linux-kernel - Re: [PATCH v1] mm/filemap: don't call folio_test_locked() without a reference in next_uptodate

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <2r2suyel6m6ngntarnxwtobicwignmmm3lfivvp5goufzis56e@rwtncfi7nxxn>
Date: Fri, 29 Nov 2024 15:40:29 +0200
From: "Kirill A. Shutemov" <kirill@...temov.name>
To: David Hildenbrand <david@...hat.com>
Cc: linux-kernel@...r.kernel.org, linux-fsdevel@...r.kernel.org, 
	linux-mm@...ck.org, syzbot+9f9a7f73fb079b2387a6@...kaller.appspotmail.com, 
	"Matthew Wilcox (Oracle)" <willy@...radead.org>, Andrew Morton <akpm@...ux-foundation.org>, 
	"Kirill A. Shutemov" <kirill.shutemov@...ux.intel.com>, Hillf Danton <hdanton@...a.com>
Subject: Re: [PATCH v1] mm/filemap: don't call folio_test_locked() without a
 reference in next_uptodate_folio()

On Fri, Nov 29, 2024 at 01:53:03PM +0100, David Hildenbrand wrote:
> The folio can get freed + buddy-merged + reallocated in the meantime,
> resulting in us calling folio_test_locked() possibly on a tail page.
> 
> This makes const_folio_flags VM_BUG_ON_PGFLAGS() when stumbling over
> the tail page.
> 
> Could this result in other issues? Doesn't look like it. False positives
> and false negatives don't really matter, because this folio would get
> skipped either way when detecting that they have been reallocated in
> the meantime.
> 
> Fix it by performing the folio_test_locked() checked after grabbing a
> reference. If this ever becomes a real problem, we could add a special
> helper that racily checks if the bit is set even on tail pages ... but
> let's hope that's not required so we can just handle it cleaner:
> work on the folio after we hold a reference.
> 
> Do we really need the folio_test_locked() check if we are going to
> trylock briefly after? Well, we can at least avoid a xas_reload().
> 
> It's a bit unclear which exact change introduced that issue. Likely,
> ever since we made PG_locked obey to the PF_NO_TAIL policy it could have
> been triggered in some way.
> 
> Reported-by: syzbot+9f9a7f73fb079b2387a6@...kaller.appspotmail.com
> Closes: https://lore.kernel.org/lkml/674184c9.050a0220.1cc393.0001.GAE@google.com/
> Fixes: 48c935ad88f5 ("page-flags: define PG_locked behavior on compound pages")
> Cc: "Matthew Wilcox (Oracle)" <willy@...radead.org>
> Cc: Andrew Morton <akpm@...ux-foundation.org>
> Cc: "Kirill A. Shutemov" <kirill.shutemov@...ux.intel.com>
> Cc: Hillf Danton <hdanton@...a.com>
> Signed-off-by: David Hildenbrand <david@...hat.com>

Looks reasonable:

Acked-by: Kirill A. Shutemov <kirill.shutemov@...ux.intel.com>

-- 
  Kiryl Shutsemau / Kirill A. Shutemov