On Wed, Mar 11, 2020 at 03:45:13PM +0800, qiwuchen55@xxxxxxxxx wrote:
> From: chenqiwu <chenqiwu@xxxxxxxxxx>
>
> When finding all the mapping vmas for an anon page by anon_vma, there
> is a panic risk that one mapping vma or its vm_mm has been released by
> someone.
What? Who would be able to release the VMA or the mm_struct? We hold
anon_vma lock. It doesn't make sense to me. Something else is broken.
> Like the following crash during kswapd reclaiming pages:
>
> Unable to handle kernel NULL pointer dereference at virtual address
> 00000048
> PC is at page_vma_mapped_walk+0x54/0x16c
> LR is at page_referenced_one+0x44/0x140
> [......]
> CPU: 1 PID: 161 Comm: kswapd0
> Call trace:
> [<ffffff9a080832d0>] el1_da+0x24/0x3c
> [<ffffff9a0823ea18>] page_vma_mapped_walk+0x54/0x16c
> [<ffffff9a0823fd8c>] page_referenced_one+0x44/0x140
> [<ffffff9a08240ef0>] rmap_walk_anon+0x124/0x168
> [<ffffff9a0823fcfc>] page_referenced+0x144/0x190
> [<ffffff9a08213e6c>] shrink_active_list+0x25c/0x478
> [<ffffff9a082126c8>] kswapd+0x7b0/0x9c8
> [<ffffff9a080daffc>] kthread+0x154/0x18c
> [<ffffff9a0808563c>] ret_from_fork+0x10/0x18
>
> The PC is pointed to the following code line:
> bool page_vma_mapped_walk(struct page_vma_mapped_walk *pvmw)
> {
> struct mm_struct *mm = pvmw->vma->vm_mm;
> ......
> pgd = pgd_offset(mm, pvmw->address); //PC
> ......
> }
>
> Because the current pvmw->vma->vm_mm is a kernel NULL pointer, which
> causing crash when pgd_offset() dereferences the mm pointer.
>
> This patch fixes the problem by ensuring that both the mapping vma
> and its vm_mm are valid. If not, we just continue to traverse the
> anon_vma->rb_root to avoid the potential junk pointer dereference.
>
> Signed-off-by: chenqiwu <chenqiwu@xxxxxxxxxx>
> ---
> mm/rmap.c | 3 +++
> 1 file changed, 3 insertions(+)
>
> diff --git a/mm/rmap.c b/mm/rmap.c
> index b3e3819..fc42ca2 100644
> --- a/mm/rmap.c
> +++ b/mm/rmap.c
> @@ -1863,6 +1863,9 @@ static void rmap_walk_anon(struct page *page, struct rmap_walk_control *rwc,
> if (rwc->invalid_vma && rwc->invalid_vma(vma, rwc->arg))
> continue;
>
> + if (!vma && !vma->vm_mm)
> + continue;
> +
Even if the premis of the patch is true, 'vma' got used twice in the loop
iteration before you check if it's non-NULL.
> if (!rwc->rmap_one(page, vma, address, rwc->arg))
> break;
> if (rwc->done && rwc->done(page))
> --
> 1.9.1
>
>
--
Kirill A. Shutemov
