From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1754350AbcITNT7 (ORCPT ); Tue, 20 Sep 2016 09:19:59 -0400 Received: from mail-db5eur01on0096.outbound.protection.outlook.com ([104.47.2.96]:42706 "EHLO EUR01-DB5-obe.outbound.protection.outlook.com" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S1754139AbcITNT5 (ORCPT ); Tue, 20 Sep 2016 09:19:57 -0400 Authentication-Results: spf=none (sender IP is ) smtp.mailfrom=aryabinin@virtuozzo.com; Subject: Re: + stackdepot-fix-mempolicy-use-after-free.patch added to -mm tree To: Andrew Morton , David Rientjes References: <57b762c9.W4lqscwtxU8GMid9%akpm@linux-foundation.org> <20160919115519.1c12bb3c0215260e20f9b1cb@linux-foundation.org> CC: , , , From: Andrey Ryabinin Message-ID: <57522051-0376-b746-3969-bd43daff51bf@virtuozzo.com> Date: Tue, 20 Sep 2016 16:04:21 +0300 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Thunderbird/45.3.0 MIME-Version: 1.0 In-Reply-To: <20160919115519.1c12bb3c0215260e20f9b1cb@linux-foundation.org> Content-Type: text/plain; charset="windows-1252" Content-Transfer-Encoding: 7bit X-Originating-IP: [195.214.232.10] X-ClientProxiedBy: AM3PR08CA0018.eurprd08.prod.outlook.com (10.160.207.156) To DB6PR0802MB2550.eurprd08.prod.outlook.com (10.172.251.148) X-MS-Office365-Filtering-Correlation-Id: eb78065d-9a20-4924-0894-08d3e156a59e X-Microsoft-Exchange-Diagnostics: 1;DB6PR0802MB2550;2:UuFn6v3XEZmuQKs2ZjsVD6Wp7NjApDKmF/4wQ31jiduszlwkK2xU1qONW/mVPg2c/m+p+ZeVmWJLkEwqcpzqC3Hw2bRc3DMQPJuko7r0H6FAxIS7dQk6Qm9+O2RX2rREvvGAlCi9uYx4CmQKIASzY4bLWtbowhXY/jzpGqZ9aOkfpb2oqj5FwtKb2+2rdPx4;3:DarZGh+SWjeEQeoq5oJSUFvTlrPjQ7h/snVG8XBw3iEYhGOT9FTwyIEWaFlQloYGoSBS/s1ZPnOHJEtLUrpRpOTplq0bE9/rBu6VyXmOvlmlWkTmmi+Uz0AOaFMXfBSO;25:PzYhk7ac73p1Lx+s90Rioncq1rxOosrbvWeT8uhitlcNtCv5ETabmjbxR0UHRSirI1HLYb6TRYpfrav45OX1kg2bQcyTc1mSP/37IiD6HG2sUkHL44hUQywUFzmd0Mbg6v6ZsyM8mKGxP6T/98JtQs/cbVvzrZImqYsFPpv2XvbsQSLeeYy3lfoVlXWGpZwxBN6UIku/fAKxXez530t+A+UbRTEGnVisQmNVoPzfCNlrY3psuDSzTYgTHxwImb9aSVJl+sJ6kgu3NF0kleJc+jR/HEVxCuMVWCb7r5LTSGZMSa857FgZnI2KRvMM6LB6rUxyMLjb5ry33ZC0BNUutlReF6FGY6SWidcE7DHp7ShxClIfawtsdVCM7akHkR6QnLOrzRLcmYLHi+AHot7/DYfnOV0bzPtcxnZn/0UXjOg= X-Microsoft-Antispam: UriScan:;BCL:0;PCL:0;RULEID:;SRVR:DB6PR0802MB2550; X-Microsoft-Exchange-Diagnostics: 1;DB6PR0802MB2550;31:/P1UWwe3E0hPSbhQccrvB/9y1Q6jNnUK2msTsgnT26l1sYzkqtXbQcgNSgwJMfxyEqj0cQsr4y1VzekP+UK5bwIa7dUK0ymNC5Uu4nD5x1yhBqOZh+6XFmeAfmxZknec8tR+7KwsSsJJaOSNZWmVYBpOT5qpBbG908r+/NiRYa6bP6UWuxnBmxGQWX+4FvMfwJyoPSBDcyxl+/64n8wYob16eemq/eluuSbVZ1MWVp8=;4:AVxUTDrsEzBFZ1msynEpm3J3C2elWbotmyg9h3mBNWXaG/QUrLZPtdkuJ5t/KeKFDXK3YrEQgrJtPAGt/K6tDytnEmiJchqYLqtLxxvtBo0uQwwOxwnuzc7vBsT+QesCMKtwSDPUqjbV0LM3hkAT+NcFchUKX2ckUtxA7V30vFhryrB1J75r0thkmhRW+dD234GI5VIpQlxo6KQRepVmrdWxiY/AvejF6p6nkWAbB+hxTmBDpaD2Qd63Pk5nqTkyDAmpDyUDOVWtUuDBi8/MKooTpN9JpMlBPY58242TGUQ4dd/r2pKLA8ZwfjP76FJMeS5sBPNXrwmw7WCBIH9OWOt/FeaIMu/LddaZmCruLGjq7V3RN062sLwjWAmH/7If5DdBffH7+inTi/fhqXFEewQHNgaKPnC+mhcZ/FR2Vdt3eCCI0UU1thfAQfv0gPaqhMXAvtOc+1HHUMCNYvOHXA== X-Microsoft-Antispam-PRVS: X-Exchange-Antispam-Report-Test: UriScan:(211936372134217); X-Exchange-Antispam-Report-CFA-Test: BCL:0;PCL:0;RULEID:(6040176)(601004)(2401047)(8121501046)(5005006)(3002001)(10201501046)(6043046)(6042046);SRVR:DB6PR0802MB2550;BCL:0;PCL:0;RULEID:;SRVR:DB6PR0802MB2550; X-Forefront-PRVS: 0071BFA85B X-Forefront-Antispam-Report: SFV:NSPM;SFS:(10019020)(4630300001)(6049001)(6009001)(7916002)(377454003)(24454002)(199003)(189002)(8676002)(81156014)(101416001)(50466002)(36756003)(65956001)(189998001)(81166006)(76176999)(50986999)(68736007)(54356999)(66066001)(3846002)(586003)(65806001)(47776003)(6116002)(106356001)(42186005)(105586002)(23746002)(31686004)(92566002)(4326007)(2906002)(33646002)(230783001)(4001350100001)(5001770100001)(77096005)(19580395003)(2950100001)(97736004)(19580405001)(31696002)(65826007)(230700001)(7846002)(86362001)(305945005)(5660300001)(83506001)(64126003)(7736002);DIR:OUT;SFP:1102;SCL:1;SRVR:DB6PR0802MB2550;H:[10.30.19.223];FPR:;SPF:None;PTR:InfoNoRecords;A:1;MX:1;LANG:en; X-Microsoft-Exchange-Diagnostics: =?Windows-1252?Q?1;DB6PR0802MB2550;23:Bu/MqZ1ymMQG+cQp+ayhG0uvBdki9UNxAYJ?= =?Windows-1252?Q?2gDZwyeF3R8s3DD8gSxvaA1QTDDer2yvuoO7Bml5m3R0QbeCtpDB3Ffy?= =?Windows-1252?Q?bAVcIDevZlwoVp/q8ZyNV/DDqtYatT44CbT7BX/h+RtWf3bWNZ4kuaYV?= =?Windows-1252?Q?q+OwOM1L1vvB18MS4i9GavKe4h7G0uIbabnwW8SIXfoTvevGaVpAlnmy?= =?Windows-1252?Q?YqoJD1RlrkKDjJA25vLdzTi63rLM7GcXFyXiwIkJM9v69L4jY1da+KZb?= =?Windows-1252?Q?ZzoMbPnCjKeNjQWuRvRPzsL/9WJzNZto1/Cbbw85lng0uB0n86QaLDDn?= =?Windows-1252?Q?72gr3iIJFkF2Fm3RJtmNPF9fHhhlvUBA5Ix7uy1tgMpnhoeNcC/2VHzC?= =?Windows-1252?Q?g3kFWKdG1QDYvld1up5GDayYGIL+F4oD2yxR+ZUQyqzw0FC/Pi8fjX8U?= =?Windows-1252?Q?XPXjqnHdYit26GLvVAhlLHWiGdkEKALM2/UfQNmT6esxbcT6xfQeakl3?= =?Windows-1252?Q?4/gl5LTTnk2YQ4MNtmWurIqLSOHc4pq6xtKgZD3Tmkg4oYmbCTGjBTtg?= =?Windows-1252?Q?R/HcwbnW3jVGyKpvtiSF/GetEYGRbugKNDLnREmhjRMCFQjJOJv5KxRy?= =?Windows-1252?Q?P8tCTJNHPyQuoaRU3XQzq1nMvr3EgcaK0dhfTXnpiQ78fH1tU6hiQtbj?= =?Windows-1252?Q?ZTCMU5+UW8ekmFG+pIw3k3IdgFjwjzcH0i5LqHV2yM62gzDV4ex8wszU?= =?Windows-1252?Q?HUXsFatbaB+UMjKuAUz8NZz5ZSvVikhYt9H5PPEqRy6kuPRnOCMTECLu?= =?Windows-1252?Q?kLO511SIX/L5tAFHSCjjzuzJm4xzXS8PRDkrAie2g6rOcj9cFV1DjeBb?= =?Windows-1252?Q?qTJYWKOx6F4vFIGGvylUwrYazbM6iQ/ItXzLWBt9QrZbcVqq9xhoXyRb?= =?Windows-1252?Q?t0+Dj/Pz5NhxiqklPfaJb5lrQa13kWyk3Jkk/7DIZ1xHbM1WkWeBP3lr?= =?Windows-1252?Q?o5aHV4bY6WBi8cPyN3miKXn14v/AbZk0MGyN7K/VYk1qLuX9CKYxdXBR?= =?Windows-1252?Q?mVexYToJVGJBfMNwjVv7eBWet7yt43xh/MxhsoDTJTR4ebFn2KHI5dZe?= =?Windows-1252?Q?8/1IoM5rimE0NeleSD9vjae851/xfUaZ74i8zOJ3WUbZuZmMY+PF11dI?= =?Windows-1252?Q?zJhDiCb9eA3bFA3dnRSvrn1itA4GpIBRDseJPOuBkAHOkHp3tDnpSKAL?= =?Windows-1252?Q?OUXrxR73aT6rDAf3X0SoiwsrTzJz84jiWmn7pHSSWmlTTLXwHT0BYHJq?= =?Windows-1252?Q?uZEtLztysiGkKIM2mVliMWt0qFHQM826vK1GNUfSXEDd446etTcW3sBG?= =?Windows-1252?Q?8KDcHoVmeP+1kQjYozPgVVUdvbWsjHW9EqFsKMyGkVxvoHonBDkR3vRU?= =?Windows-1252?Q?8EhZny/dkC03pZ3Ew8l8M?= X-Microsoft-Exchange-Diagnostics: 1;DB6PR0802MB2550;6:lc/pb0zx6Bnbtdhkw9idXT8aHSG2Av7lgk40YGjj570Xxl8KQSMOYMjFdVGAx0G/jfs0hnTMTkbHGap0KrqSy4J3K5agw1DD0JRQF6Eg01C3sTJu4uIMod55wYYk0Xdi51oH73K5AjPXgEFM34NgeAcM0RVjYAEuJB4VTsiKs1/QbmON3bwWHcwekpckbTcvbZBtSVYk4tgaLMVox0fzaWOYgTBb/pobpQhHarCTVtdtE0ra6OOako/MwZ0fScrTJBKrzsVKoL1j5m1HRIebeiLAWO0h0qPc5g7p0QdN3XtCycFVQ+FaXGeyaL1ggVyp;5:l42CYQBIrEr2CIqOe3tKBJxw97IMvHPlL//Ww6rRRbnQPIeA8yVS5yN3OFzyW+AlKMnPssMi0K/+ztLKW4Gnr4YtQ4MB/BeuXzJ7UBPR+9SMgoUF+qHy+jy09tzsSt0DbsopeihgGr845S4pLkCYhw==;24:rbcYzndY7xlNjpRLDwJBDXoDri/tI2b/aQnHB3OLJ1kNmW3hea+dlJ3EvxXJH36wNaS2GOaiyrYlRFFaOqHExcV0oVfEyFG+tidKsYbXLJQ=;7:LK1OQnHvHcpeyafWU+tyHx9bEbJEFz7kLPgpMjrbN1mgE2GlBYoxaCEmBe+e+F0BJ8yDrK1yF85xoCN0XgcuPw+EoqG1pmChbfNabACPrxJY3B+hI2fRFZUv8ZNfOPNOxUikQDAcjLpJXZ+T5QOQBbWU9be/D+VFXLdSpaXkMOvLqaVSwrBvLUqgpECD7V1P4/9vslFJvwpWbukDivB3X8R0quNnBp93ZV5NiKZi876SV3G40HnEwMqzbwNQ4HyK3+h823uB41SJaEyir1dRy3e4+pDXlq6TQiFs/UCojUZs/frJB5GZmAZKRsB+KIJj SpamDiagnosticOutput: 1:99 SpamDiagnosticMetadata: NSPM X-Microsoft-Exchange-Diagnostics: 1;DB6PR0802MB2550;20:lYTmcnSqeVaQ4ygO4aEcvuSNBC+tqacI7Q3dNayg0BJK8D1pMJHyMBEIRXeCpBDvQ/ymZgHYi1AGYQFzqaHZocMdGLiAOhufEh+Ju/EiY9a27KGOoN3z5uEiM/q1ZlIR5Bb2jDsIpjJyTeuRYM6eA8vGVgd/dhkp3bKjnZhd8g8= X-OriginatorOrg: virtuozzo.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 20 Sep 2016 13:04:24.5931 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-Transport-CrossTenantHeadersStamped: DB6PR0802MB2550 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On 09/19/2016 09:55 PM, Andrew Morton wrote: > On Wed, 24 Aug 2016 18:08:08 -0700 (PDT) David Rientjes wrote: > >>> diff -puN lib/stackdepot.c~stackdepot-fix-mempolicy-use-after-free lib/stackdepot.c >>> --- a/lib/stackdepot.c~stackdepot-fix-mempolicy-use-after-free >>> +++ a/lib/stackdepot.c >>> @@ -243,6 +243,12 @@ depot_stack_handle_t depot_save_stack(st >>> alloc_flags &= ~GFP_ZONEMASK; >>> alloc_flags &= (GFP_ATOMIC | GFP_KERNEL); >>> alloc_flags |= __GFP_NOWARN; >>> + /* >>> + * Avoid using current->mempolicy which may already have >>> + * been freed -- we may be in the process of saving the >>> + * stack for exactly that __mpol_put() call. >>> + */ >>> + alloc_flags |= __GFP_THISNODE; >>> page = alloc_pages(alloc_flags, STACK_ALLOC_ORDER); >>> if (page) >>> prealloc = page_address(page); >> >> This is wrong, it unnecessarily restricts the allocation to a local node >> and has a greater chance to fail. Passing __GFP_THISNODE here is only an >> implementation detail of mempolicies to avoid reference to freed policy. >> It is easy to fix by using alloc_pages_node(NUMA_NO_NODE, alloc_flags, >> STACK_ALLOC_ORDER) instead of alloc_pages() directly. > > Any volunteers to test and send the patch? > This already fixed in c11600e4fed67ae4cd6 ("mm, mempolicy: task->mempolicy must be NULL before dropping final reference")