Matthew Wilcox (Oracle) 99b45e7a1b memfd: Fix locking when tagging pins ... The RCU lock is insufficient to protect the radix tree iteration as a deletion from the tree can occur before we take the spinlock to tag the entry. In 4.19, this has manifested as a bug with the following trace: kernel BUG at lib/radix-tree.c:1429! invalid opcode: 0000 [#1] SMP KASAN PTI CPU: 7 PID: 6935 Comm: syz-executor.2 Not tainted 4.19.36 #25 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-1ubuntu1 04/01/2014 RIP: 0010:radix_tree_tag_set+0x200/0x2f0 lib/radix-tree.c:1429 Code: 00 00 5b 5d 41 5c 41 5d 41 5e 41 5f c3 48 89 44 24 10 e8 a3 29 7e fe 48 8b 44 24 10 48 0f ab 03 e9 d2 fe ff ff e8 90 29 7e fe <0f> 0b 48 c7 c7 e0 5a 87 84 e8 f0 e7 08 ff 4c 89 ef e8 4a ff ac fe RSP: 0018:ffff88837b13fb60 EFLAGS: 00010016 RAX: 0000000000040000 RBX: ffff8883c5515d58 RCX: ffffffff82cb2ef0 RDX: 0000000000000b72 RSI: ffffc90004cf2000 RDI: ffff8883c5515d98 RBP: ffff88837b13fb98 R08: ffffed106f627f7e R09: ffffed106f627f7e R10: 0000000000000001 R11: ffffed106f627f7d R12: 0000000000000004 R13: ffffea000d7fea80 R14: 1ffff1106f627f6f R15: 0000000000000002 FS: 00007fa1b8df2700(0000) GS:ffff8883e2fc0000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fa1b8df1db8 CR3: 000000037d4d2001 CR4: 0000000000160ee0 Call Trace: memfd_tag_pins mm/memfd.c:51 [inline] memfd_wait_for_pins+0x2c5/0x12d0 mm/memfd.c:81 memfd_add_seals mm/memfd.c:215 [inline] memfd_fcntl+0x33d/0x4a0 mm/memfd.c:247 do_fcntl+0x589/0xeb0 fs/fcntl.c:421 __do_sys_fcntl fs/fcntl.c:463 [inline] __se_sys_fcntl fs/fcntl.c:448 [inline] __x64_sys_fcntl+0x12d/0x180 fs/fcntl.c:448 do_syscall_64+0xc8/0x580 arch/x86/entry/common.c:293 The problem does not occur in mainline due to the XArray rewrite which changed the locking to exclude modification of the tree during iteration. At the time, nobody realised this was a bugfix. Backport the locking changes to stable. Cc: stable@vger.kernel.org Reported-by: zhong jiang <zhongjiang@huawei.com> Signed-off-by: Matthew Wilcox (Oracle) <willy@infradead.org> Signed-off-by: Sasha Levin <sashal@kernel.org>		2019-10-29 09:19:43 +01:00
..
kasan	kernel/memremap, kasan: make ZONE_DEVICE with work with KASAN	2018-08-17 16:20:30 -07:00
backing-dev.c	writeback: synchronize sync(2) against cgroup writeback membership switches	2019-03-05 17:58:50 +01:00
balloon_compaction.c	virtio_balloon: fix deadlock on OOM	2017-11-14 23:57:38 +02:00
bootmem.c	docs/mm: bootmem: add overview documentation	2018-08-02 12:17:27 -06:00
cleancache.c	mm: use octal not symbolic permissions	2018-06-15 07:55:25 +09:00
cma.c	mm/cma.c: fail if fixed declaration can't be honored	2019-08-06 19:06:51 +02:00
cma.h	License cleanup: add SPDX GPL-2.0 license identifier to files with no license	2017-11-02 11:10:55 +01:00
cma_debug.c	mm/cma_debug.c: fix the break condition in cma_maxchunk_get()	2019-06-15 11:54:01 +02:00
compaction.c	mm/compaction.c: clear total_{migrate,free}_scanned before scanning a new zone	2019-10-05 13:10:13 +02:00
debug.c	mm: get rid of vmacache_flush_all() entirely	2018-09-13 15:18:04 -10:00
debug_page_ref.c	License cleanup: add SPDX GPL-2.0 license identifier to files with no license	2017-11-02 11:10:55 +01:00
dmapool.c	mm: use octal not symbolic permissions	2018-06-15 07:55:25 +09:00
early_ioremap.c	mm/early_ioremap: Fix boot hang with earlyprintk=efi,keep	2017-12-11 14:54:44 +01:00
fadvise.c	vfs: implement readahead(2) using POSIX_FADV_WILLNEED	2018-08-30 20:01:32 +02:00
failslab.c	mm: use octal not symbolic permissions	2018-06-15 07:55:25 +09:00
filemap.c	mm: add filemap_fdatawait_range_keep_errors()	2019-07-28 08:29:29 +02:00
frame_vector.c	mm/frame_vector.c: release a semaphore in 'get_vaddr_frames()'	2017-12-14 16:00:48 -08:00
frontswap.c	mm: use octal not symbolic permissions	2018-06-15 07:55:25 +09:00
gup.c	mm/gup.c: remove some BUG_ONs from get_gate_page()	2019-07-31 07:27:08 +02:00
gup_benchmark.c	mm/gup_benchmark: fix unsigned comparison to zero in __gup_benchmark_ioctl	2018-10-05 16:32:04 -07:00
highmem.c	License cleanup: add SPDX GPL-2.0 license identifier to files with no license	2017-11-02 11:10:55 +01:00
hmm.c	mm, hmm: mark hmm_devmem_{add, add_resource} EXPORT_SYMBOL_GPL	2019-01-13 09:51:04 +01:00
huge_memory.c	mm, page_owner: handle THP splits correctly	2019-08-29 08:28:57 +02:00
hugetlb.c	mm: hugetlb: soft-offline: dissolve_free_huge_page() return zero on !PageHuge	2019-07-03 13:14:45 +02:00
hugetlb_cgroup.c	mm: rename page_counter's count/limit into usage/max	2018-06-07 17:34:35 -07:00
hwpoison-inject.c	mm/memory_failure: Remove unused trapno from memory_failure	2018-01-23 12:17:42 -06:00
init-mm.c	mm: Allocate the mm_cpumask (mm->cpu_bitmap[]) dynamically based on nr_cpu_ids	2018-07-17 09:35:30 +02:00
internal.h	mm: Change return type int to vm_fault_t for fault handlers	2018-08-23 18:48:44 -07:00
interval_tree.c	mm/interval_tree.c: use vma_pages() helper	2018-01-31 17:18:37 -08:00
Kconfig	mm/hmm: select mmu notifier when selecting HMM	2019-06-15 11:54:00 +02:00
Kconfig.debug	mm: clarify CONFIG_PAGE_POISONING and usage	2018-08-22 10:52:44 -07:00
khugepaged.c	coredump: fix race condition between collapse_huge_page() and core dumping	2019-06-22 08:15:21 +02:00
kmemleak-test.c
kmemleak.c	Revert "kmemleak: allow to coexist with fault injection"	2019-08-25 10:47:58 +02:00
ksm.c	include/linux/compiler*.h: make compiler-*.h mutually exclusive	2018-08-22 17:31:34 -07:00
list_lru.c	mm/list_lru.c: fix memory leak in __memcg_init_list_lru_node	2019-06-19 08:17:59 +02:00
maccess.c	mm: docs: fix parameter names mismatch	2018-02-06 18:32:48 -08:00
madvise.c	mm: madvise(MADV_DODUMP): allow hugetlbfs pages	2018-10-05 16:32:05 -07:00
Makefile	vfs: implement readahead(2) using POSIX_FADV_WILLNEED	2018-08-30 20:01:32 +02:00
memblock.c	mm/memblock.c: replace u64 with phys_addr_t where appropriate	2018-08-17 16:20:30 -07:00
memcontrol.c	memcg, kmem: do not fail __GFP_NOFAIL charges	2019-10-05 13:10:08 +02:00
memfd.c	memfd: Fix locking when tagging pins	2019-10-29 09:19:43 +01:00
memory-failure.c	mm: hugetlb: soft-offline: dissolve_free_huge_page() return zero on !PageHuge	2019-07-03 13:14:45 +02:00
memory.c	mm: use down_read_killable for locking mmap_sem in access_remote_vm	2019-07-31 07:27:09 +02:00
memory_hotplug.c	mm/memory_hotplug.c: drop memory device reference after find_memory_block()	2019-05-16 19:41:25 +02:00
mempolicy.c	mm: mempolicy: handle vma with unmovable pages mapped correctly in mbind	2019-08-25 10:47:44 +02:00
mempool.c	mm/mempool.c: add missing parameter description	2018-08-22 10:52:44 -07:00
memtest.c	License cleanup: add SPDX GPL-2.0 license identifier to files with no license	2017-11-02 11:10:55 +01:00
migrate.c	mm/migrate.c: initialize pud_entry in migrate_vma()	2019-09-16 08:22:22 +02:00
mincore.c	mm/mincore.c: make mincore() more conservative	2019-05-22 07:37:40 +02:00
mlock.c	mm/mlock.c: change count_mm_mlocked_page_nr return type	2019-07-10 09:53:40 +02:00
mm_init.c	mm: access zone->node via zone_to_nid() and zone_set_nid()	2018-08-22 10:52:45 -07:00
mmap.c	coredump: fix race condition between mmget_not_zero()/get_task_mm() and core dumping	2019-04-27 09:36:37 +02:00
mmu_context.c
mmu_notifier.c	mm/mmu_notifier: use hlist_add_head_rcu()	2019-07-31 07:27:08 +02:00
mmzone.c	License cleanup: add SPDX GPL-2.0 license identifier to files with no license	2017-11-02 11:10:55 +01:00
mprotect.c	x86/speculation/l1tf: Disallow non privileged high MMIO PROT_NONE mappings	2018-06-20 19:10:01 +02:00
mremap.c	mremap: properly flush TLB before releasing the page	2018-10-18 11:30:52 +02:00
msync.c	License cleanup: add SPDX GPL-2.0 license identifier to files with no license	2017-11-02 11:10:55 +01:00
nobootmem.c	mm/memblock: add a name for memblock flags enumeration	2018-08-02 12:17:27 -06:00
nommu.c	mm: use down_read_killable for locking mmap_sem in access_remote_vm	2019-07-31 07:27:09 +02:00
oom_kill.c	memcg, oom: don't require __GFP_FS when invoking memcg OOM killer	2019-10-05 13:10:07 +02:00
page-writeback.c	mm/page-writeback.c: don't break integrity writeback on ->writepage() error	2019-01-26 09:32:43 +01:00
page_alloc.c	mem-hotplug: fix node spanned pages when we have a node with only ZONE_MOVABLE	2019-06-15 11:54:00 +02:00
page_counter.c	memcg: introduce memory.min	2018-06-07 17:34:36 -07:00
page_ext.c	mm/page_ext.c: fix an imbalance with kmemleak	2019-04-05 22:32:58 +02:00
page_idle.c	mm/page_idle.c: fix oops because end_pfn is larger than max_pfn	2019-07-03 13:14:45 +02:00
page_io.c	swap,blkcg: issue swap io with the appropriate context	2018-07-09 09:07:54 -06:00
page_isolation.c	mm, migrate: remove reason argument from new_page_t	2018-04-11 10:28:32 -07:00
page_owner.c	mm: use octal not symbolic permissions	2018-06-15 07:55:25 +09:00
page_poison.c	page_poison: play nicely with KASAN	2019-04-05 22:32:59 +02:00
page_vma_mapped.c	mm/rmap: map_pte() was not handling private ZONE_DEVICE page properly	2018-11-13 11:08:46 -08:00
pagewalk.c	mm: kernel-doc: add missing parameter descriptions	2018-04-05 21:36:27 -07:00
percpu-internal.h	License cleanup: add SPDX GPL-2.0 license identifier to files with no license	2017-11-02 11:10:55 +01:00
percpu-km.c	percpu: convert spin_lock_irq to spin_lock_irqsave.	2019-02-12 19:47:12 +01:00
percpu-stats.c	treewide: Use array_size() in vmalloc()	2018-06-12 16:19:22 -07:00
percpu-vm.c	percpu: allow select gfp to be passed to underlying allocators	2018-02-18 05:33:01 -08:00
percpu.c	percpu: do not search past bitmap when allocating an area	2019-06-15 11:54:11 +02:00
pgtable-generic.c	mm: do not lose dirty and accessed bits in pmdp_invalidate()	2018-01-31 17:18:38 -08:00
process_vm_access.c	mm: docs: add blank lines to silence sphinx "Unexpected indentation" errors	2018-02-06 18:32:48 -08:00
quicklist.c	License cleanup: add SPDX GPL-2.0 license identifier to files with no license	2017-11-02 11:10:55 +01:00
readahead.c	vfs: implement readahead(2) using POSIX_FADV_WILLNEED	2018-08-30 20:01:32 +02:00
rmap.c	mm/hmm: fix bad subpage pointer in try_to_unmap_one	2019-08-25 10:47:43 +02:00
rodata_test.c
shmem.c	tmpfs: fix uninitialized return value in shmem_link	2019-03-23 20:09:52 +01:00
slab.c	mm/slab.c: fix an infinite loop in leaks_show()	2019-06-15 11:54:01 +02:00
slab.h	mm: add support for kmem caches in DMA32 zone	2019-04-03 06:26:28 +02:00
slab_common.c	mm: add support for kmem caches in DMA32 zone	2019-04-03 06:26:28 +02:00
slob.c	slab: __GFP_ZERO is incompatible with a constructor	2018-06-07 17:34:34 -07:00
slub.c	mm: add support for kmem caches in DMA32 zone	2019-04-03 06:26:28 +02:00
sparse-vmemmap.c	mm/sparse: delete old sparse_init and enable new one	2018-08-17 16:20:32 -07:00
sparse.c	mm/sparse: fix a bad comparison	2019-04-05 22:32:58 +02:00
swap.c	mm/swap: fix release_pages() when releasing devmap pages	2019-07-31 07:27:03 +02:00
swap_cgroup.c	License cleanup: add SPDX GPL-2.0 license identifier to files with no license	2017-11-02 11:10:55 +01:00
swap_slots.c	mm, swap, get_swap_pages: use entry_size instead of cluster in parameter	2018-08-22 10:52:44 -07:00
swap_state.c	treewide: kvzalloc() -> kvcalloc()	2018-06-12 16:19:22 -07:00
swapfile.c	mm, swap: bounds check swap_info array accesses to avoid NULL derefs	2019-04-05 22:32:58 +02:00
truncate.c	mm: cleancache: fix corruption on missed inode invalidation	2018-12-05 19:32:13 +01:00
usercopy.c	usercopy: Avoid HIGHMEM pfn warning	2019-10-11 18:20:58 +02:00
userfaultfd.c	hugetlb: use same fault hash key for shared and private mappings	2019-05-22 07:37:40 +02:00
util.c	mm: page_mapped: don't assume compound page is huge or THP	2019-01-16 22:04:36 +01:00
vmacache.c	mm: get rid of vmacache_flush_all() entirely	2018-09-13 15:18:04 -10:00
vmalloc.c	mm/vmalloc: Sync unmappings in __purge_vmap_area_lazy()	2019-08-16 10:12:40 +02:00
vmpressure.c	mm/vmpressure.c: fix a signedness bug in vmpressure_register_event()	2019-10-17 13:45:19 -07:00
vmscan.c	mm: vmscan: check if mem cgroup is disabled or not before calling memcg slab shrinker	2019-08-06 19:06:54 +02:00
vmstat.c	mm/vmstat.c: fix /proc/vmstat format for CONFIG_DEBUG_TLBFLUSH=y CONFIG_SMP=n	2019-04-27 09:36:40 +02:00
workingset.c	mm/list_lru: introduce list_lru_shrink_walk_irq()	2018-08-17 16:20:32 -07:00
z3fold.c	z3fold: fix possible reclaim races	2018-12-01 09:37:33 +01:00
zbud.c	mm: docs: fix parameter names mismatch	2018-02-06 18:32:48 -08:00
zpool.c	mm/zpool.c: zpool_evictable: fix mismatch in parameter name and kernel-doc	2018-02-21 15:35:43 -08:00
zsmalloc.c	mm/zsmalloc.c: fix build when CONFIG_COMPACTION=n	2019-09-06 10:22:08 +02:00
zswap.c	zswap: re-check zswap_is_full() after do zswap_shrink()	2018-07-26 19:38:03 -07:00