From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id B2284C433F5 for ; Thu, 17 Mar 2022 10:26:30 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id 1AE276B0071; Thu, 17 Mar 2022 06:26:30 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id 15EB88D0002; Thu, 17 Mar 2022 06:26:30 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 04D028D0001; Thu, 17 Mar 2022 06:26:30 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from forelay.hostedemail.com (smtprelay0141.hostedemail.com [216.40.44.141]) by kanga.kvack.org (Postfix) with ESMTP id EA88C6B0071 for ; Thu, 17 Mar 2022 06:26:29 -0400 (EDT) Received: from smtpin25.hostedemail.com (10.5.19.251.rfc1918.com [10.5.19.251]) by forelay01.hostedemail.com (Postfix) with ESMTP id AA601182751CB for ; Thu, 17 Mar 2022 10:26:29 +0000 (UTC) X-FDA: 79253498898.25.E1FD168 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by imf25.hostedemail.com (Postfix) with ESMTP id 4AB2FA000E for ; Thu, 17 Mar 2022 10:26:28 +0000 (UTC) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 14CB7B80EE0; Thu, 17 Mar 2022 10:26:27 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 55EC9C340E9; Thu, 17 Mar 2022 10:26:25 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1647512785; bh=4qEBcDajlD5kYvfjOkzCEQ/z5kJDytEOC4nMhJy2ciQ=; h=Date:From:To:Cc:Subject:References:In-Reply-To:From; b=Erh4LpH/4hQpxoJX4uPvJ7MlZqxiHCBgFK8CaRoHuUwtQsL9MGX0vYn0WAtnBhFvh asfFrzTc5syaQGW/d04P7Vx8O4NRBOaqxmWyia5ot4x3a1f4QGDUMXNGqUn4G1mJTu 39FM6DENvzHXb37gjs0ZR8NA6v0989KrzpRDwzrw= Date: Thu, 17 Mar 2022 11:26:22 +0100 From: Greg KH To: liqiong Cc: david@redhat.com, linux-mm@kvack.org, linux-kernel@vger.kernel.org, stable@vger.kernel.org Subject: Re: [PATCH] [PATCH 4.19 STABLE] mm: fix dereference a null pointer in migrate[_huge]_page_move_mapping() Message-ID: References: <20220217063808.42018-1-liqiong@nfschina.com> <20220217115416.55835-1-liqiong@nfschina.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20220217115416.55835-1-liqiong@nfschina.com> X-Rspam-User: X-Rspamd-Server: rspam10 X-Rspamd-Queue-Id: 4AB2FA000E X-Stat-Signature: 64zbk9cuhnstxydcaggxh5qi3wbekzfp Authentication-Results: imf25.hostedemail.com; dkim=pass header.d=linuxfoundation.org header.s=korg header.b="Erh4LpH/"; dmarc=pass (policy=none) header.from=linuxfoundation.org; spf=pass (imf25.hostedemail.com: domain of gregkh@linuxfoundation.org designates 145.40.68.75 as permitted sender) smtp.mailfrom=gregkh@linuxfoundation.org X-HE-Tag: 1647512788-720178 X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: On Thu, Feb 17, 2022 at 07:54:16PM +0800, liqiong wrote: > Upstream doesn't use radix tree any more in migrate.c, no need this patch. > > The two functions look up a slot and dereference the pointer, > If the pointer is null, the kernel would crash and dump. > > The 'numad' service calls 'migrate_pages' periodically. If some slots > being replaced (Cache Eviction), the radix_tree_lookup_slot() returns > a null pointer that causes kernel crash. > > "numad": crash> bt > [exception RIP: migrate_page_move_mapping+337] > > Introduce pointer checking to avoid dereference a null pointer. > > Cc: # linux-4.19.y > Signed-off-by: liqiong > --- > mm/migrate.c | 8 ++++++++ > 1 file changed, 8 insertions(+) > > diff --git a/mm/migrate.c b/mm/migrate.c > index a69b842f95da..76f8dedc0e02 100644 > --- a/mm/migrate.c > +++ b/mm/migrate.c > @@ -472,6 +472,10 @@ int migrate_page_move_mapping(struct address_space *mapping, > > pslot = radix_tree_lookup_slot(&mapping->i_pages, > page_index(page)); > + if (pslot == NULL) { > + xa_unlock_irq(&mapping->i_pages); > + return -EAGAIN; > + } > > expected_count += hpage_nr_pages(page) + page_has_private(page); > if (page_count(page) != expected_count || > @@ -590,6 +594,10 @@ int migrate_huge_page_move_mapping(struct address_space *mapping, > xa_lock_irq(&mapping->i_pages); > > pslot = radix_tree_lookup_slot(&mapping->i_pages, page_index(page)); > + if (pslot == NULL) { > + xa_unlock_irq(&mapping->i_pages); > + return -EAGAIN; > + } > > expected_count = 2 + page_has_private(page); > if (page_count(page) != expected_count || > -- > 2.25.1 > Sorry for the delay, now queued up. greg k-h