mpol_set_nodemask()(mm/mempolicy.c) does not set up nodemask when
pol->mode is MPOL_LOCAL. Check pol->mode before access
pol->w.cpuset_mems_allowed in mpol_rebind_policy()(mm/mempolicy.c).
BUG: KMSAN: uninit-value in mpol_rebind_policy mm/mempolicy.c:352 [inline]
BUG: KMSAN: uninit-value in mpol_rebind_task+0x2ac/0x2c0 mm/mempolicy.c:368
mpol_rebind_policy mm/mempolicy.c:352 [inline]
mpol_rebind_task+0x2ac/0x2c0 mm/mempolicy.c:368
cpuset_change_task_nodemask kernel/cgroup/cpuset.c:1711 [inline]
cpuset_attach+0x787/0x15e0 kernel/cgroup/cpuset.c:2278
cgroup_migrate_execute+0x1023/0x1d20 kernel/cgroup/cgroup.c:2515
cgroup_migrate kernel/cgroup/cgroup.c:2771 [inline]
cgroup_attach_task+0x540/0x8b0 kernel/cgroup/cgroup.c:2804
__cgroup1_procs_write+0x5cc/0x7a0 kernel/cgroup/cgroup-v1.c:520
cgroup1_tasks_write+0x94/0xb0 kernel/cgroup/cgroup-v1.c:539
cgroup_file_write+0x4c2/0x9e0 kernel/cgroup/cgroup.c:3852
kernfs_fop_write_iter+0x66a/0x9f0 fs/kernfs/file.c:296
call_write_iter include/linux/fs.h:2162 [inline]
new_sync_write fs/read_write.c:503 [inline]
vfs_write+0x1318/0x2030 fs/read_write.c:590
ksys_write+0x28b/0x510 fs/read_write.c:643
__do_sys_write fs/read_write.c:655 [inline]
__se_sys_write fs/read_write.c:652 [inline]
__x64_sys_write+0xdb/0x120 fs/read_write.c:652
do_syscall_x64 arch/x86/entry/common.c:51 [inline]
do_syscall_64+0x54/0xd0 arch/x86/entry/common.c:82
entry_SYSCALL_64_after_hwframe+0x44/0xae
Uninit was created at:
slab_post_alloc_hook mm/slab.h:524 [inline]
slab_alloc_node mm/slub.c:3251 [inline]
slab_alloc mm/slub.c:3259 [inline]
kmem_cache_alloc+0x902/0x11c0 mm/slub.c:3264
mpol_new mm/mempolicy.c:293 [inline]
do_set_mempolicy+0x421/0xb70 mm/mempolicy.c:853
kernel_set_mempolicy mm/mempolicy.c:1504 [inline]
__do_sys_set_mempolicy mm/mempolicy.c:1510 [inline]
__se_sys_set_mempolicy+0x44c/0xb60 mm/mempolicy.c:1507
__x64_sys_set_mempolicy+0xd8/0x110 mm/mempolicy.c:1507
do_syscall_x64 arch/x86/entry/common.c:51 [inline]
do_syscall_64+0x54/0xd0 arch/x86/entry/common.c:82
entry_SYSCALL_64_after_hwframe+0x44/0xae
KMSAN: uninit-value in mpol_rebind_task (2)
https://syzkaller.appspot.com/bug?id=d6eb90f952c2a5de9ea718a1b873c55cb13b59dc
Reported-and-tested-by: [email protected]
Signed-off-by: Wang Cheng <[email protected]>
---
The uninit-value is pol->w.cpuset_mems_allowed in
mpol_rebind_policy().
While syzkaller reproducer runs, I notice pol->mode is 4(MPOL_LOCAL) in
mpol_set_nodemask()
do_set_mempolicy()(mm/mempolicy.c)
that `nodemask` in `pol` is not initialized, which will be accessed in
mpol_rebind_policy().
mm/mempolicy.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/mm/mempolicy.c b/mm/mempolicy.c
index 10e9c87260ed..18b74f02da71 100644
--- a/mm/mempolicy.c
+++ b/mm/mempolicy.c
@@ -347,7 +347,7 @@ static void mpol_rebind_preferred(struct mempolicy *pol,
*/
static void mpol_rebind_policy(struct mempolicy *pol, const nodemask_t *newmask)
{
- if (!pol)
+ if (!pol || pol->mode == MPOL_LOCAL)
return;
if (!mpol_store_user_nodemask(pol) &&
nodes_equal(pol->w.cpuset_mems_allowed, *newmask))
--
2.30.2
On 22/05/12 08:34PM, Wang Cheng wrote:
> mpol_set_nodemask()(mm/mempolicy.c) does not set up nodemask when
> pol->mode is MPOL_LOCAL. Check pol->mode before access
> pol->w.cpuset_mems_allowed in mpol_rebind_policy()(mm/mempolicy.c).
>
> BUG: KMSAN: uninit-value in mpol_rebind_policy mm/mempolicy.c:352 [inline]
> BUG: KMSAN: uninit-value in mpol_rebind_task+0x2ac/0x2c0 mm/mempolicy.c:368
> mpol_rebind_policy mm/mempolicy.c:352 [inline]
> mpol_rebind_task+0x2ac/0x2c0 mm/mempolicy.c:368
> cpuset_change_task_nodemask kernel/cgroup/cpuset.c:1711 [inline]
> cpuset_attach+0x787/0x15e0 kernel/cgroup/cpuset.c:2278
> cgroup_migrate_execute+0x1023/0x1d20 kernel/cgroup/cgroup.c:2515
> cgroup_migrate kernel/cgroup/cgroup.c:2771 [inline]
> cgroup_attach_task+0x540/0x8b0 kernel/cgroup/cgroup.c:2804
> __cgroup1_procs_write+0x5cc/0x7a0 kernel/cgroup/cgroup-v1.c:520
> cgroup1_tasks_write+0x94/0xb0 kernel/cgroup/cgroup-v1.c:539
> cgroup_file_write+0x4c2/0x9e0 kernel/cgroup/cgroup.c:3852
> kernfs_fop_write_iter+0x66a/0x9f0 fs/kernfs/file.c:296
> call_write_iter include/linux/fs.h:2162 [inline]
> new_sync_write fs/read_write.c:503 [inline]
> vfs_write+0x1318/0x2030 fs/read_write.c:590
> ksys_write+0x28b/0x510 fs/read_write.c:643
> __do_sys_write fs/read_write.c:655 [inline]
> __se_sys_write fs/read_write.c:652 [inline]
> __x64_sys_write+0xdb/0x120 fs/read_write.c:652
> do_syscall_x64 arch/x86/entry/common.c:51 [inline]
> do_syscall_64+0x54/0xd0 arch/x86/entry/common.c:82
> entry_SYSCALL_64_after_hwframe+0x44/0xae
>
> Uninit was created at:
> slab_post_alloc_hook mm/slab.h:524 [inline]
> slab_alloc_node mm/slub.c:3251 [inline]
> slab_alloc mm/slub.c:3259 [inline]
> kmem_cache_alloc+0x902/0x11c0 mm/slub.c:3264
> mpol_new mm/mempolicy.c:293 [inline]
> do_set_mempolicy+0x421/0xb70 mm/mempolicy.c:853
> kernel_set_mempolicy mm/mempolicy.c:1504 [inline]
> __do_sys_set_mempolicy mm/mempolicy.c:1510 [inline]
> __se_sys_set_mempolicy+0x44c/0xb60 mm/mempolicy.c:1507
> __x64_sys_set_mempolicy+0xd8/0x110 mm/mempolicy.c:1507
> do_syscall_x64 arch/x86/entry/common.c:51 [inline]
> do_syscall_64+0x54/0xd0 arch/x86/entry/common.c:82
> entry_SYSCALL_64_after_hwframe+0x44/0xae
>
> KMSAN: uninit-value in mpol_rebind_task (2)
> https://syzkaller.appspot.com/bug?id=d6eb90f952c2a5de9ea718a1b873c55cb13b59dc
>
> Reported-and-tested-by: [email protected]
> Signed-off-by: Wang Cheng <[email protected]>
> ---
> The uninit-value is pol->w.cpuset_mems_allowed in
> mpol_rebind_policy().
>
> While syzkaller reproducer runs, I notice pol->mode is 4(MPOL_LOCAL) in
> mpol_set_nodemask()
> do_set_mempolicy()(mm/mempolicy.c)
> that `nodemask` in `pol` is not initialized, which will be accessed in
> mpol_rebind_policy().
>
> mm/mempolicy.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/mm/mempolicy.c b/mm/mempolicy.c
> index 10e9c87260ed..18b74f02da71 100644
> --- a/mm/mempolicy.c
> +++ b/mm/mempolicy.c
> @@ -347,7 +347,7 @@ static void mpol_rebind_preferred(struct mempolicy *pol,
> */
> static void mpol_rebind_policy(struct mempolicy *pol, const nodemask_t *newmask)
> {
> - if (!pol)
> + if (!pol || pol->mode == MPOL_LOCAL)
> return;
> if (!mpol_store_user_nodemask(pol) &&
> nodes_equal(pol->w.cpuset_mems_allowed, *newmask))
> --
> 2.30.2
>
Hi Andrew,
Thank you for fixing the commit message.
This patch seems to fix below bug too.
KMSAN: uninit-value in mpol_rebind_mm (2)
https://syzkaller.appspot.com/bug?id=f2fecd0d7013f54ec4162f60743a2b28df40926b
The uninit-value is pol->w.cpuset_mems_allowed in mpol_rebind_policy().
When syzkaller reproducer runs to the beginning of mpol_new(),
mpol_new() mm/mempolicy.c
do_mbind() mm/mempolicy.c
kernel_mbind() mm/mempolicy.c
`mode` is 1(MPOL_PREFERRED), nodes_empty(*nodes) is `true` and `flags`
is 0. Then
mode = MPOL_LOCAL;
...
policy->mode = mode;
policy->flags = flags;
will be executed. So in mpol_set_nodemask(),
mpol_set_nodemask() mm/mempolicy.c
do_mbind()
kernel_mbind()
pol->mode is 4(MPOL_LOCAL), that `nodemask` in `pol` is not initialized,
which will be accessed in mpol_rebind_policy().
IIUC, "#syz fix: mm/mempolicy: fix uninit-value in mpol_rebind_policy()"
could be sent to [email protected]
to attach the fixing commit to the bug. WDYT?
thanks,
- w
On Mon, 16 May 2022 17:47:26 +0800 Wang Cheng <[email protected]> wrote:
>
> ...
>
> This patch seems to fix below bug too.
> KMSAN: uninit-value in mpol_rebind_mm (2)
> https://syzkaller.appspot.com/bug?id=f2fecd0d7013f54ec4162f60743a2b28df40926b
>
> The uninit-value is pol->w.cpuset_mems_allowed in mpol_rebind_policy().
> When syzkaller reproducer runs to the beginning of mpol_new(),
>
> mpol_new() mm/mempolicy.c
> do_mbind() mm/mempolicy.c
> kernel_mbind() mm/mempolicy.c
>
> `mode` is 1(MPOL_PREFERRED), nodes_empty(*nodes) is `true` and `flags`
> is 0. Then
>
> mode = MPOL_LOCAL;
> ...
> policy->mode = mode;
> policy->flags = flags;
>
> will be executed. So in mpol_set_nodemask(),
>
> mpol_set_nodemask() mm/mempolicy.c
> do_mbind()
> kernel_mbind()
>
> pol->mode is 4(MPOL_LOCAL), that `nodemask` in `pol` is not initialized,
> which will be accessed in mpol_rebind_policy().
Thanks, I added the above to the changelog and I plan to import the
result into mm-stable later this week.
> IIUC, "#syz fix: mm/mempolicy: fix uninit-value in mpol_rebind_policy()"
> could be sent to [email protected]
> to attach the fixing commit to the bug. WDYT?
Could be. The "syz fix" isn't a thing I've paid much attention to.
I'll start doing so ;)
On Wed, 18 May 2022 at 02:08, Andrew Morton <[email protected]> wrote:
>
> On Mon, 16 May 2022 17:47:26 +0800 Wang Cheng <[email protected]> wrote:
>
> >
> > ...
> >
> > This patch seems to fix below bug too.
> > KMSAN: uninit-value in mpol_rebind_mm (2)
> > https://syzkaller.appspot.com/bug?id=f2fecd0d7013f54ec4162f60743a2b28df40926b
> >
> > The uninit-value is pol->w.cpuset_mems_allowed in mpol_rebind_policy().
> > When syzkaller reproducer runs to the beginning of mpol_new(),
> >
> > mpol_new() mm/mempolicy.c
> > do_mbind() mm/mempolicy.c
> > kernel_mbind() mm/mempolicy.c
> >
> > `mode` is 1(MPOL_PREFERRED), nodes_empty(*nodes) is `true` and `flags`
> > is 0. Then
> >
> > mode = MPOL_LOCAL;
> > ...
> > policy->mode = mode;
> > policy->flags = flags;
> >
> > will be executed. So in mpol_set_nodemask(),
> >
> > mpol_set_nodemask() mm/mempolicy.c
> > do_mbind()
> > kernel_mbind()
> >
> > pol->mode is 4(MPOL_LOCAL), that `nodemask` in `pol` is not initialized,
> > which will be accessed in mpol_rebind_policy().
>
> Thanks, I added the above to the changelog and I plan to import the
> result into mm-stable later this week.
>
> > IIUC, "#syz fix: mm/mempolicy: fix uninit-value in mpol_rebind_policy()"
> > could be sent to [email protected]
> > to attach the fixing commit to the bug. WDYT?
>
> Could be. The "syz fix" isn't a thing I've paid much attention to.
> I'll start doing so ;)
Yes, we can send:
#syz fix: mm/mempolicy: fix uninit-value in mpol_rebind_policy()
to [email protected]
and now it should be reflected at:
https://syzkaller.appspot.com/bug?extid=ad1b8c404f0959c4bfcc
and the bug will be closed when the fix is merged everywhere.