From patchwork Fri Oct 1 21:56:30 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Eric Dumazet X-Patchwork-Id: 12531747 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 91BABC433EF for ; Fri, 1 Oct 2021 21:56:36 +0000 (UTC) Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by mail.kernel.org (Postfix) with ESMTP id 2C07861247 for ; Fri, 1 Oct 2021 21:56:36 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.4.1 mail.kernel.org 2C07861247 Authentication-Results: mail.kernel.org; dmarc=fail (p=none dis=none) header.from=gmail.com Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=kvack.org Received: by kanga.kvack.org (Postfix) id AD52094014F; Fri, 1 Oct 2021 17:56:35 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id A848D940121; Fri, 1 Oct 2021 17:56:35 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 94BF394014F; Fri, 1 Oct 2021 17:56:35 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from forelay.hostedemail.com (smtprelay0183.hostedemail.com [216.40.44.183]) by kanga.kvack.org (Postfix) with ESMTP id 83583940121 for ; Fri, 1 Oct 2021 17:56:35 -0400 (EDT) Received: from smtpin24.hostedemail.com (10.5.19.251.rfc1918.com [10.5.19.251]) by forelay03.hostedemail.com (Postfix) with ESMTP id 3FDC98249980 for ; Fri, 1 Oct 2021 21:56:35 +0000 (UTC) X-FDA: 78649228350.24.2BB6A78 Received: from mail-pf1-f179.google.com (mail-pf1-f179.google.com [209.85.210.179]) by imf08.hostedemail.com (Postfix) with ESMTP id F2356300186D for ; Fri, 1 Oct 2021 21:56:34 +0000 (UTC) Received: by mail-pf1-f179.google.com with SMTP id 145so9096290pfz.11 for ; Fri, 01 Oct 2021 14:56:34 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20210112; h=from:to:cc:subject:date:message-id:mime-version :content-transfer-encoding; bh=Y0HYkhZW+UnFaJxDdjyTcTV7bE6XCnU8G/h+aF91cys=; b=G52OGId37JvuenFKWC82JJOBf3Ros45azAwPvTEEuGTUO0z/uqct0FVHC07Vry10Os DceFEfAIlTY9Iibk9gMbm5P9nksmmIcX7en1g9eZJ5vg8XYvj1bzrXEnpSWU+FoaF3Dx kl3+efNw2+qTKtYv92szcOmCimEl3tlbTojE6zWNbK5V//hl4hNcE8v0GncMjIv9SqjW qpIijxOZejNAa9ix7GYfQ6OiKSBdg3m2dqK3mfPVO7FC62qklCUbLRhezpq7DaeLstnx 6Lh9H0jlmigBoSjAl/rUkBmbEiOGo5bWzIEjAJevybVhQhLjKucxs8mam2ccqyK7FCIS IqVQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:from:to:cc:subject:date:message-id:mime-version :content-transfer-encoding; bh=Y0HYkhZW+UnFaJxDdjyTcTV7bE6XCnU8G/h+aF91cys=; b=gNoMwBlU6M+8fd1ptsVp+mRaenhXvqBbp6FHthpyrVrOzZANJEaB2RP32pC1KYrOV9 hunyXxMpRcrEoDK57n0NcsS41/IL937RKHQFgQeJzxtBrKdpO+Caqqng71I6LlTqbK4R iv7XYZPExcccKcb8FWVU1RKF3Mh+y5LW+LNySfGuN45nhy38zhVuHL65+11TsaHhEnj2 i4VrPPnOyrgQQvC9Ij3OUHxy8I8qoF9wGmDdLkcSfem5qJhnzGz0eBBebBlhCu8qWIMe x0AUMBWIKUvEM97QS8jk3zIyfw1wpDyCvNgGXBtgSeIgaKj9mU6frTa9KJkxd0oGI9OK kR/A== X-Gm-Message-State: AOAM530BLnEQJrjCoVx0Bz+s0vhEDjqthN6df8Vv5f9UU4mWXDHXcmX9 9ZUA6JsRb9rQ4iDOHnedxvk= X-Google-Smtp-Source: ABdhPJwSjplbrAiB8YX+59gmbtocYp84ljQvPvMBs3dspkRb5dUdv845u5h8qQaj6bL/25kmH8b4DA== X-Received: by 2002:a63:4003:: with SMTP id n3mr274013pga.413.1633125393800; Fri, 01 Oct 2021 14:56:33 -0700 (PDT) Received: from edumazet1.svl.corp.google.com ([2620:15c:2c4:201:63c:b112:55c:f7f4]) by smtp.gmail.com with ESMTPSA id 26sm8142954pgx.72.2021.10.01.14.56.32 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 01 Oct 2021 14:56:33 -0700 (PDT) From: Eric Dumazet To: Andrew Morton Cc: linux-kernel , linux-mm , Eric Dumazet , Eric Dumazet , syzbot , "Huang, Ying" , Mel Gorman Subject: [PATCH v2] mm/mempolicy: do not allow illegal MPOL_F_NUMA_BALANCING | MPOL_LOCAL in mbind() Date: Fri, 1 Oct 2021 14:56:30 -0700 Message-Id: <20211001215630.810592-1-eric.dumazet@gmail.com> X-Mailer: git-send-email 2.33.0.800.g4c38ced690-goog MIME-Version: 1.0 X-Rspamd-Queue-Id: F2356300186D X-Stat-Signature: h6hpwyfj7oazdibuqdgquju4u6gmmqeq Authentication-Results: imf08.hostedemail.com; dkim=pass header.d=gmail.com header.s=20210112 header.b=G52OGId3; spf=pass (imf08.hostedemail.com: domain of eric.dumazet@gmail.com designates 209.85.210.179 as permitted sender) smtp.mailfrom=eric.dumazet@gmail.com; dmarc=pass (policy=none) header.from=gmail.com X-Rspamd-Server: rspam06 X-HE-Tag: 1633125394-581137 X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: From: Eric Dumazet syzbot reported access to unitialized memory in mbind() [1] Issue came with commit bda420b98505 ("numa balancing: migrate on fault among multiple bound nodes") This commit added a new bit in MPOL_MODE_FLAGS, but only checked valid combination (MPOL_F_NUMA_BALANCING can only be used with MPOL_BIND) in do_set_mempolicy() This patch moves the check in sanitize_mpol_flags() so that it is also used by mbind() [1] BUG: KMSAN: uninit-value in __mpol_equal+0x567/0x590 mm/mempolicy.c:2260 __mpol_equal+0x567/0x590 mm/mempolicy.c:2260 mpol_equal include/linux/mempolicy.h:105 [inline] vma_merge+0x4a1/0x1e60 mm/mmap.c:1190 mbind_range+0xcc8/0x1e80 mm/mempolicy.c:811 do_mbind+0xf42/0x15f0 mm/mempolicy.c:1333 kernel_mbind mm/mempolicy.c:1483 [inline] __do_sys_mbind mm/mempolicy.c:1490 [inline] __se_sys_mbind+0x437/0xb80 mm/mempolicy.c:1486 __x64_sys_mbind+0x19d/0x200 mm/mempolicy.c:1486 do_syscall_x64 arch/x86/entry/common.c:51 [inline] do_syscall_64+0x54/0xd0 arch/x86/entry/common.c:82 entry_SYSCALL_64_after_hwframe+0x44/0xae Uninit was created at: slab_alloc_node mm/slub.c:3221 [inline] slab_alloc mm/slub.c:3230 [inline] kmem_cache_alloc+0x751/0xff0 mm/slub.c:3235 mpol_new mm/mempolicy.c:293 [inline] do_mbind+0x912/0x15f0 mm/mempolicy.c:1289 kernel_mbind mm/mempolicy.c:1483 [inline] __do_sys_mbind mm/mempolicy.c:1490 [inline] __se_sys_mbind+0x437/0xb80 mm/mempolicy.c:1486 __x64_sys_mbind+0x19d/0x200 mm/mempolicy.c:1486 do_syscall_x64 arch/x86/entry/common.c:51 [inline] do_syscall_64+0x54/0xd0 arch/x86/entry/common.c:82 entry_SYSCALL_64_after_hwframe+0x44/0xae ===================================================== Kernel panic - not syncing: panic_on_kmsan set ... CPU: 0 PID: 15049 Comm: syz-executor.0 Tainted: G B 5.15.0-rc2-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x1ff/0x28e lib/dump_stack.c:106 dump_stack+0x25/0x28 lib/dump_stack.c:113 panic+0x44f/0xdeb kernel/panic.c:232 kmsan_report+0x2ee/0x300 mm/kmsan/report.c:186 __msan_warning+0xd7/0x150 mm/kmsan/instrumentation.c:208 __mpol_equal+0x567/0x590 mm/mempolicy.c:2260 mpol_equal include/linux/mempolicy.h:105 [inline] vma_merge+0x4a1/0x1e60 mm/mmap.c:1190 mbind_range+0xcc8/0x1e80 mm/mempolicy.c:811 do_mbind+0xf42/0x15f0 mm/mempolicy.c:1333 kernel_mbind mm/mempolicy.c:1483 [inline] __do_sys_mbind mm/mempolicy.c:1490 [inline] __se_sys_mbind+0x437/0xb80 mm/mempolicy.c:1486 __x64_sys_mbind+0x19d/0x200 mm/mempolicy.c:1486 do_syscall_x64 arch/x86/entry/common.c:51 [inline] do_syscall_64+0x54/0xd0 arch/x86/entry/common.c:82 entry_SYSCALL_64_after_hwframe+0x44/0xae RIP: 0033:0x7f4a41b2c709 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f4a3f0a3188 EFLAGS: 00000246 ORIG_RAX: 00000000000000ed RAX: ffffffffffffffda RBX: 00007f4a41c30f60 RCX: 00007f4a41b2c709 RDX: 0000000000002001 RSI: 0000000000c00007 RDI: 0000000020012000 RBP: 00007f4a41b86cb4 R08: 0000000000000000 R09: 0000010000000002 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007f4a42164b2f R14: 00007f4a3f0a3300 R15: 0000000000022000 Fixes: bda420b98505 ("numa balancing: migrate on fault among multiple bound nodes") Signed-off-by: Eric Dumazet Reported-by: syzbot Cc: "Huang, Ying" Cc: Mel Gorman --- v2: fix compiler warning reported by kernel test robot mm/mempolicy.c | 16 +++++----------- 1 file changed, 5 insertions(+), 11 deletions(-) diff --git a/mm/mempolicy.c b/mm/mempolicy.c index 1592b081c58ef6dd63c6f075ad24722f2be7cb5d..d12e0608fced235dc9137d0628437046299c7cfc 100644 --- a/mm/mempolicy.c +++ b/mm/mempolicy.c @@ -856,16 +856,6 @@ static long do_set_mempolicy(unsigned short mode, unsigned short flags, goto out; } - if (flags & MPOL_F_NUMA_BALANCING) { - if (new && new->mode == MPOL_BIND) { - new->flags |= (MPOL_F_MOF | MPOL_F_MORON); - } else { - ret = -EINVAL; - mpol_put(new); - goto out; - } - } - ret = mpol_set_nodemask(new, nodes, scratch); if (ret) { mpol_put(new); @@ -1458,7 +1448,11 @@ static inline int sanitize_mpol_flags(int *mode, unsigned short *flags) return -EINVAL; if ((*flags & MPOL_F_STATIC_NODES) && (*flags & MPOL_F_RELATIVE_NODES)) return -EINVAL; - + if (*flags & MPOL_F_NUMA_BALANCING) { + if (*mode != MPOL_BIND) + return -EINVAL; + *flags |= (MPOL_F_MOF | MPOL_F_MORON); + } return 0; }