Files
linux/include/linux
Michal Hocko e4bd6a0248 mm, memcg: fix potential undefined behaviour in page stat accounting
Since commit d7365e783e ("mm: memcontrol: fix missed end-writeback
page accounting") mem_cgroup_end_page_stat consumes locked and flags
variables directly rather than via pointers which might trigger C
undefined behavior as those variables are initialized only in the slow
path of mem_cgroup_begin_page_stat.

Although mem_cgroup_end_page_stat handles parameters correctly and
touches them only when they hold a sensible value it is caller which
loads a potentially uninitialized value which then might allow compiler
to do crazy things.

I haven't seen any warning from gcc and it seems that the current
version (4.9) doesn't exploit this type undefined behavior but Sasha has
reported the following:

  UBSan: Undefined behaviour in mm/rmap.c:1084:2
  load of value 255 is not a valid value for type '_Bool'
  CPU: 4 PID: 8304 Comm: rngd Not tainted 3.18.0-rc2-next-20141029-sasha-00039-g77ed13d-dirty #1427
  Call Trace:
    dump_stack (lib/dump_stack.c:52)
    ubsan_epilogue (lib/ubsan.c:159)
    __ubsan_handle_load_invalid_value (lib/ubsan.c:482)
    page_remove_rmap (mm/rmap.c:1084 mm/rmap.c:1096)
    unmap_page_range (./arch/x86/include/asm/atomic.h:27 include/linux/mm.h:463 mm/memory.c:1146 mm/memory.c:1258 mm/memory.c:1279 mm/memory.c:1303)
    unmap_single_vma (mm/memory.c:1348)
    unmap_vmas (mm/memory.c:1377 (discriminator 3))
    exit_mmap (mm/mmap.c:2837)
    mmput (kernel/fork.c:659)
    do_exit (./arch/x86/include/asm/thread_info.h:168 kernel/exit.c:462 kernel/exit.c:747)
    do_group_exit (include/linux/sched.h:775 kernel/exit.c:873)
    SyS_exit_group (kernel/exit.c:901)
    tracesys_phase2 (arch/x86/kernel/entry_64.S:529)

Fix this by using pointer parameters for both locked and flags and be
more robust for future compiler changes even though the current code is
implemented correctly.

Signed-off-by: Michal Hocko <mhocko@suse.cz>
Reported-by: Sasha Levin <sasha.levin@oracle.com>
Acked-by: Johannes Weiner <hannes@cmpxchg.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2014-12-10 17:41:08 -08:00
..
2014-11-18 13:23:31 +01:00
2014-09-22 16:48:47 +09:00
2014-11-30 20:13:13 -08:00
2014-10-03 15:28:18 -06:00
2014-10-14 09:00:44 -06:00
2014-11-12 11:16:09 +01:00
2014-09-26 15:05:15 -04:00
2014-10-21 00:51:01 +02:00
2014-08-01 22:35:55 +08:00
2014-09-23 11:10:20 -07:00
2014-09-26 15:05:15 -04:00
2014-10-09 11:35:48 +03:00
2014-10-08 16:01:41 -04:00
2014-08-07 14:40:08 -04:00
2014-12-10 17:41:05 -08:00
2014-08-06 18:01:24 -07:00
2014-09-25 16:07:15 +02:00
2014-09-29 15:37:01 -04:00
2014-09-01 13:48:59 +02:00
2014-11-04 14:53:36 +01:00
2014-07-22 21:55:45 +01:00
2014-10-14 02:18:13 +02:00
2014-10-09 22:25:58 -04:00
2014-09-24 14:07:58 +02:00
2014-10-24 00:14:36 +02:00
2014-10-15 12:11:00 -04:00
2014-09-30 16:24:56 -04:00
2014-09-30 16:24:56 -04:00
2014-08-26 13:45:56 -04:00
2014-10-07 01:18:12 +02:00
2014-09-13 12:30:26 -04:00
2014-08-08 15:57:26 -07:00
2014-08-08 15:57:31 -07:00
2014-11-05 15:52:45 -05:00
2014-08-08 15:57:24 -07:00
2014-09-23 21:40:48 -07:00
2014-09-25 17:05:12 +02:00
2014-08-08 15:57:22 -07:00
2014-11-28 16:08:16 +01:00
2014-09-16 15:02:55 -06:00