linux-mm.kvack.org archive mirror
 help / color / mirror / Atom feed
From: Jan Kara <jack@suse.cz>
To: linux-mm@kvack.org
Cc: Johannes Weiner <hannes@cmpxchg.org>,
	Ross Zwisler <ross.zwisler@linux.intel.com>
Subject: Use after free in workingset LRU handling
Date: Thu, 12 May 2016 19:27:22 +0200	[thread overview]
Message-ID: <20160512172722.GC30647@quack2.suse.cz> (raw)

Hello,

when testing recent DAX fixes, I was puzzled by shadow_lru_isolate()
barfing on radix tree nodes attached to DAX mappings (as DAX mappings have
no shadow entries and I took care to not insert radix tree nodes for such
mappings into workingset_shadow_nodes LRU list. After some investigation, I
think there is a use after free issue in the handling of radix tree nodes
by workingset code. The following seems to be possible:

Radix tree node is created, is has two page pointers for indices 0 and 1.

Page pointer for index 0 gets replaced with a shadow entry, radix tree
node gets inserted into workingset_shadow_nodes

Truncate happens removing page at index 1, __radix_tree_delete_node() in
page_cache_tree_delete() frees the radix tree node (as it has only single
entry at index 0 and thus we can shrink the tree) while it is still in LRU
list!

Am I missing something? I'm not sure how to best fix this issue since the
shrinking / expanding of the radix tree is fully under control of
lib/radix-tree.c which is completely agnostic to the private_list used by
mm/workingset.c... Maybe we'd need some callback when radix tree node gets
freed?

								Honza

-- 
Jan Kara <jack@suse.com>
SUSE Labs, CR

--
To unsubscribe, send a message with 'unsubscribe linux-mm' in
the body to majordomo@kvack.org.  For more info on Linux MM,
see: http://www.linux-mm.org/ .
Don't email: <a href=mailto:"dont@kvack.org"> email@kvack.org </a>

             reply	other threads:[~2016-05-12 17:27 UTC|newest]

Thread overview: 3+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2016-05-12 17:27 Jan Kara [this message]
2016-05-18  6:03 ` Johannes Weiner
2016-05-18  7:13   ` Jan Kara

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20160512172722.GC30647@quack2.suse.cz \
    --to=jack@suse.cz \
    --cc=hannes@cmpxchg.org \
    --cc=linux-mm@kvack.org \
    --cc=ross.zwisler@linux.intel.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox