Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1475122

Re: mm: use-after-free in collapse_huge_page

Show all headers | View raw

>  
> @@ -898,13 +899,13 @@ static bool __collapse_huge_page_swapin(struct mm_struct *mm,
>  		/* do_swap_page returns VM_FAULT_RETRY with released mmap_sem */
>  		if (ret & VM_FAULT_RETRY) {
>  			down_read(&mm->mmap_sem);
> -			if (hugepage_vma_revalidate(mm, address)) {
> +			if (hugepage_vma_revalidate(mm, address, &vma)) {
>  				/* vma is no longer available, don't continue to swapin */
>  				trace_mm_collapse_huge_page_swapin(mm, swapped_in, referenced, 0);
>  				return false;
>  			}
>  			/* check if the pmd is still valid */
> -			if (mm_find_pmd(mm, address) != pmd)
> +			if (mm_find_pmd(mm, address) != pmd || vma != fe.vma)
>  				return false;
>  		}
>  		if (ret & VM_FAULT_ERROR) {
> @@ -923,7 +924,6 @@ static bool __collapse_huge_page_swapin(struct mm_struct *mm,
>  static void collapse_huge_page(struct mm_struct *mm,
>  				   unsigned long address,
>  				   struct page **hpage,
> -				   struct vm_area_struct *vma,
>  				   int node, int referenced)
>  {
>  	pmd_t *pmd, _pmd;
> @@ -933,6 +933,7 @@ static void collapse_huge_page(struct mm_struct *mm,
>  	spinlock_t *pmd_ptl, *pte_ptl;
>  	int isolated = 0, result = 0;
>  	struct mem_cgroup *memcg;
> +	struct vm_area_struct *vma;
>  	unsigned long mmun_start;	/* For mmu_notifiers */
I could not realize, why we need to remove vma parameter and recreate it here?
>  	unsigned long mmun_end;		/* For mmu_notifiers */
>  	gfp_t gfp;
> @@ -961,7 +962,7 @@ static void collapse_huge_page(struct mm_struct *mm,
>  	}
>  
>  	down_read(&mm->mmap_sem);
And without fe.vma check, this patch seems work for me.

Andrea, I've just sent a fix patch for leaking mapped ptes.

Kind regards,
Ebru

Back to linux.kernel | Previous | Next — Previous in thread | Find similar | Unroll thread

Thread

mm: use-after-free in collapse_huge_page Dmitry Vyukov <dvyukov@google.com> - 2016-08-28 12:50 +0200
  Re: mm: use-after-free in collapse_huge_page "Kirill A. Shutemov" <kirill.shutemov@linux.intel.com> - 2016-08-29 14:50 +0200
    Re: mm: use-after-free in collapse_huge_page Andrea Arcangeli <aarcange@redhat.com> - 2016-08-29 17:40 +0200
      Re: mm: use-after-free in collapse_huge_page "Kirill A. Shutemov" <kirill.shutemov@linux.intel.com> - 2016-09-07 14:30 +0200
        Re: mm: use-after-free in collapse_huge_page Andrea Arcangeli <aarcange@redhat.com> - 2016-09-07 14:50 +0200
    Re: mm: use-after-free in collapse_huge_page Ebru Akagunduz <ebru.akagunduz@gmail.com> - 2016-09-02 15:00 +0200

csiph-web