linux-kernel - Re: [PATCH v10 12/18] mm: replace vm_lock and detached flag with a reference count

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAJuCfpGc+Q=rabcTZoxOj9YSZJnR7GzaTNa-PL-G-3hdO+SmjA@mail.gmail.com>
Date: Thu, 20 Feb 2025 12:05:42 -0800
From: Suren Baghdasaryan <surenb@...gle.com>
To: Heiko Carstens <hca@...ux.ibm.com>
Cc: akpm@...ux-foundation.org, peterz@...radead.org, willy@...radead.org, 
	liam.howlett@...cle.com, lorenzo.stoakes@...cle.com, 
	david.laight.linux@...il.com, mhocko@...e.com, vbabka@...e.cz, 
	hannes@...xchg.org, mjguzik@...il.com, oliver.sang@...el.com, 
	david@...hat.com, peterx@...hat.com, oleg@...hat.com, dave@...olabs.net, 
	paulmck@...nel.org, brauner@...nel.org, dhowells@...hat.com, hdanton@...a.com, 
	hughd@...gle.com, lokeshgidra@...gle.com, minchan@...gle.com, 
	jannh@...gle.com, shakeel.butt@...ux.dev, souravpanda@...gle.com, 
	pasha.tatashin@...een.com, klarasmodin@...il.com, richard.weiyang@...il.com, 
	corbet@....net, linux-doc@...r.kernel.org, linux-mm@...ck.org, 
	linux-kernel@...r.kernel.org, kernel-team@...roid.com
Subject: Re: [PATCH v10 12/18] mm: replace vm_lock and detached flag with a
 reference count

On Thu, Feb 20, 2025 at 11:03 AM Suren Baghdasaryan <surenb@...gle.com> wrote:
>
> On Thu, Feb 20, 2025 at 10:53 AM Heiko Carstens <hca@...ux.ibm.com> wrote:
> >
> > On Thu, Feb 13, 2025 at 02:46:49PM -0800, Suren Baghdasaryan wrote:
> > ...
> > > While this vm_lock replacement does not yet result in a smaller
> > > vm_area_struct (it stays at 256 bytes due to cacheline alignment), it
> > > allows for further size optimization by structure member regrouping
> > > to bring the size of vm_area_struct below 192 bytes.
> > >
> > > Suggested-by: Peter Zijlstra <peterz@...radead.org>
> > > Suggested-by: Matthew Wilcox <willy@...radead.org>
> > > Signed-off-by: Suren Baghdasaryan <surenb@...gle.com>
> > > ---
> > > Changes since v9 [1]:
> > > - Use __refcount_inc_not_zero_limited_acquire() in vma_start_read(),
> > > per Hillf Danton
> > > - Refactor vma_assert_locked() to avoid vm_refcnt read when CONFIG_DEBUG_VM=n,
> > > per Mateusz Guzik
> > > - Update changelog, per Wei Yang
> > > - Change vma_start_read() to return EAGAIN if vma got isolated and changed
> > > lock_vma_under_rcu() back to detect this condition, per Wei Yang
> > > - Change VM_BUG_ON_VMA() to WARN_ON_ONCE() when checking vma detached state,
> > > per Lorenzo Stoakes
> > > - Remove Vlastimil's Reviewed-by since code is changed
> >
> > This causes crashes (NULL pointer deref) with linux-next when running
> > the ltp test suite; mtest06 (mmap1) test case.
> >
> > The bug seems to be quite obvious:
> >
> > > @@ -6424,15 +6492,18 @@ struct vm_area_struct *lock_vma_under_rcu(struct mm_struct *mm,
> > >       if (!vma)
> > >               goto inval;
> > >
> > > -     if (!vma_start_read(vma))
> > > -             goto inval;
> > > +     vma = vma_start_read(vma);
> > > +     if (IS_ERR_OR_NULL(vma)) {
> >             ^^^^^^^^^^^^^^^^^^^
> > > +             /* Check if the VMA got isolated after we found it */
> > > +             if (PTR_ERR(vma) == -EAGAIN) {
> > > +                     vma_end_read(vma);
> >                         ^^^^^^^^^^^^^^^^
>
> Doh! Thanks for reporting! I'll post a fix shortly.

The fix is posted at:
https://lore.kernel.org/all/20250220200208.323769-1-surenb@google.com/
Quite embarrassing... I missed removing that extra call. This change
was done only in v10, so never appeared before.