| Message ID | 20220818130016.45313-5-linmiaohe@huawei.com (mailing list archive) |
|---|---|
| State | New |
| Headers | show |
| Series | A few fixup patches for hugetlb | expand |
On Thu, Aug 18, 2022 at 09:00:14PM +0800, Miaohe Lin wrote: > After kill_procs(), tk will be freed without being removed from the to_kill > list. In the next iteration, the freed list entry in the to_kill list will > be accessed, thus leading to use-after-free issue. kill_procs() runs over the to_kill list and frees all listed items in each iteration. So just after returning from unmap_and_kill(), to_kill->next and to_kill->prev still point to the addresses of struct to_kill which was the first or last item (already freed!). This is bad-manered, but collect_procs_fsdax() in the next iteration calls list_add_tail() and overwrites the dangling pointers with newly allocated item. So this problem should not be so critical? Anyway, I agree with fixing this fragile code. > Fix it by reinitializing > the to_kill list after unmap_and_kill(). > > Fixes: c36e20249571 ("mm: introduce mf_dax_kill_procs() for fsdax case") > Signed-off-by: Miaohe Lin <linmiaohe@huawei.com> > --- > mm/memory-failure.c | 2 ++ > 1 file changed, 2 insertions(+) > > diff --git a/mm/memory-failure.c b/mm/memory-failure.c > index 7023c3d81273..a2f4e8b00a26 100644 > --- a/mm/memory-failure.c > +++ b/mm/memory-failure.c > @@ -1658,6 +1658,8 @@ int mf_dax_kill_procs(struct address_space *mapping, pgoff_t index, > collect_procs_fsdax(page, mapping, index, &to_kill); > unmap_and_kill(&to_kill, page_to_pfn(page), mapping, > index, mf_flags); > + /* Reinitialize to_kill list for later resuing. */ s/resuing/reusing/ ? > + INIT_LIST_HEAD(&to_kill); How about adding list_del() in kill_procs()? Other callers now use to_kill only once, but fixing generally looks tidier to me. Thanks, Naoya Horiguchi
On 2022/8/19 13:23, HORIGUCHI NAOYA(堀口 直也) wrote: > On Thu, Aug 18, 2022 at 09:00:14PM +0800, Miaohe Lin wrote: >> After kill_procs(), tk will be freed without being removed from the to_kill >> list. In the next iteration, the freed list entry in the to_kill list will >> be accessed, thus leading to use-after-free issue. > > kill_procs() runs over the to_kill list and frees all listed items in each > iteration. So just after returning from unmap_and_kill(), to_kill->next and > to_kill->prev still point to the addresses of struct to_kill which was the > first or last item (already freed!). This is bad-manered, but > collect_procs_fsdax() in the next iteration calls list_add_tail() and > overwrites the dangling pointers with newly allocated item. So this problem list_add_tail will do WRITE_ONCE(prev->next, new) where prev is already freed! Or am I miss something? > should not be so critical? Anyway, I agree with fixing this fragile code. > >> Fix it by reinitializing >> the to_kill list after unmap_and_kill(). >> >> Fixes: c36e20249571 ("mm: introduce mf_dax_kill_procs() for fsdax case") >> Signed-off-by: Miaohe Lin <linmiaohe@huawei.com> > >> --- >> mm/memory-failure.c | 2 ++ >> 1 file changed, 2 insertions(+) >> >> diff --git a/mm/memory-failure.c b/mm/memory-failure.c >> index 7023c3d81273..a2f4e8b00a26 100644 >> --- a/mm/memory-failure.c >> +++ b/mm/memory-failure.c >> @@ -1658,6 +1658,8 @@ int mf_dax_kill_procs(struct address_space *mapping, pgoff_t index, >> collect_procs_fsdax(page, mapping, index, &to_kill); >> unmap_and_kill(&to_kill, page_to_pfn(page), mapping, >> index, mf_flags); >> + /* Reinitialize to_kill list for later resuing. */ > > s/resuing/reusing/ ? OK. > >> + INIT_LIST_HEAD(&to_kill); > > How about adding list_del() in kill_procs()? Other callers now use > to_kill only once, but fixing generally looks tidier to me. That's a good idea. Will do it in v2. Many thanks for your review, Naoya! Thanks, Miaohe Lin > > Thanks, > Naoya Horiguchi >
diff --git a/mm/memory-failure.c b/mm/memory-failure.c index 7023c3d81273..a2f4e8b00a26 100644 --- a/mm/memory-failure.c +++ b/mm/memory-failure.c @@ -1658,6 +1658,8 @@ int mf_dax_kill_procs(struct address_space *mapping, pgoff_t index, collect_procs_fsdax(page, mapping, index, &to_kill); unmap_and_kill(&to_kill, page_to_pfn(page), mapping, index, mf_flags); + /* Reinitialize to_kill list for later resuing. */ + INIT_LIST_HEAD(&to_kill); unlock: dax_unlock_mapping_entry(mapping, index, cookie); }
After kill_procs(), tk will be freed without being removed from the to_kill list. In the next iteration, the freed list entry in the to_kill list will be accessed, thus leading to use-after-free issue. Fix it by reinitializing the to_kill list after unmap_and_kill(). Fixes: c36e20249571 ("mm: introduce mf_dax_kill_procs() for fsdax case") Signed-off-by: Miaohe Lin <linmiaohe@huawei.com> --- mm/memory-failure.c | 2 ++ 1 file changed, 2 insertions(+)