From patchwork Sat Jun 18 00:47:36 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yang Shi X-Patchwork-Id: 12886178 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id 08607C43334 for ; Sat, 18 Jun 2022 00:47:40 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id 5728B6B0074; Fri, 17 Jun 2022 20:47:40 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id 520DE6B0075; Fri, 17 Jun 2022 20:47:40 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 3C1546B0078; Fri, 17 Jun 2022 20:47:40 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0010.hostedemail.com [216.40.44.10]) by kanga.kvack.org (Postfix) with ESMTP id 2A3CF6B0074 for ; Fri, 17 Jun 2022 20:47:40 -0400 (EDT) Received: from smtpin04.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay06.hostedemail.com (Postfix) with ESMTP id 01D84352EF for ; Sat, 18 Jun 2022 00:47:39 +0000 (UTC) X-FDA: 79589518680.04.1D804C1 Received: from mail-pf1-f172.google.com (mail-pf1-f172.google.com [209.85.210.172]) by imf18.hostedemail.com (Postfix) with ESMTP id 856D01C0087 for ; Sat, 18 Jun 2022 00:47:39 +0000 (UTC) Received: by mail-pf1-f172.google.com with SMTP id y6so5437351pfr.13 for ; Fri, 17 Jun 2022 17:47:39 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20210112; h=from:to:cc:subject:date:message-id:mime-version :content-transfer-encoding; bh=jAq1OWKefq6Uf6mnDfJMitLNgK+QPvN0uQDkkiwg9A4=; b=dvsWPBgzkIabBMQ6PpwoFSIxmE/zGZQtcit2nkVuW6axlQ7nKKZUmp0jQtOJGsFsHf xBBOj+zNYHsrgX2tHbnk7RjbOLpudzgg9h/AZ1So1LLxQBaieaCsWxAO9QCOAgXVL+Ur WakgRDD5aY2+9pcT16hrGFHmBtcZ5bm6iFNLt6zyuxbe/Gg5zmedjy4RO9AISce3VnZ7 RRK8nruaRTYCd8M1G3cep9njj0bMyXi78Rf8SIHkwgDVf04X6hhdPzKrVRRENWtAMLFY eU5ABXl4fWRbNOyBB7xkd1GKICGwTGiwLV+dkCYjlGk1JWZ38577zqXHvcbYvE9byj8i ztXA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:from:to:cc:subject:date:message-id:mime-version :content-transfer-encoding; bh=jAq1OWKefq6Uf6mnDfJMitLNgK+QPvN0uQDkkiwg9A4=; b=10UcpOxT6dDeIbxcY7F2jGLB9K7+Z4VJCEU8OhCVT90ZBzliyObKfTzGrekxDPws09 2rxvR7wJAeI+qSdDZi9svOEnr06YYY50GVrglmhnRUJsu7uE3WPtVBsm0KkmWvxcHSnP sUMhRWO/F9CfOpWsJoMQNq4GEdgipvwm3Yb27hqW267nAD1IzHslJeta5fohRVPevpye GHBf24W4awlziupzPzw88BCGaP1t/pBRsaDCV6CrW0Rb2LtaPlatz1hoYgXp/TmpJY20 9PrXk2a6dsOICIF1Winkn0ElEdXdXZU+wqfP6pr5D2Mm0qx13B56rpvBZT6sQva1ByW6 dmBg== X-Gm-Message-State: AJIora9f7WCncMwxGUl24wd0aHiNYjt0bbmcgluplvmZm0TFKtWseANS z7wUnlzm08ncYSquPlXvyGnSHyLCd1o= X-Google-Smtp-Source: AGRyM1vGGwXGS75rbw/4GKiK2NGssYitd1RTX5wepPhPrBlPkhAMP3i/JqQSELQxTkHOUB0c5ItQyA== X-Received: by 2002:a63:914b:0:b0:3fc:f8b2:d947 with SMTP id l72-20020a63914b000000b003fcf8b2d947mr11239602pge.491.1655513258571; Fri, 17 Jun 2022 17:47:38 -0700 (PDT) Received: from localhost.localdomain (c-67-174-241-145.hsd1.ca.comcast.net. [67.174.241.145]) by smtp.gmail.com with ESMTPSA id p48-20020a056a0026f000b0050dc7628184sm4376827pfw.94.2022.06.17.17.47.37 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 17 Jun 2022 17:47:37 -0700 (PDT) From: Yang Shi To: akpm@linux-foundation.org Cc: shy828301@gmail.com, linux-mm@kvack.org, linux-kernel@vger.kernel.org Subject: [mm-unstable PATCH] mm: thp: fix hugepage_vma_check() for gate vma Date: Fri, 17 Jun 2022 17:47:36 -0700 Message-Id: <20220618004736.1235352-1-shy828301@gmail.com> X-Mailer: git-send-email 2.26.3 MIME-Version: 1.0 ARC-Authentication-Results: i=1; imf18.hostedemail.com; dkim=pass header.d=gmail.com header.s=20210112 header.b=dvsWPBgz; dmarc=pass (policy=none) header.from=gmail.com; spf=pass (imf18.hostedemail.com: domain of shy828301@gmail.com designates 209.85.210.172 as permitted sender) smtp.mailfrom=shy828301@gmail.com ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1655513259; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-transfer-encoding:content-transfer-encoding: in-reply-to:references:dkim-signature; bh=jAq1OWKefq6Uf6mnDfJMitLNgK+QPvN0uQDkkiwg9A4=; b=oIQS2OVW97LWPZoxZRmfkMD/C+9+8UQBRgtsYgEZi0USOECwN/sUPj9Oq43iYpeJAk8ovR QCCizGcjPkFCVUP83PP9HSzJKV8r+1Ms1mAZ52+j6bgcqxEr4fRTKCqJiiMBgieREE9ye+ l3qzyexK9tc5d8eZmXFHlqsBVQ+UpAo= ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1655513259; a=rsa-sha256; cv=none; b=XRqMahaxxEyIt4FV8li9EK8ILIWAG/wppIo+P6kdx54ZzKSi0WfA7qzNncBE66nmcBPvd8 5QyAy5KPwLGNh5jIGRrNSHAuguDPDThq2o70IBKOC8tmNNq1QM1eneZOA0Fk3ueT2sdPVo QLQJ8RAHaRqkJwXNPXj/d/iVm/UhLe4= X-Stat-Signature: ojccgqwy4dxzxmwcw3sdhfmxhtbb7kmd X-Rspamd-Queue-Id: 856D01C0087 X-Rspam-User: Authentication-Results: imf18.hostedemail.com; dkim=pass header.d=gmail.com header.s=20210112 header.b=dvsWPBgz; dmarc=pass (policy=none) header.from=gmail.com; spf=pass (imf18.hostedemail.com: domain of shy828301@gmail.com designates 209.85.210.172 as permitted sender) smtp.mailfrom=shy828301@gmail.com X-Rspamd-Server: rspam10 X-HE-Tag: 1655513259-638461 X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: The syzbot reported the below issue: BUG: KASAN: null-ptr-deref in instrument_atomic_read include/linux/instrumented.h:71 [inline] BUG: KASAN: null-ptr-deref in test_bit include/asm-generic/bitops/instrumented-non-atomic.h:134 [inline] BUG: KASAN: null-ptr-deref in hugepage_vma_check+0x8e/0x750 mm/huge_memory.c:82 Read of size 8 at addr 00000000000005a8 by task syz-executor.5/21978 CPU: 0 PID: 21978 Comm: syz-executor.5 Not tainted 5.19.0-rc2-next-20220616-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106 kasan_report+0xbe/0x1f0 mm/kasan/report.c:495 check_region_inline mm/kasan/generic.c:183 [inline] kasan_check_range+0x13d/0x180 mm/kasan/generic.c:189 instrument_atomic_read include/linux/instrumented.h:71 [inline] test_bit include/asm-generic/bitops/instrumented-non-atomic.h:134 [inline] hugepage_vma_check+0x8e/0x750 mm/huge_memory.c:82 show_smap+0x1c6/0x470 fs/proc/task_mmu.c:866 traverse.part.0+0xcf/0x5f0 fs/seq_file.c:111 traverse fs/seq_file.c:101 [inline] seq_read_iter+0x90f/0x1280 fs/seq_file.c:195 seq_read+0x337/0x4b0 fs/seq_file.c:162 do_loop_readv_writev fs/read_write.c:763 [inline] do_loop_readv_writev fs/read_write.c:750 [inline] do_iter_read+0x4f8/0x750 fs/read_write.c:805 vfs_readv+0xe5/0x150 fs/read_write.c:923 do_preadv fs/read_write.c:1015 [inline] __do_sys_preadv fs/read_write.c:1065 [inline] __se_sys_preadv fs/read_write.c:1060 [inline] __x64_sys_preadv+0x22b/0x310 fs/read_write.c:1060 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x46/0xb0 RIP: 0033:0x7f5c1d889109 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f5c1ea69168 EFLAGS: 00000246 ORIG_RAX: 0000000000000127 RAX: ffffffffffffffda RBX: 00007f5c1d99bf60 RCX: 00007f5c1d889109 RDX: 0000000000000001 RSI: 00000000200006c0 RDI: 0000000000000005 RBP: 00007f5c1d8e305d R08: 0000000000000000 R09: 0000000000000000 R10: 00000000fffffffe R11: 0000000000000246 R12: 0000000000000000 R13: 00007ffd8514b43f R14: 00007f5c1ea69300 R15: 0000000000022000 The mm of the vma returned by smaps is NULL. But it seems impossible for normal vma since the mm is pinned before reaching hugepage_vma_check() unless the vma is gate vma. The gate vma doesn't have valid mm, but its size is PAGE_SIZE so the old code (checking vma size first) did return before dereferencing mm. So move vma size check to the top to make sure it returns for gate vma before dereferencing mm. Reported-by: syzbot+4d875b4d2e2b60bae9b4@syzkaller.appspotmail.com Signed-off-by: Yang Shi --- mm/huge_memory.c | 24 ++++++++++++++---------- 1 file changed, 14 insertions(+), 10 deletions(-) diff --git a/mm/huge_memory.c b/mm/huge_memory.c index 2e2a8b5bc567..8e4ebd155ec6 100644 --- a/mm/huge_memory.c +++ b/mm/huge_memory.c @@ -73,6 +73,20 @@ bool hugepage_vma_check(struct vm_area_struct *vma, unsigned long vm_flags, bool smaps, bool in_pf) { + /* + * Check alignment for file vma and size for both file and anon vma. + * + * Call this before touching mm since gate vma may be met by smaps, + * which doesn't have valid mm. The size of gate vma is PAGE_SIZE so + * it will just return here. + * + * Skip the check for page fault. Huge fault does the check in fault + * handlers. And this check is not suitable for huge PUD fault. + */ + if (!in_pf && + !transhuge_vma_suitable(vma, (vma->vm_end - HPAGE_PMD_SIZE))) + return false; + /* * Explicitly disabled through madvise or prctl, or some * architectures may disable THP for some mappings, for @@ -99,16 +113,6 @@ bool hugepage_vma_check(struct vm_area_struct *vma, if (vm_flags & VM_NO_KHUGEPAGED) return false; - /* - * Check alignment for file vma and size for both file and anon vma. - * - * Skip the check for page fault. Huge fault does the check in fault - * handlers. And this check is not suitable for huge PUD fault. - */ - if (!in_pf && - !transhuge_vma_suitable(vma, (vma->vm_end - HPAGE_PMD_SIZE))) - return false; - /* * Enabled via shmem mount options or sysfs settings. * Must be done before hugepage flags check since shmem has its