Received: by 2002:ac0:aed5:0:0:0:0:0 with SMTP id t21csp2267778imb; Mon, 4 Mar 2019 00:13:04 -0800 (PST) X-Google-Smtp-Source: APXvYqxVrUet3lO6lRJGu8de7cnrFiC70uDhjVbULGY6KDZJ8nfdJdseFJGTI35RB5ZCDMAkKOKe X-Received: by 2002:a63:f658:: with SMTP id u24mr17481980pgj.399.1551687184295; Mon, 04 Mar 2019 00:13:04 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1551687184; cv=none; d=google.com; s=arc-20160816; b=GqLmejcwTeV6cKvlMD6V734PsA9Ht7V0Q65XgB3fHNUSYUp+K1Gm7lxvy/WGzxtCxj DQ0ikUiAKMSsMHUASHiP1yVUdZ3zVEKfGCXzmoGd03xEniiGJFxQk64UavwQL82vB1ag 0d+/q8ODolO6wWjbyonaEmed+HJTRRpTlCABPCTYqSHbeUMPtkpa6QF71dTiyoZCZIPE kFXBzqriDJlPUSbpJ19Gxat5NSD5OCnVqGbYEbbIeZvBTrbfGCnZZuiaWI9aphlhx7p0 UliehSjRE9RhtL3Kt9TMlpQbU4IjaSszsq/HZuivRHBOjtj8U1drXaaXgg7Wvxc9a7bH nd9Q== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:user-agent:in-reply-to :content-disposition:mime-version:references:message-id:subject:cc :to:from:date:dkim-signature; bh=KfOFdOucD1U97CCxvS8TuzZdQ4PD/e84qcQFlpBStSQ=; b=mNYy3M/srL/TmWeyj5Qo0mZ+xJrtoHODLh/cd4F7iSVF5N4puXl6gW3ltm0Cr5d0ST fuQNBfT/PKCY3s60uoFOJxvfJouyeVpWrpHUo2XxBMY803dunoWn7yib9jLNUBi+XbCS dYb8s3sW39lxVnaEj3SnW7LfiPBm1Ys6HFgwDPO+T+rvoHSegX8o2U3EVVEQs4tQENy6 z88WFJed/m+mfWnIGSbzfnyHfaa4ox9ftEBGACJBoitzi1LuvxpdkyWerIFoTWBIqIJ0 4xKn5sXccjC2w3TMm/d6BFrKSuWMcgFYhG72YH2qzvTnlUxngmal645bjDOSu7ywp+Lv MKjg== ARC-Authentication-Results: i=1; mx.google.com; dkim=fail header.i=@gmail.com header.s=20161025 header.b="uDFuyLc/"; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=kernel.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id 3si5069663plz.116.2019.03.04.00.12.48; Mon, 04 Mar 2019 00:13:04 -0800 (PST) Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; dkim=fail header.i=@gmail.com header.s=20161025 header.b="uDFuyLc/"; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1726101AbfCDIK5 (ORCPT + 99 others); Mon, 4 Mar 2019 03:10:57 -0500 Received: from mail-pg1-f193.google.com ([209.85.215.193]:44340 "EHLO mail-pg1-f193.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1725997AbfCDIK5 (ORCPT ); Mon, 4 Mar 2019 03:10:57 -0500 Received: by mail-pg1-f193.google.com with SMTP id j3so2514229pgm.11 for ; Mon, 04 Mar 2019 00:10:56 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=sender:date:from:to:cc:subject:message-id:references:mime-version :content-disposition:in-reply-to:user-agent; bh=KfOFdOucD1U97CCxvS8TuzZdQ4PD/e84qcQFlpBStSQ=; b=uDFuyLc/jJuEQsJtJDTI7zemEl9I/eG6UYZalJfhLuSQ5DshGdoeq466b6LWoJMECx BYqdpzIYsFfwOfrRH8eH+y+124e30VvYzxDQojReh73i6lUmzo2w8UQcQV8nWAsJ4uWL bHyi1BsMT/ifzLDiQLNRDGzhW6L6kdSuibU0nf7nseiccjUgouqmLvMnFFp9p5+5EKlG fp/p9MP5o7xr2VSGqOOb/7kM3sUTcMpm3nYXMNaEzA8OIaizqefA6jPR2XKz74pm1Xk0 GLiPR9wj9HHWzOdQa6cNOcMJeRS8xU+3uzr49h8OHLw9TXkfxmctm25HPeKNbMyBNbsC FhFA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:sender:date:from:to:cc:subject:message-id :references:mime-version:content-disposition:in-reply-to:user-agent; bh=KfOFdOucD1U97CCxvS8TuzZdQ4PD/e84qcQFlpBStSQ=; b=Wr1LytE7pnuKs62UADrmBgqWpokTLjrhNvcyjHq3m8GKOw3bcw0+Kd9+STLY9CAavH 5fXiE3HyC+vYQ4fmo+4X3rw+QjdilShOhkkO629OlZ+inl9Nz5QZrDvEqzE+q7A7QXoY 77OR2MbF2RK7B6T4h6g/QJA+j8EpBvF6qkMnfQy7W4wyYSV1ND8UQmDRQ8I+PEGODPnK 6FE/2m4iYpOEbUsgN9W7iNES9TrvLk48L5hpqAUFv7Py/sjShqUABt9C/N4PNRxOPJrB awJIAWkZMub0OqQY+O/fRwf/Yg6+O+AecqdQY/pFLmvGckiYSW15TSt7p5ZpDUHWovLW AvqQ== X-Gm-Message-State: APjAAAWaTqh/Ga8TmNtfXXxS5aMrZLu8BXFyUkD2fXad6R4AwyMuPtAQ WBsFYyOZcIz0/uqCXn8HREbieFn/ X-Received: by 2002:a65:624a:: with SMTP id q10mr17706122pgv.377.1551687056257; Mon, 04 Mar 2019 00:10:56 -0800 (PST) Received: from google.com ([2401:fa00:d:0:98f1:8b3d:1f37:3e8]) by smtp.gmail.com with ESMTPSA id d86sm12105717pfm.18.2019.03.04.00.10.51 (version=TLS1_2 cipher=ECDHE-RSA-CHACHA20-POLY1305 bits=256/256); Mon, 04 Mar 2019 00:10:55 -0800 (PST) Date: Mon, 4 Mar 2019 17:10:48 +0900 From: Minchan Kim To: Jan Stancek Cc: linux-mm@kvack.org, akpm@linux-foundation.org, willy@infradead.org, peterz@infradead.org, riel@surriel.com, mhocko@suse.com, ying.huang@intel.com, jrdr.linux@gmail.com, jglisse@redhat.com, aneesh.kumar@linux.ibm.com, david@redhat.com, aarcange@redhat.com, raquini@redhat.com, rientjes@google.com, kirill@shutemov.name, mgorman@techsingularity.net, linux-kernel@vger.kernel.org Subject: Re: [PATCH v3] mm/memory.c: do_fault: avoid usage of stale vm_area_struct Message-ID: <20190304081048.GA98096@google.com> References: <20190302185144.GD31083@redhat.com> <5b3fdf19e2a5be460a384b936f5b56e13733f1b8.1551595137.git.jstancek@redhat.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <5b3fdf19e2a5be460a384b936f5b56e13733f1b8.1551595137.git.jstancek@redhat.com> User-Agent: Mutt/1.10.1+60 (6df12dc1) (2018-08-07) Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Sun, Mar 03, 2019 at 08:28:04AM +0100, Jan Stancek wrote: > LTP testcase mtest06 [1] can trigger a crash on s390x running 5.0.0-rc8. > This is a stress test, where one thread mmaps/writes/munmaps memory area > and other thread is trying to read from it: > > CPU: 0 PID: 2611 Comm: mmap1 Not tainted 5.0.0-rc8+ #51 > Hardware name: IBM 2964 N63 400 (z/VM 6.4.0) > Krnl PSW : 0404e00180000000 00000000001ac8d8 (__lock_acquire+0x7/0x7a8) > Call Trace: > ([<0000000000000000>] (null)) > [<00000000001adae4>] lock_acquire+0xec/0x258 > [<000000000080d1ac>] _raw_spin_lock_bh+0x5c/0x98 > [<000000000012a780>] page_table_free+0x48/0x1a8 > [<00000000002f6e54>] do_fault+0xdc/0x670 > [<00000000002fadae>] __handle_mm_fault+0x416/0x5f0 > [<00000000002fb138>] handle_mm_fault+0x1b0/0x320 > [<00000000001248cc>] do_dat_exception+0x19c/0x2c8 > [<000000000080e5ee>] pgm_check_handler+0x19e/0x200 > > page_table_free() is called with NULL mm parameter, but because > "0" is a valid address on s390 (see S390_lowcore), it keeps > going until it eventually crashes in lockdep's lock_acquire. > This crash is reproducible at least since 4.14. > > Problem is that "vmf->vma" used in do_fault() can become stale. > Because mmap_sem may be released, other threads can come in, > call munmap() and cause "vma" be returned to kmem cache, and > get zeroed/re-initialized and re-used: > > handle_mm_fault | > __handle_mm_fault | > do_fault | > vma = vmf->vma | > do_read_fault | > __do_fault | > vma->vm_ops->fault(vmf); | > mmap_sem is released | > | > | do_munmap() > | remove_vma_list() > | remove_vma() > | vm_area_free() > | # vma is released > | ... > | # same vma is allocated > | # from kmem cache > | do_mmap() > | vm_area_alloc() > | memset(vma, 0, ...) > | > pte_free(vma->vm_mm, ...); | > page_table_free | > spin_lock_bh(&mm->context.lock);| > | > > Cache mm_struct to avoid using potentially stale "vma". > > [1] https://github.com/linux-test-project/ltp/blob/master/testcases/kernel/mem/mtest06/mmap1.c > > Signed-off-by: Jan Stancek > Reviewed-by: Andrea Arcangeli Reviewed-by: Minchan Kim Isn't it -stable material?