From patchwork Thu Jul 5 12:30:17 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Oscar Salvador X-Patchwork-Id: 10508873 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id 7B6C9600F5 for ; Thu, 5 Jul 2018 12:30:22 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 683E128ED8 for ; Thu, 5 Jul 2018 12:30:22 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 5C8C928FC1; Thu, 5 Jul 2018 12:30:22 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-2.9 required=2.0 tests=BAYES_00, MAILING_LIST_MULTI, RCVD_IN_DNSWL_NONE autolearn=ham version=3.3.1 Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id D417A28ED8 for ; Thu, 5 Jul 2018 12:30:21 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id EA8F76B000A; Thu, 5 Jul 2018 08:30:20 -0400 (EDT) Delivered-To: linux-mm-outgoing@kvack.org Received: by kanga.kvack.org (Postfix, from userid 40) id E58A86B000C; Thu, 5 Jul 2018 08:30:20 -0400 (EDT) X-Original-To: int-list-linux-mm@kvack.org X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id D211F6B000D; Thu, 5 Jul 2018 08:30:20 -0400 (EDT) X-Original-To: linux-mm@kvack.org X-Delivered-To: linux-mm@kvack.org Received: from mail-wm0-f72.google.com (mail-wm0-f72.google.com [74.125.82.72]) by kanga.kvack.org (Postfix) with ESMTP id 779706B000A for ; Thu, 5 Jul 2018 08:30:20 -0400 (EDT) Received: by mail-wm0-f72.google.com with SMTP id f13-v6so4268021wmb.4 for ; Thu, 05 Jul 2018 05:30:20 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-original-authentication-results:x-gm-message-state:date:from:to :cc:subject:message-id:references:mime-version:content-disposition :in-reply-to:user-agent; bh=KYCVXzYwSJj6Tjft2OXdg9dFuw45wYWVnM8Pgche3sY=; b=iFhAMA5PWiFzJ7ipR9yFU26uYLmYJCxDmxj9+b1kRJU9OsrPqElURY4ojVSHWb6OQV Sr/6BBF6BAv5G7tU9a53OcpbZ9Cr5dgPMG4YjhYIJPHylZ6HxVOHCrq2OewralFFZr3t DR6c1YRVNyyocy8hdVUz504ivrEq7AFOJOnIplcTqjQCJxxbPl9DGyCGISezpP2yNBXD AEZO65b7BWKAwiZSzP+V4/4Ippz8IR27if/f60kDXpgj+h1nkofYwq/oM44W+tRlCS7g p/yh3KtDwY2mVMLIeHoAp3lQt/OHJXiNBARL5Gk88IbSR6uqbOVxG6Hy6RqnffZzEVK6 LuZg== X-Original-Authentication-Results: mx.google.com; spf=pass (google.com: domain of osalvador.vilardaga@gmail.com designates 209.85.220.65 as permitted sender) smtp.mailfrom=osalvador.vilardaga@gmail.com X-Gm-Message-State: APt69E1MrbcVxkAyLG1ymcptEFeEooHXNtbblabC52+Rpwq3FKCcQLcV 6nCSsI2Fw4G1Osbnjin34bLd9PNbPHou9wYEWVhME5eC4MOsdXeZbQ2olZTJ2IkY4kLGnlCSuDR T+gBA+Hozksht4qMw5GjGFEBVV7XQd8Nxl7iyeCrwxn3XAGiX2DcTnbpE9ygUTe29GLFS4ixH7P DqXJr7gqxg2cTRm0kywSbYg9CFQyJvxXGOJfwm4su+x8jsG3+zq7Zj8Vnz/MmTTKe1ORHPP33ka dplrIqr7vNkKmXeB285UFdKtM2hgc43nsBlVhMAr2tl/d116BSSiwm74++Am8fosbChHSXLt/dZ BYTRYpUyGo96wzicofOL+KKo4HPXl0jUhzpfj1DU8poi9B6+cQOPCDjvnMYAV4e55YC3W9WioA= = X-Received: by 2002:a7b:c0d5:: with SMTP id s21-v6mr3780326wmh.106.1530793820031; Thu, 05 Jul 2018 05:30:20 -0700 (PDT) X-Received: by 2002:a7b:c0d5:: with SMTP id s21-v6mr3780295wmh.106.1530793819118; Thu, 05 Jul 2018 05:30:19 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1530793819; cv=none; d=google.com; s=arc-20160816; b=LltMrNUsC+xn491gppA+zJFtu3NGaMvpcOZepSL1Mt60nebpC4C1pAvFIkqLujslBQ oIMmZkoQE3zxTCDayY4tttEhHNiZYaYRUz//R57pCeBhPYWX8MvY19q0quzeAvQcXeG+ mVBYpopBVCW4Po2klIq+Zic/m3pPZPofi6Bi3sku2g7TjJyqGx8xZ2NfzTxrMvyy4TZD hFOK4ukjmzFKzJKKV+KzpZKHdGhUgVZ6z2suI1FuUM0a5pj11hdnHXjBpu+HZFUmk+pc 1Q07faoVcGBz9+jB1I1+aw9x2fF8S/JTVDfzakpDIxcGcuX2O+/sW/fTV35JrUnXVcUU ZWgQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=user-agent:in-reply-to:content-disposition:mime-version:references :message-id:subject:cc:to:from:date:arc-authentication-results; bh=KYCVXzYwSJj6Tjft2OXdg9dFuw45wYWVnM8Pgche3sY=; b=ebi2FXXUNSpRt/jRTIyq0zmrFhuvee7JubH3R59AbV8rK0kJiknFv0CihdposjqwSU +A4gwP9VIE2RkD1TtXz8av3HErv58Fp3Wsx+GMsHUA83W1wXCkpzFQjASmfm4dvrLW0T SOgzUuaN1HDQPa+tBlVg2mkFAzwLLZwrvvbqFY3OqcjB+l/LDg6Mo49BF9N5DPa2cd81 jve05bsIk8PN44xLMVwkhW6T8EqhR6f0hGoPhodZH+C2cLvJosMgN9V4yP1nEYMngxJy HbBJA/c+XRLuNhrgdJp3YpA6KW3EA2z0CVecodfR5sSnEUASf+GSXrTWo8w40AsG0b0i SL2A== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: domain of osalvador.vilardaga@gmail.com designates 209.85.220.65 as permitted sender) smtp.mailfrom=osalvador.vilardaga@gmail.com Received: from mail-sor-f65.google.com (mail-sor-f65.google.com. [209.85.220.65]) by mx.google.com with SMTPS id c8-v6sor2828245wrs.76.2018.07.05.05.30.18 for (Google Transport Security); Thu, 05 Jul 2018 05:30:19 -0700 (PDT) Received-SPF: pass (google.com: domain of osalvador.vilardaga@gmail.com designates 209.85.220.65 as permitted sender) client-ip=209.85.220.65; Authentication-Results: mx.google.com; spf=pass (google.com: domain of osalvador.vilardaga@gmail.com designates 209.85.220.65 as permitted sender) smtp.mailfrom=osalvador.vilardaga@gmail.com X-Google-Smtp-Source: AAOMgpeem5fL86/KHbzQVCi57rLDSYFRyxmkG6CA7seP28QVQ7cnq7KsHpo1HbATF15u9HH2jsn8gA== X-Received: by 2002:adf:8541:: with SMTP id 59-v6mr4188116wrh.223.1530793818767; Thu, 05 Jul 2018 05:30:18 -0700 (PDT) Received: from techadventures.net (techadventures.net. [62.201.165.239]) by smtp.gmail.com with ESMTPSA id b15-v6sm6983354wrs.96.2018.07.05.05.30.17 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Thu, 05 Jul 2018 05:30:17 -0700 (PDT) Received: by techadventures.net (Postfix, from userid 1000) id 43A8E123BDB; Thu, 5 Jul 2018 14:30:17 +0200 (CEST) Date: Thu, 5 Jul 2018 14:30:17 +0200 From: Oscar Salvador To: Michal Hocko Cc: Zi Yan , Tetsuo Handa , syzbot , akpm@linux-foundation.org, aneesh.kumar@linux.vnet.ibm.com, dan.j.williams@intel.com, kirill.shutemov@linux.intel.com, linux-mm@kvack.org, mst@redhat.com, syzkaller-bugs@googlegroups.com, viro@zeniv.linux.org.uk, ying.huang@intel.com Subject: Re: kernel BUG at mm/gup.c:LINE! Message-ID: <20180705123017.GA31959@techadventures.net> References: <000000000000fe4b15057024bacd@google.com> <20180704111731.GJ22503@dhcp22.suse.cz> <20180704121107.GL22503@dhcp22.suse.cz> <20180704151529.GA23317@techadventures.net> <20180705064335.GA32658@dhcp22.suse.cz> <20180705071839.GB30187@techadventures.net> MIME-Version: 1.0 Content-Disposition: inline In-Reply-To: <20180705071839.GB30187@techadventures.net> User-Agent: Mutt/1.5.23 (2014-03-12) X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: X-Virus-Scanned: ClamAV using ClamSMTP On Thu, Jul 05, 2018 at 09:18:39AM +0200, Oscar Salvador wrote: > > > This is more than unexpected. The patch merely move the alignment check > > up. I will try to investigate some more but I am off for next four days > > and won't be online most of the time. > > > > Btw. does the same happen if you keep do_brk helper and add the length > > sanitization there as well? I took another look. The problem was that while deleting the check in do_brk_flags(), this left then "len" local variable with an unset value, but we need it to contain the request value because we do use it in further calls in do_brk_flags(), like: while (find_vma_links(mm, addr, addr + len, &prev, &rb_link, &rb_parent)) { if (do_munmap(mm, addr, len, uf)) return -ENOMEM; } or if (!may_expand_vm(mm, flags, len >> PAGE_SHIFT)) and so on. This boots and works with the reproducer: diff --git a/mm/mmap.c b/mm/mmap.c index 9859cd4e19b9..e4c9e995870f 100644 --- a/mm/mmap.c +++ b/mm/mmap.c @@ -186,8 +186,8 @@ static struct vm_area_struct *remove_vma(struct vm_area_struct *vma) return next; } -static int do_brk(unsigned long addr, unsigned long len, struct list_head *uf); - +static int do_brk_flags(unsigned long addr, unsigned long request, unsigned long flags, + struct list_head *uf); SYSCALL_DEFINE1(brk, unsigned long, brk) { unsigned long retval; @@ -245,7 +245,7 @@ SYSCALL_DEFINE1(brk, unsigned long, brk) goto out; /* Ok, looks good - let it rip. */ - if (do_brk(oldbrk, newbrk-oldbrk, &uf) < 0) + if (do_brk_flags(oldbrk, newbrk-oldbrk, 0, &uf) < 0) goto out; set_brk: @@ -2934,17 +2934,11 @@ static int do_brk_flags(unsigned long addr, unsigned long request, unsigned long { struct mm_struct *mm = current->mm; struct vm_area_struct *vma, *prev; - unsigned long len; + unsigned long len = request; struct rb_node **rb_link, *rb_parent; pgoff_t pgoff = addr >> PAGE_SHIFT; int error; - len = PAGE_ALIGN(request); - if (len < request) - return -ENOMEM; - if (!len) - return 0; - /* Until we need other flags, refuse anything except VM_EXEC. */ if ((flags & (~VM_EXEC)) != 0) return -EINVAL; @@ -3016,18 +3010,20 @@ static int do_brk_flags(unsigned long addr, unsigned long request, unsigned long return 0; } -static int do_brk(unsigned long addr, unsigned long len, struct list_head *uf) -{ - return do_brk_flags(addr, len, 0, uf); -} - -int vm_brk_flags(unsigned long addr, unsigned long len, unsigned long flags) +int vm_brk_flags(unsigned long addr, unsigned long request, unsigned long flags) { struct mm_struct *mm = current->mm; int ret; + unsigned long len; bool populate; LIST_HEAD(uf); + len = PAGE_ALIGN(request); + if (len < request) + return -ENOMEM; + if (!len) + return 0; + if (down_write_killable(&mm->mmap_sem)) return -EINTR; But I think that we should also add: diff --git a/fs/binfmt_elf.c b/fs/binfmt_elf.c index 0ac456b52bdd..6c7e005ae12d 100644 --- a/fs/binfmt_elf.c +++ b/fs/binfmt_elf.c @@ -1259,9 +1259,9 @@ static int load_elf_library(struct file *file) goto out_free_ph; } - len = ELF_PAGESTART(eppnt->p_filesz + eppnt->p_vaddr + - ELF_MIN_ALIGN - 1); - bss = eppnt->p_memsz + eppnt->p_vaddr; + + len = ELF_PAGEALIGN(eppnt->p_filesz + eppnt->p_vaddr); + bss = ELF_PAGEALIGN(eppnt->p_memsz + eppnt->p_vaddr); if (bss > len) { error = vm_brk(len, bss - len); if (error)