644
--- a/mm/gup.c
+++ b/mm/gup.c
@@ -3719,12 +3719,10 @@ long memfd_pin_folios(struct file *memfd, loff_t start, loff_t end,
 		ret = check_and_migrate_movable_folios(nr_folios, folios);
 	} while (ret == -EAGAIN);
 
-	memalloc_pin_restore(flags);
-	return ret ? ret : nr_folios;
 err:
 	memalloc_pin_restore(flags);
-	unpin_folios(folios, nr_folios);
-
-	return ret;
+	if (ret)
+		unpin_folios(folios, nr_folios);
+	return ret ? ret : nr_folios;
 }
 EXPORT_SYMBOL_GPL(memfd_pin_folios);
-- 
2.47.0