From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751888AbdK0LrA (ORCPT ); Mon, 27 Nov 2017 06:47:00 -0500 Received: from szxga04-in.huawei.com ([45.249.212.190]:2179 "EHLO huawei.com" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S1751601AbdK0Lq7 (ORCPT ); Mon, 27 Nov 2017 06:46:59 -0500 From: guoxuenan To: , , , , CC: , , , , , , , , , Subject: [PATCH] mm,madvise: bugfix of madvise systemcall infinite loop under special circumstances. Date: Mon, 27 Nov 2017 19:53:18 +0800 Message-ID: <20171127115318.911-1-guoxuenan@huawei.com> X-Mailer: git-send-email 2.9.5 MIME-Version: 1.0 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: 8bit X-Originating-IP: [10.175.124.28] X-CFilter-Loop: Reflected Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: chenjie The madvise() system call supported a set of "conventional" advice values, the MADV_WILLNEED parameter has possibility of triggering an infinite loop under direct access mode(DAX). Infinite loop situation: 1、initial state [ start = vam->vm_start < vam->vm_end < end ]. 2、madvise_vma() using MADV_WILLNEED parameter; madvise_vma() -> madvise_willneed() -> return 0 && the value of [prev] is not updated. In function SYSCALL_DEFINE3(madvise,...) When [start = vam->vm_start] the program enters "for" loop, find_vma_prev() will set the pointer vma and the pointer prev(prev = vam->vm_prev). Normally ,madvise_vma() will always move the pointer prev ,but when use DAX mode, it will never update the value of [prev]. ======================================================================= SYSCALL_DEFINE3(madvise,...) { [...] //start = vam->start => prev=vma->prev vma = find_vma_prev(current->mm, start, &prev); [...] for(;;) { update [start = vma->vm_start] con0: if (start >= end) //false always; goto out; tmp = vma->vm_end; //do not update [prev] and always return 0; error = madvise_willneed(); con1: if (error) //false always; goto out; //[ vam->vm_start < start = vam->vm_end = end) //false always ; goto out; //because of pointer [prev] did not change,[vma] keep as it was; update [ vma = prev->vm_next ] } [...] } ======================================================================= After the first cycle ;it will always keep vam->vm_start < start = vam->vm_end < end && vma = prev->vm_next; since Circulation exit conditions (con{0,1,2}) will never meet ,the program stuck in infinite loop. Signed-off-by: chenjie Signed-off-by: guoxuenan --- mm/madvise.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/mm/madvise.c b/mm/madvise.c index 375cf32..751e97a 100644 --- a/mm/madvise.c +++ b/mm/madvise.c @@ -276,15 +276,14 @@ static long madvise_willneed(struct vm_area_struct *vma, { struct file *file = vma->vm_file; + *prev = vma; #ifdef CONFIG_SWAP if (!file) { - *prev = vma; force_swapin_readahead(vma, start, end); return 0; } if (shmem_mapping(file->f_mapping)) { - *prev = vma; force_shm_swapin_readahead(vma, start, end, file->f_mapping); return 0; @@ -299,7 +298,6 @@ static long madvise_willneed(struct vm_area_struct *vma, return 0; } - *prev = vma; start = ((start - vma->vm_start) >> PAGE_SHIFT) + vma->vm_pgoff; if (end > vma->vm_end) end = vma->vm_end; -- 2.9.5