Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1676520 > unrolled thread

[PATCH] thp, mm: Fix crash due race in MADV_FREE handling

Started by"Kirill A. Shutemov" <kirill.shutemov@linux.intel.com>
First post2017-06-28 12:20 +0200
Last post2017-06-29 17:50 +0200
Articles 7 — 6 participants

Back to article view | Back to linux.kernel

Contents

  [PATCH] thp, mm: Fix crash due race in MADV_FREE handling "Kirill A. Shutemov" <kirill.shutemov@linux.intel.com> - 2017-06-28 12:20 +0200
    Re: [PATCH] thp, mm: Fix crash due race in MADV_FREE handling "Kirill A. Shutemov" <kirill@shutemov.name> - 2017-06-28 12:30 +0200
      Re: [PATCH] thp, mm: Fix crash due race in MADV_FREE handling Minchan Kim <minchan@kernel.org> - 2017-06-29 10:50 +0200
      Re: [PATCH] thp, mm: Fix crash due race in MADV_FREE handling Andrew Morton <akpm@linux-foundation.org> - 2017-06-29 23:00 +0200
        Re: [PATCH] thp, mm: Fix crash due race in MADV_FREE handling "Kirill A. Shutemov" <kirill@shutemov.name> - 2017-06-30 05:40 +0200
    Re: [PATCH] thp, mm: Fix crash due race in MADV_FREE handling Dave Hansen <dave.hansen@intel.com> - 2017-06-28 16:30 +0200
    Re: [PATCH] thp, mm: Fix crash due race in MADV_FREE handling Michal Hocko <mhocko@kernel.org> - 2017-06-29 17:50 +0200

#1676520 — [PATCH] thp, mm: Fix crash due race in MADV_FREE handling

From"Kirill A. Shutemov" <kirill.shutemov@linux.intel.com>
Date2017-06-28 12:20 +0200
Subject[PATCH] thp, mm: Fix crash due race in MADV_FREE handling
Message-ID<tXieK-5vN-29@gated-at.bofh.it>
Reinette reported following crash:

  BUG: Bad page state in process log2exe  pfn:57600
  page:ffffea00015d8000 count:0 mapcount:0 mapping:          (null) index:0x20200
  flags: 0x4000000000040019(locked|uptodate|dirty|swapbacked)
  raw: 4000000000040019 0000000000000000 0000000000020200 00000000ffffffff
  raw: ffffea00015d8020 ffffea00015d8020 0000000000000000 0000000000000000
  page dumped because: PAGE_FLAGS_CHECK_AT_FREE flag(s) set
  bad because of flags: 0x1(locked)
  Modules linked in: rfcomm 8021q bnep intel_rapl x86_pkg_temp_thermal coretemp efivars btusb btrtl btbcm pwm_lpss_pci snd_hda_codec_hdmi btintel pwm_lpss snd_hda_codec_realtek snd_soc_skl snd_hda_codec_generic snd_soc_skl_ipc spi_pxa2xx_platform snd_soc_sst_ipc snd_soc_sst_dsp i2c_designware_platform i2c_designware_core snd_hda_ext_core snd_soc_sst_match snd_hda_intel snd_hda_codec mei_me snd_hda_core mei snd_soc_rt286 snd_soc_rl6347a snd_soc_core efivarfs
  CPU: 1 PID: 354 Comm: log2exe Not tainted 4.12.0-rc7-test-test #19
  Hardware name: Intel corporation NUC6CAYS/NUC6CAYB, BIOS AYAPLCEL.86A.0027.2016.1108.1529 11/08/2016
  Call Trace:
   dump_stack+0x95/0xeb
   bad_page+0x16a/0x1f0
   free_pages_check_bad+0x117/0x190
   ? rcu_read_lock_sched_held+0xa8/0x130
   free_hot_cold_page+0x7b1/0xad0
   __put_page+0x70/0xa0
   madvise_free_huge_pmd+0x627/0x7b0
   madvise_free_pte_range+0x6f8/0x1150
   ? debug_check_no_locks_freed+0x280/0x280
   ? swapin_walk_pmd_entry+0x380/0x380
   __walk_page_range+0x6b5/0xe30
   walk_page_range+0x13b/0x310
   madvise_free_page_range.isra.16+0xad/0xd0
   ? force_swapin_readahead+0x110/0x110
   ? swapin_walk_pmd_entry+0x380/0x380
   ? lru_add_drain_cpu+0x160/0x320
   madvise_free_single_vma+0x2e4/0x470
   ? madvise_free_page_range.isra.16+0xd0/0xd0
   ? vmacache_update+0x100/0x130
   ? find_vma+0x35/0x160
   SyS_madvise+0x8ce/0x1450

If somebody frees the page under us and we hold the last reference to
it, put_page() would attempt to free the page before unlocking it.

The fix is trivial reorder of operations.

Signed-off-by: Kirill A. Shutemov <kirill.shutemov@linux.intel.com>
Reported-by: Reinette Chatre <reinette.chatre@intel.com>
Fixes: 9818b8cde622 ("madvise_free, thp: fix madvise_free_huge_pmd return value after splitting")
Cc: Huang Ying <ying.huang@intel.com>
Cc: Minchan Kim <minchan@kernel.org>
Cc: Dave Hansen <dave.hansen@intel.com>
---
 mm/huge_memory.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/mm/huge_memory.c b/mm/huge_memory.c
index 8624450f7106..25b5965c1130 100644
--- a/mm/huge_memory.c
+++ b/mm/huge_memory.c
@@ -1575,8 +1575,8 @@ bool madvise_free_huge_pmd(struct mmu_gather *tlb, struct vm_area_struct *vma,
 		get_page(page);
 		spin_unlock(ptl);
 		split_huge_page(page);
-		put_page(page);
 		unlock_page(page);
+		put_page(page);
 		goto out_unlocked;
 	}
 
-- 
2.11.0

[toc] | [next] | [standalone]

#1676527

From"Kirill A. Shutemov" <kirill@shutemov.name>
Date2017-06-28 12:30 +0200
Message-ID<tXiop-5z2-17@gated-at.bofh.it>
In reply to#1676520
On Wed, Jun 28, 2017 at 01:12:49PM +0300, Kirill A. Shutemov wrote:
> Reinette reported following crash:
> 
>   BUG: Bad page state in process log2exe  pfn:57600
>   page:ffffea00015d8000 count:0 mapcount:0 mapping:          (null) index:0x20200
>   flags: 0x4000000000040019(locked|uptodate|dirty|swapbacked)
>   raw: 4000000000040019 0000000000000000 0000000000020200 00000000ffffffff
>   raw: ffffea00015d8020 ffffea00015d8020 0000000000000000 0000000000000000
>   page dumped because: PAGE_FLAGS_CHECK_AT_FREE flag(s) set
>   bad because of flags: 0x1(locked)
>   Modules linked in: rfcomm 8021q bnep intel_rapl x86_pkg_temp_thermal coretemp efivars btusb btrtl btbcm pwm_lpss_pci snd_hda_codec_hdmi btintel pwm_lpss snd_hda_codec_realtek snd_soc_skl snd_hda_codec_generic snd_soc_skl_ipc spi_pxa2xx_platform snd_soc_sst_ipc snd_soc_sst_dsp i2c_designware_platform i2c_designware_core snd_hda_ext_core snd_soc_sst_match snd_hda_intel snd_hda_codec mei_me snd_hda_core mei snd_soc_rt286 snd_soc_rl6347a snd_soc_core efivarfs
>   CPU: 1 PID: 354 Comm: log2exe Not tainted 4.12.0-rc7-test-test #19
>   Hardware name: Intel corporation NUC6CAYS/NUC6CAYB, BIOS AYAPLCEL.86A.0027.2016.1108.1529 11/08/2016
>   Call Trace:
>    dump_stack+0x95/0xeb
>    bad_page+0x16a/0x1f0
>    free_pages_check_bad+0x117/0x190
>    ? rcu_read_lock_sched_held+0xa8/0x130
>    free_hot_cold_page+0x7b1/0xad0
>    __put_page+0x70/0xa0
>    madvise_free_huge_pmd+0x627/0x7b0
>    madvise_free_pte_range+0x6f8/0x1150
>    ? debug_check_no_locks_freed+0x280/0x280
>    ? swapin_walk_pmd_entry+0x380/0x380
>    __walk_page_range+0x6b5/0xe30
>    walk_page_range+0x13b/0x310
>    madvise_free_page_range.isra.16+0xad/0xd0
>    ? force_swapin_readahead+0x110/0x110
>    ? swapin_walk_pmd_entry+0x380/0x380
>    ? lru_add_drain_cpu+0x160/0x320
>    madvise_free_single_vma+0x2e4/0x470
>    ? madvise_free_page_range.isra.16+0xd0/0xd0
>    ? vmacache_update+0x100/0x130
>    ? find_vma+0x35/0x160
>    SyS_madvise+0x8ce/0x1450
> 
> If somebody frees the page under us and we hold the last reference to
> it, put_page() would attempt to free the page before unlocking it.
> 
> The fix is trivial reorder of operations.
> 
> Signed-off-by: Kirill A. Shutemov <kirill.shutemov@linux.intel.com>
> Reported-by: Reinette Chatre <reinette.chatre@intel.com>
> Fixes: 9818b8cde622 ("madvise_free, thp: fix madvise_free_huge_pmd return value after splitting")

Sorry, the wrong Fixes. The right one:

Fixes: b8d3c4c3009d ("mm/huge_memory.c: don't split THP page when MADV_FREE syscall is called")

-- 
 Kirill A. Shutemov

[toc] | [prev] | [next] | [standalone]

#1677528

FromMinchan Kim <minchan@kernel.org>
Date2017-06-29 10:50 +0200
Message-ID<tXDjb-5jp-7@gated-at.bofh.it>
In reply to#1676527
On Wed, Jun 28, 2017 at 01:15:50PM +0300, Kirill A. Shutemov wrote:
> On Wed, Jun 28, 2017 at 01:12:49PM +0300, Kirill A. Shutemov wrote:
> > Reinette reported following crash:
> > 
> >   BUG: Bad page state in process log2exe  pfn:57600
> >   page:ffffea00015d8000 count:0 mapcount:0 mapping:          (null) index:0x20200
> >   flags: 0x4000000000040019(locked|uptodate|dirty|swapbacked)
> >   raw: 4000000000040019 0000000000000000 0000000000020200 00000000ffffffff
> >   raw: ffffea00015d8020 ffffea00015d8020 0000000000000000 0000000000000000
> >   page dumped because: PAGE_FLAGS_CHECK_AT_FREE flag(s) set
> >   bad because of flags: 0x1(locked)
> >   Modules linked in: rfcomm 8021q bnep intel_rapl x86_pkg_temp_thermal coretemp efivars btusb btrtl btbcm pwm_lpss_pci snd_hda_codec_hdmi btintel pwm_lpss snd_hda_codec_realtek snd_soc_skl snd_hda_codec_generic snd_soc_skl_ipc spi_pxa2xx_platform snd_soc_sst_ipc snd_soc_sst_dsp i2c_designware_platform i2c_designware_core snd_hda_ext_core snd_soc_sst_match snd_hda_intel snd_hda_codec mei_me snd_hda_core mei snd_soc_rt286 snd_soc_rl6347a snd_soc_core efivarfs
> >   CPU: 1 PID: 354 Comm: log2exe Not tainted 4.12.0-rc7-test-test #19
> >   Hardware name: Intel corporation NUC6CAYS/NUC6CAYB, BIOS AYAPLCEL.86A.0027.2016.1108.1529 11/08/2016
> >   Call Trace:
> >    dump_stack+0x95/0xeb
> >    bad_page+0x16a/0x1f0
> >    free_pages_check_bad+0x117/0x190
> >    ? rcu_read_lock_sched_held+0xa8/0x130
> >    free_hot_cold_page+0x7b1/0xad0
> >    __put_page+0x70/0xa0
> >    madvise_free_huge_pmd+0x627/0x7b0
> >    madvise_free_pte_range+0x6f8/0x1150
> >    ? debug_check_no_locks_freed+0x280/0x280
> >    ? swapin_walk_pmd_entry+0x380/0x380
> >    __walk_page_range+0x6b5/0xe30
> >    walk_page_range+0x13b/0x310
> >    madvise_free_page_range.isra.16+0xad/0xd0
> >    ? force_swapin_readahead+0x110/0x110
> >    ? swapin_walk_pmd_entry+0x380/0x380
> >    ? lru_add_drain_cpu+0x160/0x320
> >    madvise_free_single_vma+0x2e4/0x470
> >    ? madvise_free_page_range.isra.16+0xd0/0xd0
> >    ? vmacache_update+0x100/0x130
> >    ? find_vma+0x35/0x160
> >    SyS_madvise+0x8ce/0x1450
> > 
> > If somebody frees the page under us and we hold the last reference to
> > it, put_page() would attempt to free the page before unlocking it.
> > 
> > The fix is trivial reorder of operations.
> > 
> > Signed-off-by: Kirill A. Shutemov <kirill.shutemov@linux.intel.com>
> > Reported-by: Reinette Chatre <reinette.chatre@intel.com>
> > Fixes: 9818b8cde622 ("madvise_free, thp: fix madvise_free_huge_pmd return value after splitting")
> 
> Sorry, the wrong Fixes. The right one:
> 
> Fixes: b8d3c4c3009d ("mm/huge_memory.c: don't split THP page when MADV_FREE syscall is called")
> 

Acked-by: Minchan Kim <minchan@kernel.org>

Thanks.

[toc] | [prev] | [next] | [standalone]

#1678194

FromAndrew Morton <akpm@linux-foundation.org>
Date2017-06-29 23:00 +0200
Message-ID<tXOHE-49X-27@gated-at.bofh.it>
In reply to#1676527
On Wed, 28 Jun 2017 13:15:50 +0300 "Kirill A. Shutemov" <kirill@shutemov.name> wrote:

> > Signed-off-by: Kirill A. Shutemov <kirill.shutemov@linux.intel.com>
> > Reported-by: Reinette Chatre <reinette.chatre@intel.com>
> > Fixes: 9818b8cde622 ("madvise_free, thp: fix madvise_free_huge_pmd return value after splitting")
> 
> Sorry, the wrong Fixes. The right one:
> 
> Fixes: b8d3c4c3009d ("mm/huge_memory.c: don't split THP page when MADV_FREE syscall is called")

So I'll add cc:stable, OK?

[toc] | [prev] | [next] | [standalone]

#1678433

From"Kirill A. Shutemov" <kirill@shutemov.name>
Date2017-06-30 05:40 +0200
Message-ID<tXUWJ-8qf-1@gated-at.bofh.it>
In reply to#1678194
On Thu, Jun 29, 2017 at 01:50:51PM -0700, Andrew Morton wrote:
> On Wed, 28 Jun 2017 13:15:50 +0300 "Kirill A. Shutemov" <kirill@shutemov.name> wrote:
> 
> > > Signed-off-by: Kirill A. Shutemov <kirill.shutemov@linux.intel.com>
> > > Reported-by: Reinette Chatre <reinette.chatre@intel.com>
> > > Fixes: 9818b8cde622 ("madvise_free, thp: fix madvise_free_huge_pmd return value after splitting")
> > 
> > Sorry, the wrong Fixes. The right one:
> > 
> > Fixes: b8d3c4c3009d ("mm/huge_memory.c: don't split THP page when MADV_FREE syscall is called")
> 
> So I'll add cc:stable, OK?

Yep.

-- 
 Kirill A. Shutemov

[toc] | [prev] | [next] | [standalone]

#1676711

FromDave Hansen <dave.hansen@intel.com>
Date2017-06-28 16:30 +0200
Message-ID<tXm8F-7TU-11@gated-at.bofh.it>
In reply to#1676520
I came up with the exact same patch.  For posterity, here's the test
case, generated by syzkaller and trimmed down by Reinette:

	https://www.sr71.net/~dave/intel/log2.c

And the config that helps detect this:

	https://www.sr71.net/~dave/intel/config-log2

Acked-by: Dave Hansen <dave.hansen@intel.com>

[toc] | [prev] | [next] | [standalone]

#1677879

FromMichal Hocko <mhocko@kernel.org>
Date2017-06-29 17:50 +0200
Message-ID<tXJRD-XD-1@gated-at.bofh.it>
In reply to#1676520
On Wed 28-06-17 13:12:49, Kirill A. Shutemov wrote:
> Reinette reported following crash:
> 
>   BUG: Bad page state in process log2exe  pfn:57600
>   page:ffffea00015d8000 count:0 mapcount:0 mapping:          (null) index:0x20200
>   flags: 0x4000000000040019(locked|uptodate|dirty|swapbacked)
>   raw: 4000000000040019 0000000000000000 0000000000020200 00000000ffffffff
>   raw: ffffea00015d8020 ffffea00015d8020 0000000000000000 0000000000000000
>   page dumped because: PAGE_FLAGS_CHECK_AT_FREE flag(s) set
>   bad because of flags: 0x1(locked)
>   Modules linked in: rfcomm 8021q bnep intel_rapl x86_pkg_temp_thermal coretemp efivars btusb btrtl btbcm pwm_lpss_pci snd_hda_codec_hdmi btintel pwm_lpss snd_hda_codec_realtek snd_soc_skl snd_hda_codec_generic snd_soc_skl_ipc spi_pxa2xx_platform snd_soc_sst_ipc snd_soc_sst_dsp i2c_designware_platform i2c_designware_core snd_hda_ext_core snd_soc_sst_match snd_hda_intel snd_hda_codec mei_me snd_hda_core mei snd_soc_rt286 snd_soc_rl6347a snd_soc_core efivarfs
>   CPU: 1 PID: 354 Comm: log2exe Not tainted 4.12.0-rc7-test-test #19
>   Hardware name: Intel corporation NUC6CAYS/NUC6CAYB, BIOS AYAPLCEL.86A.0027.2016.1108.1529 11/08/2016
>   Call Trace:
>    dump_stack+0x95/0xeb
>    bad_page+0x16a/0x1f0
>    free_pages_check_bad+0x117/0x190
>    ? rcu_read_lock_sched_held+0xa8/0x130
>    free_hot_cold_page+0x7b1/0xad0
>    __put_page+0x70/0xa0
>    madvise_free_huge_pmd+0x627/0x7b0
>    madvise_free_pte_range+0x6f8/0x1150
>    ? debug_check_no_locks_freed+0x280/0x280
>    ? swapin_walk_pmd_entry+0x380/0x380
>    __walk_page_range+0x6b5/0xe30
>    walk_page_range+0x13b/0x310
>    madvise_free_page_range.isra.16+0xad/0xd0
>    ? force_swapin_readahead+0x110/0x110
>    ? swapin_walk_pmd_entry+0x380/0x380
>    ? lru_add_drain_cpu+0x160/0x320
>    madvise_free_single_vma+0x2e4/0x470
>    ? madvise_free_page_range.isra.16+0xd0/0xd0
>    ? vmacache_update+0x100/0x130
>    ? find_vma+0x35/0x160
>    SyS_madvise+0x8ce/0x1450
> 
> If somebody frees the page under us and we hold the last reference to
> it, put_page() would attempt to free the page before unlocking it.
> 
> The fix is trivial reorder of operations.
> 
> Signed-off-by: Kirill A. Shutemov <kirill.shutemov@linux.intel.com>
> Reported-by: Reinette Chatre <reinette.chatre@intel.com>
> Fixes: 9818b8cde622 ("madvise_free, thp: fix madvise_free_huge_pmd return value after splitting")
> Cc: Huang Ying <ying.huang@intel.com>
> Cc: Minchan Kim <minchan@kernel.org>
> Cc: Dave Hansen <dave.hansen@intel.com>

Acked-by: Michal Hocko <mhocko@suse.com>

> ---
>  mm/huge_memory.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/mm/huge_memory.c b/mm/huge_memory.c
> index 8624450f7106..25b5965c1130 100644
> --- a/mm/huge_memory.c
> +++ b/mm/huge_memory.c
> @@ -1575,8 +1575,8 @@ bool madvise_free_huge_pmd(struct mmu_gather *tlb, struct vm_area_struct *vma,
>  		get_page(page);
>  		spin_unlock(ptl);
>  		split_huge_page(page);
> -		put_page(page);
>  		unlock_page(page);
> +		put_page(page);
>  		goto out_unlocked;
>  	}

I was about to ask what prevents get_page on an already freed page but
then I've noticed that this is still under pmd_trans_huge_lock which is
released right after that said get_page.

-- 
Michal Hocko
SUSE Labs

[toc] | [prev] | [standalone]

Back to top | Article view | linux.kernel

csiph-web