From patchwork Fri Aug 21 00:42:17 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Andrew Morton X-Patchwork-Id: 265238 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.8 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI, SIGNED_OFF_BY,SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED autolearn=no autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id BD827C433E1 for ; Fri, 21 Aug 2020 00:42:20 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 947E220FC3 for ; Fri, 21 Aug 2020 00:42:20 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1597970540; bh=H0TlMLU7cAofjPmQz4xfJlF0ssVRdl3/ZmHYO3yDzvk=; h=Date:From:To:Subject:In-Reply-To:List-ID:From; b=aMgzD5h3SBFkSNJ81qeanAv8dkAKvF5soC1J/WS8/etlFRHO6p3xssGOlZePq6GLh dYjtXXK641eeY1W5RMhSRtB42zCqu8EQDyNN1XOj/Ug/nlA1qbIowKI1q2cjY/QKOp v6N2slnGhrF6HLbhouSf6Q3WorchoFXhxR9blqmg= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1727046AbgHUAmU (ORCPT ); Thu, 20 Aug 2020 20:42:20 -0400 Received: from mail.kernel.org ([198.145.29.99]:35674 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1727012AbgHUAmT (ORCPT ); Thu, 20 Aug 2020 20:42:19 -0400 Received: from localhost.localdomain (c-73-231-172-41.hsd1.ca.comcast.net [73.231.172.41]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 5DC6822B3F; Fri, 21 Aug 2020 00:42:18 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1597970538; bh=H0TlMLU7cAofjPmQz4xfJlF0ssVRdl3/ZmHYO3yDzvk=; h=Date:From:To:Subject:In-Reply-To:From; b=yST5V7MI6TNTixVOBVSzajv07c/mdva30cf8ICrAqeNy0vr7Y6pFAEH2d5z9Yk61p 9r2KpVxyew6Qtvb8IieCuynvzQauLE6/kuAyB+oE3OcWcbz5rflgcYdPYszIm4dtHH 9YrgrI7qbaXghDsM9HqRDrpAq0HPTvLdkWWcjRB4= Date: Thu, 20 Aug 2020 17:42:17 -0700 From: Andrew Morton To: akpm@linux-foundation.org, hughd@google.com, kirill.shutemov@linux.intel.com, linux-mm@kvack.org, mm-commits@vger.kernel.org, oleg@redhat.com, songliubraving@fb.com, srikar@linux.vnet.ibm.com, stable@vger.kernel.org, syzkaller@googlegroups.com, torvalds@linux-foundation.org Subject: [patch 08/11] uprobes: __replace_page() avoid BUG in munlock_vma_page() Message-ID: <20200821004217.UBGpf4I1N%akpm@linux-foundation.org> In-Reply-To: <20200820174132.67fd4a7a9359048f807a533b@linux-foundation.org> User-Agent: s-nail v14.8.16 Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Hugh Dickins Subject: uprobes: __replace_page() avoid BUG in munlock_vma_page() syzbot crashed on the VM_BUG_ON_PAGE(PageTail) in munlock_vma_page(), when called from uprobes __replace_page(). Which of many ways to fix it? Settled on not calling when PageCompound (since Head and Tail are equals in this context, PageCompound the usual check in uprobes.c, and the prior use of FOLL_SPLIT_PMD will have cleared PageMlocked already). Link: http://lkml.kernel.org/r/alpine.LSU.2.11.2008161338360.20413@eggly.anvils Fixes: 5a52c9df62b4 ("uprobe: use FOLL_SPLIT_PMD instead of FOLL_SPLIT") Signed-off-by: Hugh Dickins Reported-by: syzbot Acked-by: Song Liu Acked-by: Oleg Nesterov Reviewed-by: Srikar Dronamraju Cc: "Kirill A. Shutemov" Cc: [5.4+] Signed-off-by: Andrew Morton --- kernel/events/uprobes.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/kernel/events/uprobes.c~uprobes-__replace_page-avoid-bug-in-munlock_vma_page +++ a/kernel/events/uprobes.c @@ -205,7 +205,7 @@ static int __replace_page(struct vm_area try_to_free_swap(old_page); page_vma_mapped_walk_done(&pvmw); - if (vma->vm_flags & VM_LOCKED) + if ((vma->vm_flags & VM_LOCKED) && !PageCompound(old_page)) munlock_vma_page(old_page); put_page(old_page);