> On Aug 23, 2022, at 22:47, Kefeng Wang <wangkefeng.wang@xxxxxxxxxx> wrote:
>
>
> On 2022/8/23 9:07, Kefeng Wang wrote:
>>
>> On 2022/8/21 4:59, Andrew Morton wrote:
>>> On Sat, 20 Aug 2022 15:33:04 +0800 Muchun Song <muchun.song@xxxxxxxxx> wrote:
>>>
>>>>
>>>>> + if (IS_ERR(t)) {
>>>>> /* failure at boot is fatal */
>>>>> BUG_ON(system_state < SYSTEM_RUNNING);
>>>>> pr_err("Failed to start kswapd on node %d\n", nid);
>>>>> - pgdat->kswapd = NULL;
>>>>> + WRITE_ONCE(pgdat->kswapd, NULL);
>>>>> + } else {
>>>>> + WRITE_ONCE(pgdat->kswapd, t);
>>>>> }
>>>>> }
>>>> IIUC, the race is like the followings:
>>>>
>>>> CPU 0: CPU 1:
>>>>
>>>> kswapd_run()
>>>> pgdat->kswapd = kthread_run()
>>>> if (IS_ERR(pgdat->kswapd))
>>>> kswapd_is_running
>>>> // load pgdat->kswapd and it is NOT NULL.
>>>> pgdat->kswapd = NULL
>>>> task_is_running(pgdat->kswapd); // NULL pointer dereference
>>>>
>>> But don't we still have a bug? Sure, kswapd_is_running() will no
>>> longer deref a null pointer. But it now runs kswapd_is_running()
>>> against a task which has exited - a use-after-free?
>
> The UAF is caused by race between kswapd_stop() and kcompactd(), right?
>
> so kcompactd() should be stop before kswapd_stop() to avoid the above UAF.
>
> $ git diff
> diff --git a/mm/memory_hotplug.c b/mm/memory_hotplug.c
> index fad6d1f2262a..2fd45ccbce45 100644
> --- a/mm/memory_hotplug.c
> +++ b/mm/memory_hotplug.c
> @@ -1940,8 +1940,8 @@ int __ref offline_pages(unsigned long start_pfn, unsigned long nr_pages,
>
> node_states_clear_node(node, &arg);
> if (arg.status_change_nid >= 0) {
> - kswapd_stop(node);
> kcompactd_stop(node);
> + kswapd_stop(node);
> }
>
> writeback_set_ratelimit();
The changes make sense to me. Again:
Reviewed-by: Muchun Song <songmuchun@xxxxxxxxxxxxx>
Thanks.
>
>> we could add get/put_task_struct() to avoid the UAF， will update， thanks.
>
> sorry, the task refcount won't fix anything.
>
>
>> .
