From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id 88984C433EF for ; Thu, 12 May 2022 12:34:56 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id DDD8D6B0074; Thu, 12 May 2022 08:34:55 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id D8C0E6B0075; Thu, 12 May 2022 08:34:55 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id C52D86B0078; Thu, 12 May 2022 08:34:55 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0011.hostedemail.com [216.40.44.11]) by kanga.kvack.org (Postfix) with ESMTP id B1B376B0074 for ; Thu, 12 May 2022 08:34:55 -0400 (EDT) Received: from smtpin29.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay06.hostedemail.com (Postfix) with ESMTP id 8B16631E45 for ; Thu, 12 May 2022 12:34:55 +0000 (UTC) X-FDA: 79457035350.29.1FC2766 Received: from mail-pf1-f193.google.com (mail-pf1-f193.google.com [209.85.210.193]) by imf01.hostedemail.com (Postfix) with ESMTP id C4D48400B4 for ; Thu, 12 May 2022 12:34:42 +0000 (UTC) Received: by mail-pf1-f193.google.com with SMTP id g8so4674760pfh.5 for ; Thu, 12 May 2022 05:34:54 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20210112; h=date:from:to:cc:subject:message-id:mime-version:content-disposition; bh=yQ5WC+qcQWn5/mQktyQ4optwmHzpiPFv8x+qVdD6+j8=; b=nEtYBtR0RP200nt2NTfIFNPaHyXnOsWGHzp9bm7b6ycK/2hhsrwxnHCX0QWasV/LPq QUbVu4Ylnd5FdLc4hkvamnC6zKkY1XFu21kltQv3rRySkga5epOVe5zRVSaiG349p1ok vDvii4rC9Sr8FMOnGiNJt4bvHQyqQAPSxQIJ4ua5i3vBm1JaeZdV4pVbfCp714ZOJAhA bge3VVDrkGabUdjqKhBlGsiLQwgjWBz7Z6rYlkAfNjKiYqRTqiStuF+8LJN9bwNlPRVb 8esE+scWFh4J1fhe/y8wtZAUpFXnC1tvh+AFHA67DGl7UsVnWivZtgGM+Z347v9bNb/C OLTg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:date:from:to:cc:subject:message-id:mime-version :content-disposition; bh=yQ5WC+qcQWn5/mQktyQ4optwmHzpiPFv8x+qVdD6+j8=; b=mMV4DviW4Co6Uu9BhJCa++WqAU1UfOi8/q8c6gq9ONUiQ2ivhSv4cDCcFJs3yodo5F FDmw9rq0zifdga70MaTUdHvAfdXfVOE0wjM7SKnM9VxQlP844qdZgmGcNiAOwXLb81ZO BzuruhgAL7s1xijEKwYrmqAsHdI00LZQyc7BZA2YNFp7M7jfXkpwWoLuP4pim941OCyQ yQ+yfH2wyw77COZ0W1T7Hnb7P2CBG+yYsMAsux3E2vnpf1OMQce597UaHOlKSIeQjJYP 8oAtm60TKtBPDgXZGFJ3g8QBqgRs7mOk2Xw+LjH38gSZAsOlsUzT3/vBRbFT4bLfCge1 OgzQ== X-Gm-Message-State: AOAM530VabdQSsms9gDL0MTiwy6ng1g7S7J8nq0yhkRIcGcBVaU32RIo Ll7UOkQCB/SUnSXodSoKJhg= X-Google-Smtp-Source: ABdhPJwLRrKmpLcRZdI+y9ESvkx5IO/3s59v/pkumtgamKiIN06JgAS4mXsn/09jTM05zY8VIRa4og== X-Received: by 2002:a63:561c:0:b0:3c1:42fb:cd81 with SMTP id k28-20020a63561c000000b003c142fbcd81mr25803928pgb.104.1652358893907; Thu, 12 May 2022 05:34:53 -0700 (PDT) Received: from localhost ([152.70.90.187]) by smtp.gmail.com with ESMTPSA id 188-20020a6308c5000000b003c14af505f8sm1759534pgi.16.2022.05.12.05.34.51 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 12 May 2022 05:34:53 -0700 (PDT) Date: Thu, 12 May 2022 20:34:28 +0800 From: Wang Cheng To: akpm@linux-foundation.org Cc: linux-mm@kvack.org, cgroups@vger.kernel.org, linux-kernel@vger.kernel.org Subject: [PATCH] mm/mempolicy: fix uninit-value in mpol_rebind_policy() Message-ID: <20220512123428.fq3wofedp6oiotd4@ppc.localdomain> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline X-Rspamd-Queue-Id: C4D48400B4 X-Stat-Signature: qd9wn6bmiknnkbykyswy3qo9fwe57as9 Authentication-Results: imf01.hostedemail.com; dkim=pass header.d=gmail.com header.s=20210112 header.b=nEtYBtR0; dmarc=pass (policy=none) header.from=gmail.com; spf=pass (imf01.hostedemail.com: domain of wanngchenng@gmail.com designates 209.85.210.193 as permitted sender) smtp.mailfrom=wanngchenng@gmail.com X-Rspam-User: X-Rspamd-Server: rspam08 X-HE-Tag: 1652358882-233246 X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: mpol_set_nodemask()(mm/mempolicy.c) does not set up nodemask when pol->mode is MPOL_LOCAL. Check pol->mode before access pol->w.cpuset_mems_allowed in mpol_rebind_policy()(mm/mempolicy.c). BUG: KMSAN: uninit-value in mpol_rebind_policy mm/mempolicy.c:352 [inline] BUG: KMSAN: uninit-value in mpol_rebind_task+0x2ac/0x2c0 mm/mempolicy.c:368 mpol_rebind_policy mm/mempolicy.c:352 [inline] mpol_rebind_task+0x2ac/0x2c0 mm/mempolicy.c:368 cpuset_change_task_nodemask kernel/cgroup/cpuset.c:1711 [inline] cpuset_attach+0x787/0x15e0 kernel/cgroup/cpuset.c:2278 cgroup_migrate_execute+0x1023/0x1d20 kernel/cgroup/cgroup.c:2515 cgroup_migrate kernel/cgroup/cgroup.c:2771 [inline] cgroup_attach_task+0x540/0x8b0 kernel/cgroup/cgroup.c:2804 __cgroup1_procs_write+0x5cc/0x7a0 kernel/cgroup/cgroup-v1.c:520 cgroup1_tasks_write+0x94/0xb0 kernel/cgroup/cgroup-v1.c:539 cgroup_file_write+0x4c2/0x9e0 kernel/cgroup/cgroup.c:3852 kernfs_fop_write_iter+0x66a/0x9f0 fs/kernfs/file.c:296 call_write_iter include/linux/fs.h:2162 [inline] new_sync_write fs/read_write.c:503 [inline] vfs_write+0x1318/0x2030 fs/read_write.c:590 ksys_write+0x28b/0x510 fs/read_write.c:643 __do_sys_write fs/read_write.c:655 [inline] __se_sys_write fs/read_write.c:652 [inline] __x64_sys_write+0xdb/0x120 fs/read_write.c:652 do_syscall_x64 arch/x86/entry/common.c:51 [inline] do_syscall_64+0x54/0xd0 arch/x86/entry/common.c:82 entry_SYSCALL_64_after_hwframe+0x44/0xae Uninit was created at: slab_post_alloc_hook mm/slab.h:524 [inline] slab_alloc_node mm/slub.c:3251 [inline] slab_alloc mm/slub.c:3259 [inline] kmem_cache_alloc+0x902/0x11c0 mm/slub.c:3264 mpol_new mm/mempolicy.c:293 [inline] do_set_mempolicy+0x421/0xb70 mm/mempolicy.c:853 kernel_set_mempolicy mm/mempolicy.c:1504 [inline] __do_sys_set_mempolicy mm/mempolicy.c:1510 [inline] __se_sys_set_mempolicy+0x44c/0xb60 mm/mempolicy.c:1507 __x64_sys_set_mempolicy+0xd8/0x110 mm/mempolicy.c:1507 do_syscall_x64 arch/x86/entry/common.c:51 [inline] do_syscall_64+0x54/0xd0 arch/x86/entry/common.c:82 entry_SYSCALL_64_after_hwframe+0x44/0xae KMSAN: uninit-value in mpol_rebind_task (2) https://syzkaller.appspot.com/bug?id=d6eb90f952c2a5de9ea718a1b873c55cb13b59dc Reported-and-tested-by: syzbot+217f792c92599518a2ab@syzkaller.appspotmail.com Signed-off-by: Wang Cheng --- The uninit-value is pol->w.cpuset_mems_allowed in mpol_rebind_policy(). While syzkaller reproducer runs, I notice pol->mode is 4(MPOL_LOCAL) in mpol_set_nodemask() do_set_mempolicy()(mm/mempolicy.c) that `nodemask` in `pol` is not initialized, which will be accessed in mpol_rebind_policy(). mm/mempolicy.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/mm/mempolicy.c b/mm/mempolicy.c index 10e9c87260ed..18b74f02da71 100644 --- a/mm/mempolicy.c +++ b/mm/mempolicy.c @@ -347,7 +347,7 @@ static void mpol_rebind_preferred(struct mempolicy *pol, */ static void mpol_rebind_policy(struct mempolicy *pol, const nodemask_t *newmask) { - if (!pol) + if (!pol || pol->mode == MPOL_LOCAL) return; if (!mpol_store_user_nodemask(pol) && nodes_equal(pol->w.cpuset_mems_allowed, *newmask)) -- 2.30.2