TencentOS
/
TencentOS-kernel
mirror of https://github.com/Tencent/TencentOS-kernel
0
0
Fork 4
Code Issues Projects Releases Wiki Activity
TencentOS-kernel/mm
History
Ilya Lipnitskiy ec1b58f077 mm: fix race by making init_zero_pfn() early_initcall 
commit e720e7d0e983bf05de80b231bccc39f1487f0f16 upstream.

There are code paths that rely on zero_pfn to be fully initialized
before core_initcall.  For example, wq_sysfs_init() is a core_initcall
function that eventually results in a call to kernel_execve, which
causes a page fault with a subsequent mmput.  If zero_pfn is not
initialized by then it may not get cleaned up properly and result in an
error:

  BUG: Bad rss-counter state mm:(ptrval) type:MM_ANONPAGES val:1

Here is an analysis of the race as seen on a MIPS device. On this
particular MT7621 device (Ubiquiti ER-X), zero_pfn is PFN 0 until
initialized, at which point it becomes PFN 5120:

  1. wq_sysfs_init calls into kobject_uevent_env at core_initcall:
       kobject_uevent_env+0x7e4/0x7ec
       kset_register+0x68/0x88
       bus_register+0xdc/0x34c
       subsys_virtual_register+0x34/0x78
       wq_sysfs_init+0x1c/0x4c
       do_one_initcall+0x50/0x1a8
       kernel_init_freeable+0x230/0x2c8
       kernel_init+0x10/0x100
       ret_from_kernel_thread+0x14/0x1c

  2. kobject_uevent_env() calls call_usermodehelper_exec() which executes
     kernel_execve asynchronously.

  3. Memory allocations in kernel_execve cause a page fault, bumping the
     MM reference counter:
       add_mm_counter_fast+0xb4/0xc0
       handle_mm_fault+0x6e4/0xea0
       __get_user_pages.part.78+0x190/0x37c
       __get_user_pages_remote+0x128/0x360
       get_arg_page+0x34/0xa0
       copy_string_kernel+0x194/0x2a4
       kernel_execve+0x11c/0x298
       call_usermodehelper_exec_async+0x114/0x194

  4. In case zero_pfn has not been initialized yet, zap_pte_range does
     not decrement the MM_ANONPAGES RSS counter and the BUG message is
     triggered shortly afterwards when __mmdrop checks the ref counters:
       __mmdrop+0x98/0x1d0
       free_bprm+0x44/0x118
       kernel_execve+0x160/0x1d8
       call_usermodehelper_exec_async+0x114/0x194
       ret_from_kernel_thread+0x14/0x1c

To avoid races such as described above, initialize init_zero_pfn at
early_initcall level.  Depending on the architecture, ZERO_PAGE is
either constant or gets initialized even earlier, at paging_init, so
there is no issue with initializing zero_pfn earlier.

Link: https://lkml.kernel.org/r/CALCv0x2YqOXEAy2Q=hafjhHCtTHVodChv1qpM=niAXOpqEbt7w@mail.gmail.com
Signed-off-by: Ilya Lipnitskiy <ilya.lipnitskiy@gmail.com>
Cc: Hugh Dickins <hughd@google.com>
Cc: "Eric W. Biederman" <ebiederm@xmission.com>
Cc: stable@vger.kernel.org
Tested-by: 周琰杰 (Zhou Yanjie) <zhouyanjie@wanyeetech.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 		2021-05-20 16:06:49 +08:00
..
kasan kasan: fix incorrect arguments passing in kasan_add_zero_shadow 2021-04-12 12:51:39 +08:00
Kconfig mm/zsmalloc.c: drop ZSMALLOC_PGTABLE_MAPPING 2021-03-16 16:42:15 +08:00
Kconfig.debug Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
Makefile Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
backing-dev.c bdi: add a ->dev_name field to struct backing_dev_info 2021-03-16 16:27:44 +08:00
balloon_compaction.c Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
cleancache.c Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
cma.c cma: don't quit at first error when activating reserved areas 2021-03-16 16:34:57 +08:00
cma.h Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
cma_debug.c Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
compaction.c mm/compaction: fix misbehaviors of fast_find_migrateblock() 2021-04-12 12:52:31 +08:00
debug.c Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
debug_page_ref.c Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
dmapool.c Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
early_ioremap.c Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
fadvise.c Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
failslab.c Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
filemap.c mm/error_inject: Fix allow_error_inject function signatures. 2021-03-16 16:38:34 +08:00
frame_vector.c Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
frontswap.c Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
gup.c mm/gup: fix gup_fast with dynamic page table folding 2021-03-16 16:37:40 +08:00
gup_benchmark.c Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
highmem.c Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
hmm.c Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
huge_memory.c mm: thp: fix MADV_REMOVE deadlock on shmem THP 2021-04-12 12:51:57 +08:00
hugetlb.c hugetlbfs: hugetlb_fault_mutex_hash() cleanup 2021-04-12 12:53:21 +08:00
hugetlb_cgroup.c Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
hwpoison-inject.c Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
init-mm.c Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
internal.h Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
interval_tree.c Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
khugepaged.c mm: khugepaged: recalculate min_free_kbytes after memory hotplug as expected by khugepaged 2021-03-16 16:38:06 +08:00
kmemleak-test.c Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
kmemleak.c mm/kmemleak.c: use address-of operator on section symbols 2021-03-16 16:37:10 +08:00
ksm.c mm/ksm: fix NULL pointer dereference when KSM zero page is enabled 2021-03-16 16:26:56 +08:00
list_lru.c mm: list_lru: set shrinker map bit when child nr_items is not zero 2021-03-16 16:42:05 +08:00
maccess.c Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
madvise.c mm: validate pmd after splitting 2021-03-16 16:37:37 +08:00
memblock.c memblock: do not start bottom-up allocations with kernel_end 2021-04-12 12:51:54 +08:00
memcontrol.c mm: memcg/slab: fix root memcg vmstats 2021-03-16 16:41:32 +08:00
memfd.c Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
memory-failure.c BACKPORT: mm/memory-failure: Add memory_failure_queue_kick() 2021-03-16 16:43:59 +08:00
memory.c mm: fix race by making init_zero_pfn() early_initcall 2021-05-20 16:06:49 +08:00
memory_hotplug.c mm: don't rely on system state to detect hot-plug operations 2021-03-16 16:37:50 +08:00
mempolicy.c mm: mempolicy: fix potential pte_unmap_unlock pte error 2021-03-16 16:40:21 +08:00
mempool.c Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
memremap.c Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
memtest.c Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
migrate.c Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
mincore.c Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
mlock.c Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
mm_init.c Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
mmap.c mm/mmap.c: initialize align_offset explicitly for vm_unmapped_area 2021-03-16 16:37:12 +08:00
mmu_context.c mm: fix kthread_use_mm() vs TLB invalidate 2021-03-16 16:34:57 +08:00
mmu_gather.c Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
mmu_notifier.c Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
mmzone.c Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
mprotect.c Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
mremap.c mm: Fix mremap not considering huge pmd devmap 2021-03-16 16:28:43 +08:00
msync.c Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
nommu.c mm: Implement no-MMU variant of vmalloc_user_node_flags 2021-03-16 16:43:58 +08:00
oom_kill.c mm, oom_adj: don't loop through tasks in __set_oom_adj when not necessary 2021-03-16 16:38:47 +08:00
page-writeback.c Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
page_alloc.c mm: don't wake kswapd prematurely when watermark boosting is disabled 2021-03-16 16:43:15 +08:00
page_counter.c mm/page_counter.c: fix protection usage propagation 2021-03-16 16:34:07 +08:00
page_ext.c Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
page_idle.c Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
page_io.c swap: fix swapfile read/write offset 2021-04-12 12:52:50 +08:00
page_isolation.c mm/memory_hotplug: drain per-cpu pages again during memory offline 2021-03-16 16:36:22 +08:00
page_owner.c mm/page_owner: change split_page_owner to take a count 2021-03-16 16:38:58 +08:00
page_poison.c Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
page_vma_mapped.c Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
pagewalk.c mm: pagewalk: fix termination condition in walk_pte_range() 2021-03-16 16:36:50 +08:00
percpu-internal.h Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
percpu-km.c Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
percpu-stats.c Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
percpu-vm.c Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
percpu.c percpu: fix first chunk size calculation for populated bitmap 2021-03-16 16:36:21 +08:00
pgtable-generic.c Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
process_vm_access.c Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
readahead.c Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
rmap.c Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
rodata_test.c Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
shmem.c shmem: fix possible deadlocks on shmlock_user_lock 2021-03-16 16:27:44 +08:00
shuffle.c mm/shuffle: don't move pages between zones and don't read garbage memmaps 2021-03-16 16:34:57 +08:00
shuffle.h Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
slab.c Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
slab.h Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
slab_common.c mm: memcg/slab: fix memory leak at non-root kmem_cache destroy 2021-03-16 16:32:38 +08:00
slob.c Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
slub.c Revert "mm, slub: consider rest of partial list if acquire_slab() fails" 2021-04-12 12:52:58 +08:00
sparse-vmemmap.c Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
sparse.c Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
swap.c Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
swap_cgroup.c Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
swap_slots.c Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
swap_state.c mm/swap_state: fix a data race in swapin_nr_pages 2021-03-16 16:37:24 +08:00
swapfile.c swap: fix swapfile read/write offset 2021-04-12 12:52:50 +08:00
truncate.c Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
usercopy.c Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
userfaultfd.c hugetlbfs: hugetlb_fault_mutex_hash() cleanup 2021-04-12 12:53:21 +08:00
util.c mm: add kvfree_sensitive() for freeing sensitive data objects 2021-03-16 16:28:58 +08:00
vmacache.c Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
vmalloc.c bpf: Add mmap() support for BPF_MAP_TYPE_ARRAY 2021-03-16 16:43:58 +08:00
vmpressure.c Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
vmscan.c memcg: fix variable initialization error causing crash 2021-04-30 14:20:38 +08:00
vmstat.c Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
workingset.c Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
z3fold.c Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
zbud.c Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
zpool.c Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
zsmalloc.c zsmalloc: account the number of compacted pages correctly 2021-04-12 12:52:50 +08:00
zswap.c Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00