From: Sven Schnelle <svens@linux.ibm.com>
To: Michael Ellerman <mpe@ellerman.id.au>
Cc: Masami Hiramatsu <mhiramat@kernel.org>,
Oleg Nesterov <oleg@redhat.com>,
Peter Zijlstra <peterz@infradead.org>,
Ingo Molnar <mingo@redhat.com>,
Arnaldo Carvalho de Melo <acme@kernel.org>,
Namhyung Kim <namhyung@kernel.org>,
Mark Rutland <mark.rutland@arm.com>,
Alexander Shishkin <alexander.shishkin@linux.intel.com>,
Jiri Olsa <jolsa@kernel.org>, Ian Rogers <irogers@google.com>,
Adrian Hunter <adrian.hunter@intel.com>,
"Liang, Kan" <kan.liang@linux.intel.com>,
Linus Torvalds <torvalds@linux-foundation.org>,
linux-kernel@vger.kernel.org, linux-trace-kernel@vger.kernel.org,
linux-perf-users@vger.kernel.org
Subject: Re: [PATCH] uprobes: use vm_special_mapping close() functionality
Date: Tue, 03 Sep 2024 09:49:13 +0200 [thread overview]
Message-ID: <yt9dikvd9nye.fsf@linux.ibm.com> (raw)
In-Reply-To: <20240903073629.2442754-1-svens@linux.ibm.com> (Sven Schnelle's message of "Tue, 3 Sep 2024 09:36:28 +0200")
Hi Michael,
Sven Schnelle <svens@linux.ibm.com> writes:
> The following KASAN splat was shown:
>
> [ 44.505448] ================================================================== 20:37:27 [3421/145075]
> [ 44.505455] BUG: KASAN: slab-use-after-free in special_mapping_close+0x9c/0xc8
> [ 44.505471] Read of size 8 at addr 00000000868dac48 by task sh/1384
> [ 44.505479]
> [ 44.505486] CPU: 51 UID: 0 PID: 1384 Comm: sh Not tainted 6.11.0-rc6-next-20240902-dirty #1496
> [ 44.505503] Hardware name: IBM 3931 A01 704 (z/VM 7.3.0)
> [ 44.505508] Call Trace:
> [ 44.505511] [<000b0324d2f78080>] dump_stack_lvl+0xd0/0x108
> [ 44.505521] [<000b0324d2f5435c>] print_address_description.constprop.0+0x34/0x2e0
> [ 44.505529] [<000b0324d2f5464c>] print_report+0x44/0x138
> [ 44.505536] [<000b0324d1383192>] kasan_report+0xc2/0x140
> [ 44.505543] [<000b0324d2f52904>] special_mapping_close+0x9c/0xc8
> [ 44.505550] [<000b0324d12c7978>] remove_vma+0x78/0x120
> [ 44.505557] [<000b0324d128a2c6>] exit_mmap+0x326/0x750
> [ 44.505563] [<000b0324d0ba655a>] __mmput+0x9a/0x370
> [ 44.505570] [<000b0324d0bbfbe0>] exit_mm+0x240/0x340
> [ 44.505575] [<000b0324d0bc0228>] do_exit+0x548/0xd70
> [ 44.505580] [<000b0324d0bc1102>] do_group_exit+0x132/0x390
> [ 44.505586] [<000b0324d0bc13b6>] __s390x_sys_exit_group+0x56/0x60
> [ 44.505592] [<000b0324d0adcbd6>] do_syscall+0x2f6/0x430
> [ 44.505599] [<000b0324d2f78434>] __do_syscall+0xa4/0x170
> [ 44.505606] [<000b0324d2f9454c>] system_call+0x74/0x98
> [ 44.505614]
> [ 44.505616] Allocated by task 1384:
> [ 44.505621] kasan_save_stack+0x40/0x70
> [ 44.505630] kasan_save_track+0x28/0x40
> [ 44.505636] __kasan_kmalloc+0xa0/0xc0
> [ 44.505642] __create_xol_area+0xfa/0x410
> [ 44.505648] get_xol_area+0xb0/0xf0
> [ 44.505652] uprobe_notify_resume+0x27a/0x470
> [ 44.505657] irqentry_exit_to_user_mode+0x15e/0x1d0
> [ 44.505664] pgm_check_handler+0x122/0x170
> [ 44.505670]
> [ 44.505672] Freed by task 1384:
> [ 44.505676] kasan_save_stack+0x40/0x70
> [ 44.505682] kasan_save_track+0x28/0x40
> [ 44.505687] kasan_save_free_info+0x4a/0x70
> [ 44.505693] __kasan_slab_free+0x5a/0x70
> [ 44.505698] kfree+0xe8/0x3f0
> [ 44.505704] __mmput+0x20/0x370
> [ 44.505709] exit_mm+0x240/0x340
> [ 44.505713] do_exit+0x548/0xd70
> [ 44.505718] do_group_exit+0x132/0x390
> [ 44.505722] __s390x_sys_exit_group+0x56/0x60
> [ 44.505727] do_syscall+0x2f6/0x430
> [ 44.505732] __do_syscall+0xa4/0x170
> [ 44.505738] system_call+0x74/0x98
> [..]
As this has a dependency on your special mapping close series, do you
want to carry that with your patches?
next prev parent reply other threads:[~2024-09-03 7:49 UTC|newest]
Thread overview: 18+ messages / expand[flat|nested] mbox.gz Atom feed top
[not found] <CAHk-=wjD0XLhkzou89J-TK=L6B88pFoNYxN1uTWRQB3U5Czywg@mail.gmail.com>
2024-09-03 7:36 ` [PATCH] uprobes: use vm_special_mapping close() functionality Sven Schnelle
2024-09-03 7:49 ` Sven Schnelle [this message]
2024-09-04 3:57 ` Michael Ellerman
2024-09-04 21:26 ` Andrew Morton
2024-09-03 9:08 ` Oleg Nesterov
2024-09-03 9:32 ` Sven Schnelle
2024-09-03 19:12 ` Linus Torvalds
2024-09-03 19:31 ` Sven Schnelle
2024-09-03 19:34 ` Linus Torvalds
2024-09-03 19:32 ` Oleg Nesterov
2024-09-04 9:56 ` Oleg Nesterov
2024-09-04 10:03 ` Oleg Nesterov
2024-09-11 9:44 ` Oleg Nesterov
2024-09-11 9:57 ` Oleg Nesterov
2024-09-11 10:12 ` Oleg Nesterov
2024-09-11 13:13 ` [PATCH -mm 1/3] Revert "uprobes: use vm_special_mapping close() functionality" Oleg Nesterov
2024-09-11 13:14 ` [PATCH -mm 2/3] uprobes: introduce the global struct vm_special_mapping xol_mapping Oleg Nesterov
2024-09-11 13:14 ` [PATCH -mm 3/3] uprobes: turn xol_area->pages[2] into xol_area->page Oleg Nesterov
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=yt9dikvd9nye.fsf@linux.ibm.com \
--to=svens@linux.ibm.com \
--cc=acme@kernel.org \
--cc=adrian.hunter@intel.com \
--cc=alexander.shishkin@linux.intel.com \
--cc=irogers@google.com \
--cc=jolsa@kernel.org \
--cc=kan.liang@linux.intel.com \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-perf-users@vger.kernel.org \
--cc=linux-trace-kernel@vger.kernel.org \
--cc=mark.rutland@arm.com \
--cc=mhiramat@kernel.org \
--cc=mingo@redhat.com \
--cc=mpe@ellerman.id.au \
--cc=namhyung@kernel.org \
--cc=oleg@redhat.com \
--cc=peterz@infradead.org \
--cc=torvalds@linux-foundation.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).