From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <linux-kernel-owner@vger.kernel.org>
Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand
        id S1752643AbcISSzW (ORCPT <rfc822;w@1wt.eu>);
        Mon, 19 Sep 2016 14:55:22 -0400
Received: from mail.linuxfoundation.org ([140.211.169.12]:49833 "EHLO
        mail.linuxfoundation.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org
        with ESMTP id S1751085AbcISSzU (ORCPT
        <rfc822;linux-kernel@vger.kernel.org>);
        Mon, 19 Sep 2016 14:55:20 -0400
Date: Mon, 19 Sep 2016 11:55:19 -0700
From: Andrew Morton <akpm@linux-foundation.org>
To: David Rientjes <rientjes@google.com>
Cc: linux-kernel@vger.kernel.org, vegard.nossum@oracle.com,
        aryabinin@virtuozzo.com, dvyukov@google.com, glider@google.com
Subject: Re: + stackdepot-fix-mempolicy-use-after-free.patch added to -mm
 tree
Message-Id: <20160919115519.1c12bb3c0215260e20f9b1cb@linux-foundation.org>
In-Reply-To: <alpine.DEB.2.10.1608241805280.144357@chino.kir.corp.google.com>
References: <57b762c9.W4lqscwtxU8GMid9%akpm@linux-foundation.org>
        <alpine.DEB.2.10.1608241805280.144357@chino.kir.corp.google.com>
X-Mailer: Sylpheed 3.4.1 (GTK+ 2.24.23; x86_64-pc-linux-gnu)
Mime-Version: 1.0
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 7bit
Sender: linux-kernel-owner@vger.kernel.org
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

On Wed, 24 Aug 2016 18:08:08 -0700 (PDT) David Rientjes <rientjes@google.com> wrote:

> > diff -puN lib/stackdepot.c~stackdepot-fix-mempolicy-use-after-free lib/stackdepot.c
> > --- a/lib/stackdepot.c~stackdepot-fix-mempolicy-use-after-free
> > +++ a/lib/stackdepot.c
> > @@ -243,6 +243,12 @@ depot_stack_handle_t depot_save_stack(st
> >  		alloc_flags &= ~GFP_ZONEMASK;
> >  		alloc_flags &= (GFP_ATOMIC | GFP_KERNEL);
> >  		alloc_flags |= __GFP_NOWARN;
> > +		/*
> > +		 * Avoid using current->mempolicy which may already have
> > +		 * been freed -- we may be in the process of saving the
> > +		 * stack for exactly that __mpol_put() call.
> > +		 */
> > +		alloc_flags |= __GFP_THISNODE;
> >  		page = alloc_pages(alloc_flags, STACK_ALLOC_ORDER);
> >  		if (page)
> >  			prealloc = page_address(page);
> 
> This is wrong, it unnecessarily restricts the allocation to a local node 
> and has a greater chance to fail.  Passing __GFP_THISNODE here is only an 
> implementation detail of mempolicies to avoid reference to freed policy.  
> It is easy to fix by using alloc_pages_node(NUMA_NO_NODE, alloc_flags, 
> STACK_ALLOC_ORDER) instead of alloc_pages() directly.

Any volunteers to test and send the patch?