linux-fsdevel.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
From: Sasha Levin <sasha.levin@oracle.com>
To: "Kirill A. Shutemov" <kirill.shutemov@linux.intel.com>,
	Linus Torvalds <torvalds@linux-foundation.org>,
	Andrew Morton <akpm@linux-foundation.org>,
	Mel Gorman <mgorman@suse.de>, Rik van Riel <riel@redhat.com>
Cc: Andi Kleen <ak@linux.intel.com>,
	Matthew Wilcox <matthew.r.wilcox@intel.com>,
	Dave Hansen <dave.hansen@linux.intel.com>,
	Alexander Viro <viro@zeniv.linux.org.uk>,
	Dave Chinner <david@fromorbit.com>, Ning Qu <quning@gmail.com>,
	linux-mm@kvack.org, linux-fsdevel@vger.kernel.org,
	linux-kernel@vger.kernel.org, Dave Jones <davej@redhat.com>,
	Andrey Ryabinin <a.ryabinin@samsung.com>
Subject: Re: [PATCHv3 1/2] mm: introduce vm_ops->map_pages()
Date: Thu, 24 Jul 2014 09:05:42 -0400	[thread overview]
Message-ID: <53D104A6.4050402@oracle.com> (raw)
In-Reply-To: <53D07E96.5000006@oracle.com>

On 07/23/2014 11:33 PM, Sasha Levin wrote:
> On 02/27/2014 02:53 PM, Kirill A. Shutemov wrote:
>> > The patch introduces new vm_ops callback ->map_pages() and uses it for
>> > mapping easy accessible pages around fault address.
>> > 
>> > On read page fault, if filesystem provides ->map_pages(), we try to map
>> > up to FAULT_AROUND_PAGES pages around page fault address in hope to
>> > reduce number of minor page faults.
>> > 
>> > We call ->map_pages first and use ->fault() as fallback if page by the
>> > offset is not ready to be mapped (cold page cache or something).
>> > 
>> > Signed-off-by: Kirill A. Shutemov <kirill.shutemov@linux.intel.com>
>> > ---
> Hi all,
> 
> This patch triggers use-after-free when fuzzing using trinity and the KASAN
> patchset.

FWIW, if it helps, here's another KASAN report with the conventional BUG following it:

[  360.498001] ==================================================================
[  360.500896] AddressSanitizer: use after free in do_read_fault.isra.40+0x3c2/0x510 at addr ffff880581ee3fd0
[  360.504474] page:ffffea001607b8c0 count:0 mapcount:0 mapping:          (null) index:0x0
[  360.507264] page flags: 0xefffff80000000()
[  360.508655] page dumped because: kasan error
[  360.509489] CPU: 8 PID: 9251 Comm: trinity-c159 Not tainted 3.16.0-rc6-next-20140723-sasha-00047-g289342b-dirty #929
[  360.511717]  00000000000000ff 0000000000000000 ffffea001607b8c0 ffff8801ba8bbb98
[  360.513272]  ffffffff8fe40903 ffff8801ba8bbc68 ffff8801ba8bbc58 ffffffff8b42acfc
[  360.514729]  0000000000000001 ffff880592deaa48 ffff8801ba84b038 ffff8801ba8bbbd0
[  360.516156] Call Trace:
[  360.516622] dump_stack (lib/dump_stack.c:52)
[  360.517566] kasan_report_error (mm/kasan/report.c:98 mm/kasan/report.c:166)
[  360.518745] ? debug_smp_processor_id (lib/smp_processor_id.c:57)
[  360.519923] ? preempt_count_sub (kernel/sched/core.c:2606)
[  360.521124] ? put_lock_stats.isra.13 (./arch/x86/include/asm/preempt.h:98 kernel/locking/lockdep.c:254)
[  360.522431] ? do_read_fault.isra.40 (mm/memory.c:2784 mm/memory.c:2849 mm/memory.c:2898)
[  360.523651] __asan_load8 (mm/kasan/kasan.c:364)
[  360.524625] ? do_read_fault.isra.40 (mm/memory.c:2864 mm/memory.c:2898)
[  360.525887] do_read_fault.isra.40 (mm/memory.c:2864 mm/memory.c:2898)
[  360.527156] ? __rcu_read_unlock (kernel/rcu/update.c:101)
[  360.528251] handle_mm_fault (mm/memory.c:3092 mm/memory.c:3225 mm/memory.c:3345 mm/memory.c:3374)
[  360.529308] ? vmacache_update (mm/vmacache.c:61)
[  360.530505] ? find_vma (mm/mmap.c:2027)
[  360.531453] __do_page_fault (arch/x86/mm/fault.c:1231)
[  360.532503] ? context_tracking_user_exit (kernel/context_tracking.c:184)
[  360.533744] ? __this_cpu_preempt_check (lib/smp_processor_id.c:63)
[  360.535001] ? trace_hardirqs_off_caller (kernel/locking/lockdep.c:2639 (discriminator 8))
[  360.536262] ? trace_hardirqs_off (kernel/locking/lockdep.c:2645)
[  360.537360] trace_do_page_fault (arch/x86/mm/fault.c:1314 include/linux/jump_label.h:115 include/linux/context_tracking_state.h:27 include/linux/context_tracking.h:45 arch/x86/mm/fault.c:1315)
[  360.538493] do_async_page_fault (arch/x86/kernel/kvm.c:279)
[  360.539567] async_page_fault (arch/x86/kernel/entry_64.S:1321)
[  360.540668] Read of size 8 by thread T9251:
[  360.541485] Memory state around the buggy address:
[  360.542463]  ffff880581ee3d00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[  360.543816]  ffff880581ee3d80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[  360.545116]  ffff880581ee3e00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[  360.546476]  ffff880581ee3e80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[  360.547806]  ffff880581ee3f00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[  360.549112] >ffff880581ee3f80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[  360.550507]                                                  ^
[  360.551574]  ffff880581ee4000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[  360.552910]  ffff880581ee4080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[  360.554207]  ffff880581ee4100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[  360.555621]  ffff880581ee4180: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[  360.557035]  ffff880581ee4200: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[  360.558489] ==================================================================
[  360.559804] BUG: unable to handle kernel paging request at ffff880581ee3fd0
[  360.559817] IP: do_read_fault.isra.40 (mm/memory.c:2864 mm/memory.c:2898)
[  360.559827] PGD 147b9067 PUD 70353d067 PMD 70352d067 PTE 8000000581ee3060
[  360.559836] Oops: 0000 [#1] PREEMPT SMP DEBUG_PAGEALLOC
[  360.559892] Dumping ftrace buffer:
[  360.560117]    (ftrace buffer empty)
[  360.560132] Modules linked in:
[  360.560145] CPU: 8 PID: 9251 Comm: trinity-c159 Not tainted 3.16.0-rc6-next-20140723-sasha-00047-g289342b-dirty #929
[  360.560154] task: ffff8801ba84b000 ti: ffff8801ba8b8000 task.ti: ffff8801ba8b8000
[  360.560172] RIP: do_read_fault.isra.40 (mm/memory.c:2864 mm/memory.c:2898)
[  360.560180] RSP: 0000:ffff8801ba8bbc98  EFLAGS: 00010296
[  360.560186] RAX: 0000000000000000 RBX: ffff8801ba8d5a00 RCX: 0000000000000006
[  360.560192] RDX: 0000000000000006 RSI: ffffffff912f5fd5 RDI: 0000000000000282
[  360.560199] RBP: ffff8801ba8bbd58 R08: 0000000000000001 R09: 0000000000000000
[  360.560206] R10: 0000000000000000 R11: 0000000000000000 R12: ffff8801ba8ad470
[  360.560213] R13: 00007f2411bfa000 R14: 0000000000000000 R15: ffff880581ee3fd0
[  360.560222] FS:  00007f2412de6700(0000) GS:ffff8801de000000(0000) knlGS:0000000000000000
[  360.560228] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[  360.560234] CR2: ffff880581ee3fd0 CR3: 00000001ba89b000 CR4: 00000000000006a0
[  360.560255] DR0: 00000000006ec000 DR1: 0000000000000000 DR2: 0000000000000000
[  360.560262] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 00000000000d0602
[  360.560264] Stack:
[  360.560278]  0000000000000001 0000000000000000 ffff880581ee4030 ffff880592deaa30
[  360.560290]  0000000000000005 00007f2411c07000 ffff8801ba8d5a90 ffff880592deaa30
[  360.560297]  0000000000000000 000000a8ba84b038 000000000000000c 00007f2411c06220
[  360.560299] Call Trace:
[  360.560317] ? __rcu_read_unlock (kernel/rcu/update.c:101)
[  360.560332] handle_mm_fault (mm/memory.c:3092 mm/memory.c:3225 mm/memory.c:3345 mm/memory.c:3374)
[  360.560345] ? vmacache_update (mm/vmacache.c:61)
[  360.560358] ? find_vma (mm/mmap.c:2027)
[  360.560370] __do_page_fault (arch/x86/mm/fault.c:1231)
[  360.560386] ? context_tracking_user_exit (kernel/context_tracking.c:184)
[  360.560400] ? __this_cpu_preempt_check (lib/smp_processor_id.c:63)
[  360.560413] ? trace_hardirqs_off_caller (kernel/locking/lockdep.c:2639 (discriminator 8))
[  360.560425] ? trace_hardirqs_off (kernel/locking/lockdep.c:2645)
[  360.560432] trace_do_page_fault (arch/x86/mm/fault.c:1314 include/linux/jump_label.h:115 include/linux/context_tracking_state.h:27 include/linux/context_tracking.h:45 arch/x86/mm/fault.c:1315)
[  360.560440] do_async_page_fault (arch/x86/kernel/kvm.c:279)
[  360.560447] async_page_fault (arch/x86/kernel/entry_64.S:1321)
[ 360.560458] Code: 47 f9 48 8b 8d 68 ff ff ff 48 29 f1 48 c1 e9 0c 49 8d 44 08 ff 48 39 c7 48 0f 46 c7 4c 89 ff 48 89 85 60 ff ff ff e8 3e 19 07 00 <49> 83 3f 00 0f 84 8f 00 00 00 49 83 c6 01 4c 39 b5 60 ff ff ff
All code
========
   0:	47 f9                	rex.RXB stc
   2:	48 8b 8d 68 ff ff ff 	mov    -0x98(%rbp),%rcx
   9:	48 29 f1             	sub    %rsi,%rcx
   c:	48 c1 e9 0c          	shr    $0xc,%rcx
  10:	49 8d 44 08 ff       	lea    -0x1(%r8,%rcx,1),%rax
  15:	48 39 c7             	cmp    %rax,%rdi
  18:	48 0f 46 c7          	cmovbe %rdi,%rax
  1c:	4c 89 ff             	mov    %r15,%rdi
  1f:	48 89 85 60 ff ff ff 	mov    %rax,-0xa0(%rbp)
  26:	e8 3e 19 07 00       	callq  0x71969
  2b:*	49 83 3f 00          	cmpq   $0x0,(%r15)		<-- trapping instruction
  2f:	0f 84 8f 00 00 00    	je     0xc4
  35:	49 83 c6 01          	add    $0x1,%r14
  39:	4c 39 b5 60 ff ff ff 	cmp    %r14,-0xa0(%rbp)
	...

Code starting with the faulting instruction
===========================================
   0:	49 83 3f 00          	cmpq   $0x0,(%r15)
   4:	0f 84 8f 00 00 00    	je     0x99
   a:	49 83 c6 01          	add    $0x1,%r14
   e:	4c 39 b5 60 ff ff ff 	cmp    %r14,-0xa0(%rbp)
	...
[  360.560458] RIP do_read_fault.isra.40 (mm/memory.c:2864 mm/memory.c:2898)
[  360.560458]  RSP <ffff8801ba8bbc98>
[  360.560458] CR2: ffff880581ee3fd0
[  360.560458] ---[ end trace ccd7cee352be7945 ]---

Thanks,
Sasha

--
To unsubscribe, send a message with 'unsubscribe linux-mm' in
the body to majordomo@kvack.org.  For more info on Linux MM,
see: http://www.linux-mm.org/ .
Don't email: <a href=mailto:"dont@kvack.org"> email@kvack.org </a>

  parent reply	other threads:[~2014-07-24 13:05 UTC|newest]

Thread overview: 35+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2014-02-27 19:53 [PATCHv3 0/2] mm: map few pages around fault address if they are in page cache Kirill A. Shutemov
2014-02-27 19:53 ` [PATCHv3 1/2] mm: introduce vm_ops->map_pages() Kirill A. Shutemov
2014-02-27 21:59   ` Dave Hansen
2014-02-27 22:06     ` Linus Torvalds
2014-02-27 22:34       ` Dave Hansen
2014-02-28  0:18         ` Kirill A. Shutemov
2014-02-28 11:50         ` Benjamin Herrenschmidt
2014-02-27 22:08     ` Andrew Morton
2014-03-03 23:16   ` Andrew Morton
2014-03-04  1:26     ` Kirill A. Shutemov
2014-03-05  0:04     ` Rusty Russell
2014-03-05 20:02       ` Andrew Morton
2014-07-24  3:33   ` Sasha Levin
2014-07-24  6:53     ` Andrey Ryabinin
2014-07-24 12:48       ` Sasha Levin
2014-07-24 13:05     ` Sasha Levin [this message]
2014-07-24 13:30       ` Konstantin Khlebnikov
2014-07-28  7:43     ` [PATCH] mm: don't allow fault_around_bytes to be 0 Andrey Ryabinin
2014-07-28  7:47       ` Andrey Ryabinin
2014-07-28  9:36       ` Kirill A. Shutemov
2014-07-28 10:27         ` Andrey Ryabinin
2014-07-28 10:52           ` Kirill A. Shutemov
2014-07-28 12:32           ` Sasha Levin
2014-07-28 22:43           ` David Rientjes
2014-07-28 15:26         ` Dave Hansen
2014-02-27 19:53 ` [PATCHv3 2/2] mm: implement ->map_pages for page cache Kirill A. Shutemov
2014-02-27 21:47   ` Andrew Morton
2014-02-28  0:31     ` Kirill A. Shutemov
2014-04-02 18:03   ` Konstantin Khlebnikov
2014-04-02 19:07     ` Kirill A. Shutemov
2014-02-27 21:28 ` [PATCHv3 0/2] mm: map few pages around fault address if they are in " Linus Torvalds
2014-02-28  0:10   ` Kirill A. Shutemov
2014-02-28  3:52     ` Wilcox, Matthew R
2014-02-28 23:08     ` Linus Torvalds
2014-03-12 14:22   ` Kirill A. Shutemov

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=53D104A6.4050402@oracle.com \
    --to=sasha.levin@oracle.com \
    --cc=a.ryabinin@samsung.com \
    --cc=ak@linux.intel.com \
    --cc=akpm@linux-foundation.org \
    --cc=dave.hansen@linux.intel.com \
    --cc=davej@redhat.com \
    --cc=david@fromorbit.com \
    --cc=kirill.shutemov@linux.intel.com \
    --cc=linux-fsdevel@vger.kernel.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=linux-mm@kvack.org \
    --cc=matthew.r.wilcox@intel.com \
    --cc=mgorman@suse.de \
    --cc=quning@gmail.com \
    --cc=riel@redhat.com \
    --cc=torvalds@linux-foundation.org \
    --cc=viro@zeniv.linux.org.uk \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).