Skip to content

GitLab

An error occurred while fetching folder content.
Switch branch/tag
History Find file
Clone
khugepaged: fix null-pointer dereference due to race
Kirill A. Shutemov authored 
commit 594cced1 upstream.

khugepaged has to drop mmap lock several times while collapsing a page.
The situation can change while the lock is dropped and we need to
re-validate that the VMA is still in place and the PMD is still subject
for collapse.

But we miss one corner case: while collapsing an anonymous pages the VMA
could be replaced with file VMA.  If the file VMA doesn't have any
private pages we get NULL pointer dereference:

	general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] PREEMPT SMP KASAN
	KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]
	anon_vma_lock_write include/linux/rmap.h:120 [inline]
	collapse_huge_page mm/khugepaged.c:1110 [inline]
	khugepaged_scan_pmd mm/khugepaged.c:1349 [inline]
	khugepaged_scan_mm_slot mm/khugepaged.c:2110 [inline]
	khugepaged_do_scan mm/khugepaged.c:2193 [inline]
	khugepaged+0x3bba/0x5a10 mm/khugepaged.c:2238

The fix is to make sure that the VMA is anonymous in
hugepage_vma_revalidate().  The helper is only used for collapsing
anonymous pages.

Fixes: 99cb0dbd

 ("mm,thp: add read-only THP support for (non-shmem) FS")
Reported-by: syzbot+ed318e8b790ca72c5ad0@syzkaller.appspotmail.com
Signed-off-by: default avatarKirill A. Shutemov <kirill.shutemov@linux.intel.com>
Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
Reviewed-by: default avatarDavid Hildenbrand <david@redhat.com>
Acked-by: default avatarYang Shi <yang.shi@linux.alibaba.com>
Cc: <stable@vger.kernel.org>
Link: http://lkml.kernel.org/r/20200722121439.44328-1-kirill.shutemov@linux.intel.com

Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
0e3e2be4
Name Last commit Last update
..
kasan kasan: disable branch tracing for core runtime
Kconfig Merge tag 'libnvdimm-for-5.7' of git://git.kernel.org/pub/scm/linux/kernel/git/nvdimm/nvdimm
Kconfig.debug mm: add generic ptdump
Makefile mm: introduce Reported pages
backing-dev.c bdi: add a ->dev_name field to struct backing_dev_info
balloon_compaction.c mm/balloon_compaction: suppress allocation warnings
cleancache.c Merge tag 'driver-core-5.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/driver-core
cma.c mm/cma.c: use exact_nid true to fix possible per-numa cma leak
cma.h License cleanup: add SPDX GPL-2.0 license identifier to files with no license
cma_debug.c mm/cma_debug.c: use DEFINE_DEBUGFS_ATTRIBUTE to define debugfs fops
compaction.c mm, compaction: make capture control handling safe wrt interrupts
debug.c mm, dump_page(): do not crash with invalid mapping pointer
debug_page_ref.c License cleanup: add SPDX GPL-2.0 license identifier to files with no license
dmapool.c mm/dmapool.c: micro-optimisation remove unnecessary branch
early_ioremap.c mm/early_ioremap.c: use %pa to print resource_size_t variables
fadvise.c fs: Export generic_fadvise()
failslab.c mm/failslab.c: by default, do not fail allocations with direct reclaim only
filemap.c mm: huge tmpfs: try to split_huge_page() when punching hole
frame_vector.c mm: untag user pointers in get_vaddr_frames
frontswap.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 482
gup.c gup: document and work around "COW can break either way" issue
gup_benchmark.c mm/gup_benchmark: support pin_user_pages() and related calls
highmem.c mm, x86/mm: Untangle address space layout definitions from basic pgtable type definitions
hmm.c mm/hmm: return error for non-vma snapshots
huge_memory.c mm: thp: make the THP mapcount atomic against __split_huge_pmd_locked()
hugetlb.c
hugetlb_cgroup.c
hwpoison-inject.c
init-mm.c
internal.h
interval_tree.c
khugepaged.c
kmemleak-test.c
kmemleak.c
ksm.c
list_lru.c
maccess.c
madvise.c
mapping_dirty_helpers.c
memblock.c
memcontrol.c
memfd.c
memory-failure.c
memory.c
memory_hotplug.c
mempolicy.c
mempool.c
memremap.c
memtest.c
migrate.c
mincore.c
mlock.c
mm_init.c
mmap.c
mmu_context.c
mmu_gather.c
mmu_notifier.c
mmzone.c
mprotect.c
mremap.c
msync.c
nommu.c
oom_kill.c
page-writeback.c
page_alloc.c
page_counter.c
page_ext.c
page_idle.c
page_io.c
page_isolation.c
page_owner.c
page_poison.c
page_reporting.c
page_reporting.h
page_vma_mapped.c
pagewalk.c
percpu-internal.h
percpu-km.c
percpu-stats.c
percpu-vm.c
percpu.c
pgtable-generic.c
process_vm_access.c
ptdump.c
readahead.c
rmap.c
rodata_test.c
shmem.c
shuffle.c
shuffle.h
slab.c
slab.h
slab_common.c
slob.c
slub.c
sparse-vmemmap.c
sparse.c
swap.c
swap_cgroup.c
swap_slots.c