From: Jan Kara <jack@suse.cz>
To: linux-mm@kvack.org
Cc: Johannes Weiner <hannes@cmpxchg.org>,
Ross Zwisler <ross.zwisler@linux.intel.com>
Subject: Use after free in workingset LRU handling
Date: Thu, 12 May 2016 19:27:22 +0200 [thread overview]
Message-ID: <20160512172722.GC30647@quack2.suse.cz> (raw)
Hello,
when testing recent DAX fixes, I was puzzled by shadow_lru_isolate()
barfing on radix tree nodes attached to DAX mappings (as DAX mappings have
no shadow entries and I took care to not insert radix tree nodes for such
mappings into workingset_shadow_nodes LRU list. After some investigation, I
think there is a use after free issue in the handling of radix tree nodes
by workingset code. The following seems to be possible:
Radix tree node is created, is has two page pointers for indices 0 and 1.
Page pointer for index 0 gets replaced with a shadow entry, radix tree
node gets inserted into workingset_shadow_nodes
Truncate happens removing page at index 1, __radix_tree_delete_node() in
page_cache_tree_delete() frees the radix tree node (as it has only single
entry at index 0 and thus we can shrink the tree) while it is still in LRU
list!
Am I missing something? I'm not sure how to best fix this issue since the
shrinking / expanding of the radix tree is fully under control of
lib/radix-tree.c which is completely agnostic to the private_list used by
mm/workingset.c... Maybe we'd need some callback when radix tree node gets
freed?
Honza
--
Jan Kara <jack@suse.com>
SUSE Labs, CR
--
To unsubscribe, send a message with 'unsubscribe linux-mm' in
the body to majordomo@kvack.org. For more info on Linux MM,
see: http://www.linux-mm.org/ .
Don't email: <a href=mailto:"dont@kvack.org"> email@kvack.org </a>
next reply other threads:[~2016-05-12 17:27 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2016-05-12 17:27 Jan Kara [this message]
2016-05-18 6:03 ` Johannes Weiner
2016-05-18 7:13 ` Jan Kara
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20160512172722.GC30647@quack2.suse.cz \
--to=jack@suse.cz \
--cc=hannes@cmpxchg.org \
--cc=linux-mm@kvack.org \
--cc=ross.zwisler@linux.intel.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox