From patchwork Mon Aug 24 08:29:07 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 264976 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-10.7 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI, SIGNED_OFF_BY,SPF_HELO_NONE,SPF_PASS,USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 5845AC433DF for ; Mon, 24 Aug 2020 09:50:52 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 31A012071E for ; Mon, 24 Aug 2020 09:50:52 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1598262652; bh=bwJDBs57T0HWecCtTiQwXS+EX5zVLlTne8P+SfQfMyA=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=eKeHffbDPOzcikky1BujlOSKh8WVHK0eDGmU0AGJuQYWVdHi7JOq6HSKq7cY1Bzz9 +jD/JWZtonWfgomxPOt7IQSpJJSFxQJ6Duze2Kc0GVJULv5fha+2xejFooYXtvwnqp jjDKj4O6gPKANb39GrRk3AUObV27kwfViUylKA/Y= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1728409AbgHXJuS (ORCPT ); Mon, 24 Aug 2020 05:50:18 -0400 Received: from mail.kernel.org ([198.145.29.99]:54060 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1728048AbgHXIi4 (ORCPT ); Mon, 24 Aug 2020 04:38:56 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id AC2AB22BEB; Mon, 24 Aug 2020 08:38:55 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1598258336; bh=bwJDBs57T0HWecCtTiQwXS+EX5zVLlTne8P+SfQfMyA=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=w7EqnVZpz4745tfhYNkYoUuY47bJQTfxEzO04xqaVtBjLjzpMtmuqMrK6RQseVks+ MHAMzMilaM5mMjmqBtoUYwfsURmyXuqZDYsQox9ERKMhXOfPVlUco5A7Pl7CL5IQb5 KGIDLUWByZkq2/4lULb7vL+TD9t/zyZcvvT1kJ4U= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, syzbot , Hugh Dickins , Andrew Morton , Srikar Dronamraju , Song Liu , Oleg Nesterov , "Kirill A. Shutemov" , Linus Torvalds Subject: [PATCH 5.7 013/124] uprobes: __replace_page() avoid BUG in munlock_vma_page() Date: Mon, 24 Aug 2020 10:29:07 +0200 Message-Id: <20200824082410.064150254@linuxfoundation.org> X-Mailer: git-send-email 2.28.0 In-Reply-To: <20200824082409.368269240@linuxfoundation.org> References: <20200824082409.368269240@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Hugh Dickins commit c17c3dc9d08b9aad9a55a1e53f205187972f448e upstream. syzbot crashed on the VM_BUG_ON_PAGE(PageTail) in munlock_vma_page(), when called from uprobes __replace_page(). Which of many ways to fix it? Settled on not calling when PageCompound (since Head and Tail are equals in this context, PageCompound the usual check in uprobes.c, and the prior use of FOLL_SPLIT_PMD will have cleared PageMlocked already). Fixes: 5a52c9df62b4 ("uprobe: use FOLL_SPLIT_PMD instead of FOLL_SPLIT") Reported-by: syzbot Signed-off-by: Hugh Dickins Signed-off-by: Andrew Morton Reviewed-by: Srikar Dronamraju Acked-by: Song Liu Acked-by: Oleg Nesterov Cc: "Kirill A. Shutemov" Cc: [5.4+] Link: http://lkml.kernel.org/r/alpine.LSU.2.11.2008161338360.20413@eggly.anvils Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman --- kernel/events/uprobes.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/kernel/events/uprobes.c +++ b/kernel/events/uprobes.c @@ -211,7 +211,7 @@ static int __replace_page(struct vm_area try_to_free_swap(old_page); page_vma_mapped_walk_done(&pvmw); - if (vma->vm_flags & VM_LOCKED) + if ((vma->vm_flags & VM_LOCKED) && !PageCompound(old_page)) munlock_vma_page(old_page); put_page(old_page);