From patchwork Thu Jul 19 10:06:47 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: jing xia X-Patchwork-Id: 10534049 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id 5226460547 for ; Thu, 19 Jul 2018 10:07:11 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 4287F293F7 for ; Thu, 19 Jul 2018 10:07:11 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 3644B293AF; Thu, 19 Jul 2018 10:07:11 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-3.0 required=2.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID, DKIM_VALID_AU, FREEMAIL_FROM, MAILING_LIST_MULTI, RCVD_IN_DNSWL_NONE autolearn=unavailable version=3.3.1 Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id BC8F329400 for ; Thu, 19 Jul 2018 10:07:10 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id AA5506B0003; Thu, 19 Jul 2018 06:07:09 -0400 (EDT) Delivered-To: linux-mm-outgoing@kvack.org Received: by kanga.kvack.org (Postfix, from userid 40) id A55416B0006; Thu, 19 Jul 2018 06:07:09 -0400 (EDT) X-Original-To: int-list-linux-mm@kvack.org X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 9459E6B0008; Thu, 19 Jul 2018 06:07:09 -0400 (EDT) X-Original-To: linux-mm@kvack.org X-Delivered-To: linux-mm@kvack.org Received: from mail-pf0-f198.google.com (mail-pf0-f198.google.com [209.85.192.198]) by kanga.kvack.org (Postfix) with ESMTP id 534956B0003 for ; Thu, 19 Jul 2018 06:07:09 -0400 (EDT) Received: by mail-pf0-f198.google.com with SMTP id u16-v6so3835313pfm.15 for ; Thu, 19 Jul 2018 03:07:09 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:dkim-signature:from:to:cc:subject:date :message-id; bh=RJhJrPg5vB3sWmzaN5lFkpQiPrD9UBbb70hv06tTUJ4=; b=HYVIf4oxAG2w1SncHA4aL4P/CD/zLEZbyXGSWML9RsI1UbFUtcF3JCXU5trNbVSx6o 7mIbfhnbeV+12nj2kUk7zKkYD06eoUapO6yhmPbQXl/g260IYA5Zq04PygXOk6mm9/2T yBDcBqcX3ztDnFw8sszpgDF4HlIVYBu9jhabyA6NZTp2BPOM0Rvri/5bEapB3d+xP0jV ELV53jaiu5tP92KbkN6NLYqK9ncVTX8kZycGU0Yu78bEWIsRGSbXdHrvyfb0NeYRlvRI E43AsUpRMPQ0ueXIUVw7gW/PGZ7+JDOEt0kAOD45+aLVYb73jUmNtxBK5UILwx1TPq6F hFew== X-Gm-Message-State: AOUpUlGGkxtvdRZR7w19O/Jj+yiNwlcnLQTnZMGxoJZw2LLsfRJ1CGiI SiY9bop84+Muckzc1z/o4wLrYahrunYlcjbXNlgDwY71XPqHuLmNcdEMR6aWuC4whDOp9EFeWKB c9SWNc9sCxA1yr4RA5WuorqHN5LqmvapTvbKBBMnadVG8P9p/CjYf+pnVWwoKMNJBpEx4jqjmCj BD2VSjUCZTY7oMkzksA/Sa5AmdkCxkJ8emyFQzgtZ2Zum/KrdNsD3wvy/R84MDv0g2msTcboGZT Frypp269OaLuHxydY3fTeKeywS4UZ64PynlTyYUvyuwC/RkbJhikBuvppNCMS0VUr71cLh9A8eI LpG2LTS152SX5CmiS73TVEQ/Jc/kESvSodOt6o2wHQhjkZhMpVaPCs/IJUbbKfbJ11cDVmpCfYT r X-Received: by 2002:a17:902:b693:: with SMTP id c19-v6mr9539959pls.114.1531994829029; Thu, 19 Jul 2018 03:07:09 -0700 (PDT) X-Received: by 2002:a17:902:b693:: with SMTP id c19-v6mr9539893pls.114.1531994827981; Thu, 19 Jul 2018 03:07:07 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1531994827; cv=none; d=google.com; s=arc-20160816; b=sH7j/MxK0sLkhmAdavaZyFqK6yLsjzo1WPHYj4O9HQeMX0XzWes5cwvm+TrLYc6AN1 kVcYYtboNyVSBOjG41BRPrZvHmiA0tMxH1cQ4B0/UsTfUM9SOgbJrL/cSY9Cee0pBc0+ 1aql42KWVFvAHoiNUaveY0TgNTvmaPI8oAnm9Ku/2SzA2nK8Axq5Se9LPa4JnxKE+lHG ywu6SAx+7BVClNzu1X3TNHwl6BmVuuGMUCZUzRmTwoLtYgnXrm0jLLU0byR0T3VYGE7j LrjLbWcif//3FV7USNlWJiIaJuGZOPNgtREG5qqbXBgdyfdYtpjMc6hH3VH4DJSaFRIv ZRMw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=message-id:date:subject:cc:to:from:dkim-signature :arc-authentication-results; bh=RJhJrPg5vB3sWmzaN5lFkpQiPrD9UBbb70hv06tTUJ4=; b=U09ka7PZrpZwdwhfvVHq5SQaDEtZ7uN4VfVzEbJJ4R+w/WMxUR8DER7GAeYz/GyA0l mU529F5KilFl/JY3MlhkCnPiMeyeJHbs5xRXWoYnOJG/uOJi0hbgjZAeLIJmngaFJSvH U1vchGD8n06mdG6DMogXALz1GGTY5KilGThPHJKeguwUGVr6/7uhgqsNz2Bv8Wm/GcP2 1/hIN0KHmAaNMNgdF7fbkhpoyTyJLdvEYklUdolxpaLyr1NMar/rqsAZImiQtGDNapCC i31l0P/7LrPNrgZG2SQ0os83fYfpQ0vxPpD3e0LIOYALJKF8qOByQGTrJZRj8Jyx9Dv4 XHvQ== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@gmail.com header.s=20161025 header.b=LGi5d0Bh; spf=pass (google.com: domain of jing.xia.mail@gmail.com designates 209.85.220.65 as permitted sender) smtp.mailfrom=jing.xia.mail@gmail.com; dmarc=pass (p=NONE sp=QUARANTINE dis=NONE) header.from=gmail.com Received: from mail-sor-f65.google.com (mail-sor-f65.google.com. [209.85.220.65]) by mx.google.com with SMTPS id 19-v6sor1531390pgl.427.2018.07.19.03.07.07 for (Google Transport Security); Thu, 19 Jul 2018 03:07:07 -0700 (PDT) Received-SPF: pass (google.com: domain of jing.xia.mail@gmail.com designates 209.85.220.65 as permitted sender) client-ip=209.85.220.65; Authentication-Results: mx.google.com; dkim=pass header.i=@gmail.com header.s=20161025 header.b=LGi5d0Bh; spf=pass (google.com: domain of jing.xia.mail@gmail.com designates 209.85.220.65 as permitted sender) smtp.mailfrom=jing.xia.mail@gmail.com; dmarc=pass (p=NONE sp=QUARANTINE dis=NONE) header.from=gmail.com DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:to:cc:subject:date:message-id; bh=RJhJrPg5vB3sWmzaN5lFkpQiPrD9UBbb70hv06tTUJ4=; b=LGi5d0BhcB4tPQcG26h5D5OhpGUIlojIG4lB+mcxmmVOvO9fCPITFBLoriP8vcRM7W SsWSt7yC/SnEFr/o6aB/TXMiOQmREPLLkqVa5BQFvTDvHSqGJWKSHaGIIoOkVWSwLQe1 KrU0wVvvDtdKlLueIiTTlwC8f9qMVPrqUMQjeYLuW5iTo4fpjHZNHexVbV+EM0LVpTOq uIMpyC1AYUc5TB2AyPETwm+MSx45Xw6DmgVOf4eeZ0KblVQ0eJ01Cl3zaeH6bgLE6HIA JN//NmrgXYw978tqx4SOoLj6fblWI+Afadq0lwGc9HEvu2zDHC5F0Xe7PUecthW5qKvg GJgA== X-Google-Smtp-Source: AAOMgpf58Ur/K54N5Jqcv1LqCmzf7A84ZeXpRjad39H0B7floe29T/MppWrhK10Q4OePYHd223IhSA== X-Received: by 2002:a65:62d8:: with SMTP id m24-v6mr9447904pgv.307.1531994827602; Thu, 19 Jul 2018 03:07:07 -0700 (PDT) Received: from localhost ([117.18.48.82]) by smtp.gmail.com with ESMTPSA id r25-v6sm19077908pfj.42.2018.07.19.03.07.06 (version=TLS1_2 cipher=AES128-SHA bits=128/128); Thu, 19 Jul 2018 03:07:07 -0700 (PDT) From: Jing Xia X-Google-Original-From: Jing Xia To: hannes@cmpxchg.org, mhocko@kernel.org, vdavydov.dev@gmail.com Cc: chunyan.zhang@unisoc.com, cgroups@vger.kernel.org, linux-mm@kvack.org, linux-kernel@vger.kernel.org Subject: [PATCH] mm: memcg: fix use after free in mem_cgroup_iter() Date: Thu, 19 Jul 2018 18:06:47 +0800 Message-Id: <1531994807-25639-1-git-send-email-jing.xia@unisoc.com> X-Mailer: git-send-email 1.9.1 X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: X-Virus-Scanned: ClamAV using ClamSMTP It was reported that a kernel crash happened in mem_cgroup_iter(), which can be triggered if the legacy cgroup-v1 non-hierarchical mode is used. Unable to handle kernel paging request at virtual address 6b6b6b6b6b6b8f ...... Call trace: mem_cgroup_iter+0x2e0/0x6d4 shrink_zone+0x8c/0x324 balance_pgdat+0x450/0x640 kswapd+0x130/0x4b8 kthread+0xe8/0xfc ret_from_fork+0x10/0x20 mem_cgroup_iter(): ...... if (css_tryget(css)) <-- crash here break; ...... The crashing reason is that mem_cgroup_iter() uses the memcg object whose pointer is stored in iter->position, which has been freed before and filled with POISON_FREE(0x6b). And the root cause of the use-after-free issue is that invalidate_reclaim_iterators() fails to reset the value of iter->position to NULL when the css of the memcg is released in non- hierarchical mode. Signed-off-by: Jing Xia Acked-by: Michal Hocko --- mm/memcontrol.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/mm/memcontrol.c b/mm/memcontrol.c index e6f0d5e..8c0280b 100644 --- a/mm/memcontrol.c +++ b/mm/memcontrol.c @@ -850,7 +850,7 @@ static void invalidate_reclaim_iterators(struct mem_cgroup *dead_memcg) int nid; int i; - while ((memcg = parent_mem_cgroup(memcg))) { + for (; memcg; memcg = parent_mem_cgroup(memcg)) { for_each_node(nid) { mz = mem_cgroup_nodeinfo(memcg, nid); for (i = 0; i <= DEF_PRIORITY; i++) {