Received: by 2002:a25:4158:0:0:0:0:0 with SMTP id o85csp994831yba; Thu, 4 Apr 2019 02:01:04 -0700 (PDT) X-Google-Smtp-Source: APXvYqwpNDkaImpCj+G0WgesC5IDS+h1Ppi+fRfXShK6wWRVl/44p71f1R3yF+IC3To7HtyYCJxX X-Received: by 2002:a17:902:a704:: with SMTP id w4mr4954237plq.51.1554368464682; Thu, 04 Apr 2019 02:01:04 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1554368464; cv=none; d=google.com; s=arc-20160816; b=R5+RLPTBDYIJ7GoPm4C7Sd/GlEcj08HPeAXwRQfSWwlSIr31lWie8WE1BuEZ5ZDDOa XPUKYpgJbeddc+7t+d72eyXe6B/ipDDQ7wvv4gRJLz4JIFDLVJOehgLRGHeQpouN4O5r H6i6SLloEe68lq+Hoj0G8hZuTj5Ox7F41bcP4JVVGNfsscJcEsxp6rTOtTyzmDljBLyA AnZ7irs0BurhJGQSCPXFPfXQmOSWp9atpYBI/xnci3mPakk55QRQne9TZ0q3PQjnaHM8 SGX+ZLiAk2sdaTV7xyU6exv1281O49dkk5iXivGsMEwJCyIT42+QenvxuLgaLSDUeQV8 Weuw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:content-transfer-encoding:mime-version :user-agent:references:in-reply-to:message-id:date:subject:cc:to :from:dkim-signature; bh=GsG0utAy3rCspYZthaQoDbbrT5WxExfqI2ayTHagPuk=; b=kYERRg/q1JjHN6Oywok7w2sKZGJ+A5afBi8fUrqCcha/62p/JiQbplt1u8bhyQlo9c ctNrPN8HtPGcYuP0ud+Wvp4iE3ffJiOuHX+gj/BAkF3HWmb3YyJbKUnktdJOSNFAaq4z p9c9OuwEJa/v+LHcSVmGLO22Mvtw11EuUpy62CmWiLdPpiQ5izYiruEXXyMGR4mEGp+I 7E4zAZGYMfTxOdGE+sKSFRM2PQFFMZF9NksXG8rZ+zYMxveKG2lgjNj4iCK7l1H4sQPe sRKV22lA/6W3f/8uGK2jiPXlvMIRcI407fs93EQlfG5/3uGi9IzOLaexd33Ko6OHvcb5 K2Dg== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@kernel.org header.s=default header.b=nAZwxCT1; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id k186si12911243pgd.206.2019.04.04.02.00.49; Thu, 04 Apr 2019 02:01:04 -0700 (PDT) Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; dkim=pass header.i=@kernel.org header.s=default header.b=nAZwxCT1; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1729984AbfDDJAP (ORCPT + 99 others); Thu, 4 Apr 2019 05:00:15 -0400 Received: from mail.kernel.org ([198.145.29.99]:36820 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1729400AbfDDJAM (ORCPT ); Thu, 4 Apr 2019 05:00:12 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id C84ED21741; Thu, 4 Apr 2019 09:00:09 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1554368410; bh=gbQBScSEvMaEqy3CR4rDExKVpHHwyJl+0QuSdQXKKCg=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=nAZwxCT1qgpPF9AgjxcOsIwTl+8zqMtcyfRoqKc6oxQ7MBi65EyAeljhwc5uPv/az p6nE1oajTI0QIKevnVQNQ8HDCltOJn/kFV8ZS/2AoyASXllBS/65pSFSwIu21IWkZm CSriO0gc7Yt57URDkV/ncgibcVJk0LlAayFTTuSM= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Vlastimil Babka , syzbot+b19c2dc2c990ea657a71@syzkaller.appspotmail.com, Alexander Potapenko , Dmitry Vyukov , Andrea Arcangeli , "Kirill A. Shutemov" , Michal Hocko , David Rientjes , Yisheng Xie , zhong jiang , Andrew Morton , Linus Torvalds , Sasha Levin Subject: [PATCH 4.19 029/187] mm, mempolicy: fix uninit memory access Date: Thu, 4 Apr 2019 10:46:06 +0200 Message-Id: <20190404084604.447535595@linuxfoundation.org> X-Mailer: git-send-email 2.21.0 In-Reply-To: <20190404084603.119654039@linuxfoundation.org> References: <20190404084603.119654039@linuxfoundation.org> User-Agent: quilt/0.65 X-stable: review X-Patchwork-Hint: ignore MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org 4.19-stable review patch. If anyone has any objections, please let me know. ------------------ [ Upstream commit 2e25644e8da4ed3a27e7b8315aaae74660be72dc ] Syzbot with KMSAN reports (excerpt): ================================================================== BUG: KMSAN: uninit-value in mpol_rebind_policy mm/mempolicy.c:353 [inline] BUG: KMSAN: uninit-value in mpol_rebind_mm+0x249/0x370 mm/mempolicy.c:384 CPU: 1 PID: 17420 Comm: syz-executor4 Not tainted 4.20.0-rc7+ #15 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x173/0x1d0 lib/dump_stack.c:113 kmsan_report+0x12e/0x2a0 mm/kmsan/kmsan.c:613 __msan_warning+0x82/0xf0 mm/kmsan/kmsan_instr.c:295 mpol_rebind_policy mm/mempolicy.c:353 [inline] mpol_rebind_mm+0x249/0x370 mm/mempolicy.c:384 update_tasks_nodemask+0x608/0xca0 kernel/cgroup/cpuset.c:1120 update_nodemasks_hier kernel/cgroup/cpuset.c:1185 [inline] update_nodemask kernel/cgroup/cpuset.c:1253 [inline] cpuset_write_resmask+0x2a98/0x34b0 kernel/cgroup/cpuset.c:1728 ... Uninit was created at: kmsan_save_stack_with_flags mm/kmsan/kmsan.c:204 [inline] kmsan_internal_poison_shadow+0x92/0x150 mm/kmsan/kmsan.c:158 kmsan_kmalloc+0xa6/0x130 mm/kmsan/kmsan_hooks.c:176 kmem_cache_alloc+0x572/0xb90 mm/slub.c:2777 mpol_new mm/mempolicy.c:276 [inline] do_mbind mm/mempolicy.c:1180 [inline] kernel_mbind+0x8a7/0x31a0 mm/mempolicy.c:1347 __do_sys_mbind mm/mempolicy.c:1354 [inline] As it's difficult to report where exactly the uninit value resides in the mempolicy object, we have to guess a bit. mm/mempolicy.c:353 contains this part of mpol_rebind_policy(): if (!mpol_store_user_nodemask(pol) && nodes_equal(pol->w.cpuset_mems_allowed, *newmask)) "mpol_store_user_nodemask(pol)" is testing pol->flags, which I couldn't ever see being uninitialized after leaving mpol_new(). So I'll guess it's actually about accessing pol->w.cpuset_mems_allowed on line 354, but still part of statement starting on line 353. For w.cpuset_mems_allowed to be not initialized, and the nodes_equal() reachable for a mempolicy where mpol_set_nodemask() is called in do_mbind(), it seems the only possibility is a MPOL_PREFERRED policy with empty set of nodes, i.e. MPOL_LOCAL equivalent, with MPOL_F_LOCAL flag. Let's exclude such policies from the nodes_equal() check. Note the uninit access should be benign anyway, as rebinding this kind of policy is always a no-op. Therefore no actual need for stable inclusion. Link: http://lkml.kernel.org/r/a71997c3-e8ae-a787-d5ce-3db05768b27c@suse.cz Link: http://lkml.kernel.org/r/73da3e9c-cc84-509e-17d9-0c434bb9967d@suse.cz Signed-off-by: Vlastimil Babka Reported-by: syzbot+b19c2dc2c990ea657a71@syzkaller.appspotmail.com Cc: Alexander Potapenko Cc: Dmitry Vyukov Cc: Andrea Arcangeli Cc: "Kirill A. Shutemov" Cc: Michal Hocko Cc: David Rientjes Cc: Yisheng Xie Cc: zhong jiang Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Signed-off-by: Sasha Levin --- mm/mempolicy.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/mm/mempolicy.c b/mm/mempolicy.c index f32d0a5be4fb..360b24bc69e5 100644 --- a/mm/mempolicy.c +++ b/mm/mempolicy.c @@ -350,7 +350,7 @@ static void mpol_rebind_policy(struct mempolicy *pol, const nodemask_t *newmask) { if (!pol) return; - if (!mpol_store_user_nodemask(pol) && + if (!mpol_store_user_nodemask(pol) && !(pol->flags & MPOL_F_LOCAL) && nodes_equal(pol->w.cpuset_mems_allowed, *newmask)) return; -- 2.19.1