From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <linux-kernel-owner@vger.kernel.org>
Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand
        id S1755112AbcJUQxp (ORCPT <rfc822;w@1wt.eu>);
        Fri, 21 Oct 2016 12:53:45 -0400
Received: from mail-pf0-f174.google.com ([209.85.192.174]:36305 "EHLO
        mail-pf0-f174.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org
        with ESMTP id S1754148AbcJUQxn (ORCPT
        <rfc822;linux-kernel@vger.kernel.org>);
        Fri, 21 Oct 2016 12:53:43 -0400
Date: Fri, 21 Oct 2016 09:53:39 -0700
From: Brian Norris <briannorris@chromium.org>
To: Michal Hocko <mhocko@kernel.org>
Cc: Linus Torvalds <torvalds@linux-foundation.org>,
        Andy Lutomirski <luto@kernel.org>,
        Phil not Paul Oester <kernel@linuxace.com>,
        linux-kernel@vger.kernel.org, stable@vger.kernel.org,
        Willy Tarreau <w@1wt.eu>, Guenter Roeck <linux@roeck-us.net>,
        Kees Cook <keescook@chromium.org>,
        Dmitry Torokhov <dmitry.torokhov@gmail.com>
Subject: Re: [3.8 Regression] backporting "[PATCH stable pre 3.9] mm, gup:
 close FOLL MAP_PRIVATE race"
Message-ID: <20161021165339.GA6072@localhost>
References: <20161021063938.GA5463@google.com>
 <20161021064602.GD6045@dhcp22.suse.cz>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <20161021064602.GD6045@dhcp22.suse.cz>
User-Agent: Mutt/1.5.21 (2010-09-15)
Sender: linux-kernel-owner@vger.kernel.org
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

Hi Michal,

On Fri, Oct 21, 2016 at 08:46:02AM +0200, Michal Hocko wrote:
> On Thu 20-10-16 23:39:39, Brian Norris wrote:
> > I'm not sure the best way to report this, but the Chrome OS test
> > infrastructure noticed some problems when testing the following patch
> > backported to our 3.8 kernels:
> > 
> > http://www.spinics.net/lists/stable/msg147998.html
> > 
> > Specifically (if you can hold your nose and stand Gerrit), this change:
> > 
> > https://chromium-review.googlesource.com/#/c/401041/

To be clear to any other readers, the above link has been updated with a
new version. The version in question at the time of the original writing
(and Michal's response) is preserved at this URL:

https://chromium-review.googlesource.com/#/c/401041/2

> This is not correct. You have
> https://chromium-review.googlesource.com/#/c/401041/2/mm/memory.c
> 
> f ((flags & FOLL_WRITE) && !can_follow_write_pte(pte, page, flags)) {
> 		pte_unmap_unlock(ptep, ptl);
> 		goto no_page;
> 	}
> 
> so you do a double unlock. See how my patch does
> +	if ((flags & FOLL_WRITE) && !can_follow_write_pte(pte, page, flags)) {
> +		pte_unmap_unlock(ptep, ptl);
> +		return NULL;
> +	}

Wow, indeed we do have a double unlock. Sorry for not reading the
backport more closely :( But thanks a bunch for the tip -- obvious in
retrospect. Will give that a go.

Also, I could have inferred that if it was so simple to crash the
system, that there *had* to simply be something wrong with our patch,
not with the patch you had (presumably tested and) posted.

Sorry for the noise, and thanks again.

Brian