From: Greg Kroah-Hartman Date: Thu, 20 Jun 2019 14:32:42 +0000 (+0200) Subject: 4.9-stable patches X-Git-Tag: v5.1.13~10 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=d7ee62e71c2355e631747dfdabf874c4a14a63c1;p=thirdparty%2Fkernel%2Fstable-queue.git 4.9-stable patches added patches: coredump-fix-race-condition-between-collapse_huge_page-and-core-dumping.patch --- diff --git a/queue-4.9/coredump-fix-race-condition-between-collapse_huge_page-and-core-dumping.patch b/queue-4.9/coredump-fix-race-condition-between-collapse_huge_page-and-core-dumping.patch new file mode 100644 index 00000000000..7e82b1e1cf0 --- /dev/null +++ b/queue-4.9/coredump-fix-race-condition-between-collapse_huge_page-and-core-dumping.patch @@ -0,0 +1,83 @@ +From 59ea6d06cfa9247b586a695c21f94afa7183af74 Mon Sep 17 00:00:00 2001 +From: Andrea Arcangeli +Date: Thu, 13 Jun 2019 15:56:11 -0700 +Subject: coredump: fix race condition between collapse_huge_page() and core dumping + +From: Andrea Arcangeli + +commit 59ea6d06cfa9247b586a695c21f94afa7183af74 upstream. + +When fixing the race conditions between the coredump and the mmap_sem +holders outside the context of the process, we focused on +mmget_not_zero()/get_task_mm() callers in 04f5866e41fb70 ("coredump: fix +race condition between mmget_not_zero()/get_task_mm() and core +dumping"), but those aren't the only cases where the mmap_sem can be +taken outside of the context of the process as Michal Hocko noticed +while backporting that commit to older -stable kernels. + +If mmgrab() is called in the context of the process, but then the +mm_count reference is transferred outside the context of the process, +that can also be a problem if the mmap_sem has to be taken for writing +through that mm_count reference. + +khugepaged registration calls mmgrab() in the context of the process, +but the mmap_sem for writing is taken later in the context of the +khugepaged kernel thread. + +collapse_huge_page() after taking the mmap_sem for writing doesn't +modify any vma, so it's not obvious that it could cause a problem to the +coredump, but it happens to modify the pmd in a way that breaks an +invariant that pmd_trans_huge_lock() relies upon. collapse_huge_page() +needs the mmap_sem for writing just to block concurrent page faults that +call pmd_trans_huge_lock(). + +Specifically the invariant that "!pmd_trans_huge()" cannot become a +"pmd_trans_huge()" doesn't hold while collapse_huge_page() runs. + +The coredump will call __get_user_pages() without mmap_sem for reading, +which eventually can invoke a lockless page fault which will need a +functional pmd_trans_huge_lock(). + +So collapse_huge_page() needs to use mmget_still_valid() to check it's +not running concurrently with the coredump... as long as the coredump +can invoke page faults without holding the mmap_sem for reading. + +This has "Fixes: khugepaged" to facilitate backporting, but in my view +it's more a bug in the coredump code that will eventually have to be +rewritten to stop invoking page faults without the mmap_sem for reading. +So the long term plan is still to drop all mmget_still_valid(). + +Link: http://lkml.kernel.org/r/20190607161558.32104-1-aarcange@redhat.com +Fixes: ba76149f47d8 ("thp: khugepaged") +Signed-off-by: Andrea Arcangeli +Reported-by: Michal Hocko +Acked-by: Michal Hocko +Acked-by: Kirill A. Shutemov +Cc: Oleg Nesterov +Cc: Jann Horn +Cc: Hugh Dickins +Cc: Mike Rapoport +Cc: Mike Kravetz +Cc: Peter Xu +Cc: Jason Gunthorpe +Cc: +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + mm/khugepaged.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/mm/khugepaged.c ++++ b/mm/khugepaged.c +@@ -1004,6 +1004,9 @@ static void collapse_huge_page(struct mm + * handled by the anon_vma lock + PG_lock. + */ + down_write(&mm->mmap_sem); ++ result = SCAN_ANY_PROCESS; ++ if (!mmget_still_valid(mm)) ++ goto out; + result = hugepage_vma_revalidate(mm, address, &vma); + if (result) + goto out; diff --git a/queue-4.9/series b/queue-4.9/series index df40140be8d..a5268b59bd0 100644 --- a/queue-4.9/series +++ b/queue-4.9/series @@ -114,3 +114,4 @@ scsi-libcxgbi-add-a-check-for-null-pointer-in-cxgbi_.patch scsi-smartpqi-properly-set-both-the-dma-mask-and-the.patch scsi-libsas-delete-sas-port-if-expander-discover-fai.patch mlxsw-spectrum-prevent-force-of-56g.patch +coredump-fix-race-condition-between-collapse_huge_page-and-core-dumping.patch