From: Naoya Horiguchi <n-horiguchi@ah.jp.nec.com>
To: "Kirill A. Shutemov" <kirill@shutemov.name>
Cc: linux-mm@kvack.org, Andrew Morton <akpm@linux-foundation.org>,
Dave Hansen <dave.hansen@intel.com>,
Hugh Dickins <hughd@google.com>,
Jerome Marchand <jmarchan@redhat.com>,
linux-kernel@vger.kernel.org,
Naoya Horiguchi <nao.horiguchi@gmail.com>
Subject: Re: [PATCH v4 13/13] mincore: apply page table walker on do_mincore()
Date: Thu, 10 Jul 2014 12:35:55 -0400 [thread overview]
Message-ID: <20140710163555.GB12391@nhori> (raw)
In-Reply-To: <20140710100600.GA30360@node.dhcp.inet.fi>
On Thu, Jul 10, 2014 at 01:06:00PM +0300, Kirill A. Shutemov wrote:
> On Wed, Jul 09, 2014 at 05:36:24PM -0400, Naoya Horiguchi wrote:
> > On Wed, Jul 09, 2014 at 04:34:36PM +0300, Kirill A. Shutemov wrote:
> > > On Tue, Jul 01, 2014 at 01:07:31PM -0400, Naoya Horiguchi wrote:
> > > > This patch makes do_mincore() use walk_page_vma(), which reduces many lines
> > > > of code by using common page table walk code.
> > > >
> > > > ChangeLog v4:
> > > > - remove redundant vma
> > > >
> > > > ChangeLog v3:
> > > > - add NULL vma check in mincore_unmapped_range()
> > > > - don't use pte_entry()
> > > >
> > > > ChangeLog v2:
> > > > - change type of args of callbacks to void *
> > > > - move definition of mincore_walk to the start of the function to fix compiler
> > > > warning
> > > >
> > > > Signed-off-by: Naoya Horiguchi <n-horiguchi@ah.jp.nec.com>
> > >
> > > Trinity crases this implementation of mincore pretty easily:
> > >
> > > [ 42.775369] BUG: unable to handle kernel paging request at ffff88007bb61000
> > > [ 42.776656] IP: [<ffffffff81126f8f>] mincore_unmapped_range+0xdf/0x100
> >
> > Thanks for your testing/reporting.
> >
> > ...
> > >
> > > Looks like 'vec' overflow. I don't see what could prevent do_mincore() to
> > > write more than PAGE_SIZE to 'vec'.
> >
> > I found the miscalculation of walk->private (vec) on thp and hugetlbfs.
> > I confirmed that the reported problem is fixed (I checked that trinity
> > never triggers the reported BUG) with the following changes on this patch.
>
> With the changes:
>
> [ 26.850945] BUG: unable to handle kernel paging request at ffff880852d8c000
> [ 26.852718] IP: [<ffffffff81126de7>] mincore_hugetlb+0x27/0x50
> [ 26.853527] PGD 2ef6067 PUD 2ef9067 PMD 87fd4a067 PTE 8000000852d8c060
> [ 26.854462] Oops: 0002 [#1] SMP DEBUG_PAGEALLOC
> [ 26.854752] Modules linked in:
> [ 26.854752] CPU: 5 PID: 170 Comm: trinity-c5 Not tainted 3.16.0-rc4-next-20140709-00013-g28e4629f71a8-dirty #1453
> [ 26.854752] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011
> [ 26.854752] task: ffff880852d22890 ti: ffff880852d24000 task.ti: ffff880852d24000
> [ 26.854752] RIP: 0010:[<ffffffff81126de7>] [<ffffffff81126de7>] mincore_hugetlb+0x27/0x50
> [ 26.854752] RSP: 0018:ffff880852d27e28 EFLAGS: 00010206
> [ 26.854752] RAX: ffff880852d8c000 RBX: 00007f9fb2200000 RCX: 00007f9fb2200000
> [ 26.854752] RDX: 00007f9fb2001000 RSI: ffffffffffe00000 RDI: ffff88084f3edc80
> [ 26.854752] RBP: ffff880852d27e28 R08: ffff880852d27f10 R09: ffffffff81126dc0
> [ 26.854752] R10: 0000000000000000 R11: 0000000000000001 R12: 00007f9fde000000
> [ 26.854752] R13: ffffffff82e32580 R14: 00007f9fb2000000 R15: ffff880852d27f10
> [ 26.854752] FS: 00007f9fe1bde700(0000) GS:ffff88085a000000(0000) knlGS:0000000000000000
> [ 26.854752] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> [ 26.854752] CR2: ffff880852d8c000 CR3: 0000000852d12000 CR4: 00000000000006e0
> [ 26.854752] Stack:
> [ 26.854752] ffff880852d27eb8 ffffffff81135e24 ffff880852ce01d8 0000000000000282
> [ 26.854752] ffff880852ce01d8 ffff880852d22890 00007f9fde000000 ffff880852d27eb0
> [ 26.854752] 0000000000000282 0000000000000000 ffffffff81127399 0000000000000282
> [ 26.854752] Call Trace:
> [ 26.854752] [<ffffffff81135e24>] __walk_page_range+0x3f4/0x450
> [ 26.854752] [<ffffffff81127399>] ? SyS_mincore+0x179/0x270
> [ 26.854752] [<ffffffff81136031>] walk_page_vma+0x71/0x90
> [ 26.854752] [<ffffffff811273fe>] SyS_mincore+0x1de/0x270
> [ 26.854752] [<ffffffff81126fb0>] ? mincore_unmapped_range+0x100/0x100
> [ 26.854752] [<ffffffff81126eb0>] ? mincore_page+0xa0/0xa0
> [ 26.854752] [<ffffffff81126dc0>] ? handle_mm_fault+0xd30/0xd30
> [ 26.854752] [<ffffffff81746b12>] system_call_fastpath+0x16/0x1b
> [ 26.854752] Code: 0f 1f 40 00 55 48 85 ff 49 8b 40 38 48 89 e5 74 33 48 83 3f 00 40 0f 95 c6 48 39 ca 74 19 66 0f 1f 44 00 00 48 81 c2 00 10 00 00 <40> 88 30 48 83 c0 01 48 39 d1 75 ed 49 89 40 38 31 c0 5d c3 0f
> [ 26.854752] RIP [<ffffffff81126de7>] mincore_hugetlb+0x27/0x50
> [ 26.854752] RSP <ffff880852d27e28>
> [ 26.854752] CR2: ffff880852d8c000
> [ 26.854752] ---[ end trace 536bbdef8c6d5b03 ]---
>
> Could you explain to me how you protect 'vec' from being overflowed? I don't
> any code for that.
I don't do it explicitly, so adding it is one solution.
But I think the problem comes from using walk_page_range() instead of
walk_page_vma() which forcibly sets the walk range from vm->vm_start to
vm->vm_end.
As the original code does, limiting the range to [addr, addr + pages <<
PAGE_SHIFT) is fine because it implicitly prevents buffer overflow.
Here is the revised fix for this patch. Please remove the one I replied
yesterday because it was wrong.
Thanks,
Naoya Horiguchi
---
diff --git a/mm/mincore.c b/mm/mincore.c
index 3c64dcbcb3e2..0e548fbce19e 100644
--- a/mm/mincore.c
+++ b/mm/mincore.c
@@ -34,7 +34,7 @@ static int mincore_hugetlb(pte_t *pte, unsigned long hmask, unsigned long addr,
present = pte && !huge_pte_none(huge_ptep_get(pte));
for (; addr != end; vec++, addr += PAGE_SIZE)
*vec = present;
- walk->private += (end - addr) >> PAGE_SHIFT;
+ walk->private = vec;
#else
BUG();
#endif
@@ -118,8 +118,10 @@ static int mincore_pte_range(pmd_t *pmd, unsigned long addr, unsigned long end,
return 0;
}
- if (pmd_trans_unstable(pmd))
+ if (pmd_trans_unstable(pmd)) {
+ mincore_unmapped_range(addr, end, walk);
return 0;
+ }
ptep = pte_offset_map_lock(walk->mm, pmd, addr, &ptl);
for (; addr != end; ptep++, addr += PAGE_SIZE) {
@@ -168,6 +170,7 @@ static int mincore_pte_range(pmd_t *pmd, unsigned long addr, unsigned long end,
static long do_mincore(unsigned long addr, unsigned long pages, unsigned char *vec)
{
struct vm_area_struct *vma;
+ unsigned long end;
int err;
struct mm_walk mincore_walk = {
.pmd_entry = mincore_pte_range,
@@ -180,16 +183,11 @@ static long do_mincore(unsigned long addr, unsigned long pages, unsigned char *v
if (!vma || addr < vma->vm_start)
return -ENOMEM;
mincore_walk.mm = vma->vm_mm;
-
- err = walk_page_vma(vma, &mincore_walk);
+ end = min(vma->vm_end, addr + (pages << PAGE_SHIFT));
+ err = walk_page_range(addr, end, &mincore_walk);
if (err < 0)
return err;
- else {
- unsigned long end;
-
- end = min(vma->vm_end, addr + (pages << PAGE_SHIFT));
- return (end - addr) >> PAGE_SHIFT;
- }
+ return (end - addr) >> PAGE_SHIFT;
}
/*
--
To unsubscribe, send a message with 'unsubscribe linux-mm' in
the body to majordomo@kvack.org. For more info on Linux MM,
see: http://www.linux-mm.org/ .
Don't email: <a href=mailto:"dont@kvack.org"> email@kvack.org </a>
prev parent reply other threads:[~2014-07-10 16:36 UTC|newest]
Thread overview: 22+ messages / expand[flat|nested] mbox.gz Atom feed top
2014-07-01 17:07 [PATCH v4 00/13] pagewalk: improve vma handling, apply to new users Naoya Horiguchi
2014-07-01 17:07 ` [PATCH v4 01/13] mm/pagewalk: remove pgd_entry() and pud_entry() Naoya Horiguchi
2014-07-01 17:07 ` [PATCH v4 02/13] pagewalk: improve vma handling Naoya Horiguchi
2014-07-01 17:07 ` [PATCH v4 03/13] pagewalk: add walk_page_vma() Naoya Horiguchi
2014-07-01 17:07 ` [PATCH v4 04/13] smaps: remove mem_size_stats->vma and use walk_page_vma() Naoya Horiguchi
2014-07-01 17:07 ` [PATCH v4 05/13] clear_refs: remove clear_refs_private->vma and introduce clear_refs_test_walk() Naoya Horiguchi
2014-07-10 11:32 ` Kirill A. Shutemov
2014-07-10 13:27 ` Naoya Horiguchi
2014-07-01 17:07 ` [PATCH v4 06/13] pagemap: use walk->vma instead of calling find_vma() Naoya Horiguchi
2014-07-01 17:07 ` [PATCH v4 07/13] numa_maps: fix typo in gather_hugetbl_stats Naoya Horiguchi
2014-07-01 17:07 ` [PATCH v4 08/13] numa_maps: remove numa_maps->vma Naoya Horiguchi
2014-07-01 17:07 ` [PATCH v4 09/13] memcg: cleanup preparation for page table walk Naoya Horiguchi
2014-07-01 17:07 ` [PATCH v4 10/13] arch/powerpc/mm/subpage-prot.c: use walk->vma and walk_page_vma() Naoya Horiguchi
2014-07-01 17:07 ` [PATCH v4 11/13] mempolicy: apply page table walker on queue_pages_range() Naoya Horiguchi
2014-07-01 21:00 ` Dave Hansen
2014-07-01 21:51 ` Naoya Horiguchi
2014-07-01 17:07 ` [PATCH v4 12/13] mm: /proc/pid/clear_refs: avoid split_huge_page() Naoya Horiguchi
2014-07-01 17:07 ` [PATCH v4 13/13] mincore: apply page table walker on do_mincore() Naoya Horiguchi
2014-07-09 13:34 ` Kirill A. Shutemov
2014-07-09 21:36 ` Naoya Horiguchi
2014-07-10 10:06 ` Kirill A. Shutemov
2014-07-10 16:35 ` Naoya Horiguchi [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20140710163555.GB12391@nhori \
--to=n-horiguchi@ah.jp.nec.com \
--cc=akpm@linux-foundation.org \
--cc=dave.hansen@intel.com \
--cc=hughd@google.com \
--cc=jmarchan@redhat.com \
--cc=kirill@shutemov.name \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-mm@kvack.org \
--cc=nao.horiguchi@gmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).