Re: mm: compaction: buffer overflow in isolate_migratepages_range

2014-08-14 Thread Rafael Aquini
On Fri, Aug 15, 2014 at 07:36:16AM +0400, Konstantin Khlebnikov wrote: > Don't hurry. The code in this state for years. > I'm working on patches for this, if everything goes well I'll show it today. > As usual I couldn't stop myself from cleaning the mess, so it will be > bigger than yours. >

Re: mm: compaction: buffer overflow in isolate_migratepages_range

2014-08-14 Thread Rafael Aquini
Here's a potential final version for the patch mentioned in a earlier message. The nitpick I raised to myself and a couple of other minor typing issues are fixed. I did a preliminary testround, in a KVM guest ballooning in and out memory by chunks of 1GB while a script within the guest was

Re: mm: compaction: buffer overflow in isolate_migratepages_range

2014-08-14 Thread Konstantin Khlebnikov
On Fri, Aug 15, 2014 at 2:07 AM, Rafael Aquini wrote: > On Thu, Aug 14, 2014 at 06:43:50PM -0300, Rafael Aquini wrote: >> On Thu, Aug 14, 2014 at 10:07:40PM +0400, Andrey Ryabinin wrote: >> > We discussed this with Konstantin and he suggested a better solution for >> > this. >> > If I understood

Re: mm: compaction: buffer overflow in isolate_migratepages_range

2014-08-14 Thread Rafael Aquini
On Thu, Aug 14, 2014 at 06:43:50PM -0300, Rafael Aquini wrote: > On Thu, Aug 14, 2014 at 10:07:40PM +0400, Andrey Ryabinin wrote: > > We discussed this with Konstantin and he suggested a better solution for > > this. > > If I understood him correctly the main idea was to store bit > > identifying

Re: mm: compaction: buffer overflow in isolate_migratepages_range

2014-08-14 Thread Rafael Aquini
On Thu, Aug 14, 2014 at 10:07:40PM +0400, Andrey Ryabinin wrote: > We discussed this with Konstantin and he suggested a better solution for this. > If I understood him correctly the main idea was to store bit > identifying ballon page > in struct page (special value in _mapcount), so we won't need

Re: mm: compaction: buffer overflow in isolate_migratepages_range

2014-08-14 Thread Rafael Aquini
On Thu, Aug 14, 2014 at 10:07:40PM +0400, Andrey Ryabinin wrote: > 2014-08-14 19:13 GMT+04:00 Rafael Aquini : > > It still a harmless condition as before, but considering what goes above > > I'm now convinced & confident the patch proposed by Andrey is the real fix > > for such occurrences. > > >

Re: mm: compaction: buffer overflow in isolate_migratepages_range

2014-08-14 Thread Andrey Ryabinin
2014-08-14 19:13 GMT+04:00 Rafael Aquini : >> Yeah, it happens because I failed to anticipate a race window opening where >> balloon_page_movable() can stumble across an anon page being released -- >> somewhere in the midway of __page_cache_release() & free_pages_prepare() >> down on the

Re: mm: compaction: buffer overflow in isolate_migratepages_range

2014-08-14 Thread Rafael Aquini
On Wed, Aug 13, 2014 at 12:35:02PM -0300, Rafael Aquini wrote: > On Sun, Aug 10, 2014 at 12:49:47PM +0400, Andrey Ryabinin wrote: > > 2014-08-10 5:45 GMT+04:00 Sasha Levin : > > > Hi all, > > > > > > While fuzzing with trinity inside a KVM tools guest running the latest > > > -next > > > kernel

Re: mm: compaction: buffer overflow in isolate_migratepages_range

2014-08-14 Thread Rafael Aquini
On Wed, Aug 13, 2014 at 12:35:02PM -0300, Rafael Aquini wrote: On Sun, Aug 10, 2014 at 12:49:47PM +0400, Andrey Ryabinin wrote: 2014-08-10 5:45 GMT+04:00 Sasha Levin sasha.le...@oracle.com: Hi all, While fuzzing with trinity inside a KVM tools guest running the latest -next

Re: mm: compaction: buffer overflow in isolate_migratepages_range

2014-08-14 Thread Andrey Ryabinin
2014-08-14 19:13 GMT+04:00 Rafael Aquini aqu...@redhat.com: Yeah, it happens because I failed to anticipate a race window opening where balloon_page_movable() can stumble across an anon page being released -- somewhere in the midway of __page_cache_release() free_pages_prepare() down on the

Re: mm: compaction: buffer overflow in isolate_migratepages_range

2014-08-14 Thread Rafael Aquini
On Thu, Aug 14, 2014 at 10:07:40PM +0400, Andrey Ryabinin wrote: 2014-08-14 19:13 GMT+04:00 Rafael Aquini aqu...@redhat.com: It still a harmless condition as before, but considering what goes above I'm now convinced confident the patch proposed by Andrey is the real fix for such

Re: mm: compaction: buffer overflow in isolate_migratepages_range

2014-08-14 Thread Rafael Aquini
On Thu, Aug 14, 2014 at 10:07:40PM +0400, Andrey Ryabinin wrote: We discussed this with Konstantin and he suggested a better solution for this. If I understood him correctly the main idea was to store bit identifying ballon page in struct page (special value in _mapcount), so we won't need to

Re: mm: compaction: buffer overflow in isolate_migratepages_range

2014-08-14 Thread Rafael Aquini
On Thu, Aug 14, 2014 at 06:43:50PM -0300, Rafael Aquini wrote: On Thu, Aug 14, 2014 at 10:07:40PM +0400, Andrey Ryabinin wrote: We discussed this with Konstantin and he suggested a better solution for this. If I understood him correctly the main idea was to store bit identifying ballon

Re: mm: compaction: buffer overflow in isolate_migratepages_range

2014-08-14 Thread Konstantin Khlebnikov
On Fri, Aug 15, 2014 at 2:07 AM, Rafael Aquini aqu...@redhat.com wrote: On Thu, Aug 14, 2014 at 06:43:50PM -0300, Rafael Aquini wrote: On Thu, Aug 14, 2014 at 10:07:40PM +0400, Andrey Ryabinin wrote: We discussed this with Konstantin and he suggested a better solution for this. If I

Re: mm: compaction: buffer overflow in isolate_migratepages_range

2014-08-14 Thread Rafael Aquini
Here's a potential final version for the patch mentioned in a earlier message. The nitpick I raised to myself and a couple of other minor typing issues are fixed. I did a preliminary testround, in a KVM guest ballooning in and out memory by chunks of 1GB while a script within the guest was

Re: mm: compaction: buffer overflow in isolate_migratepages_range

2014-08-14 Thread Rafael Aquini
On Fri, Aug 15, 2014 at 07:36:16AM +0400, Konstantin Khlebnikov wrote: Don't hurry. The code in this state for years. I'm working on patches for this, if everything goes well I'll show it today. As usual I couldn't stop myself from cleaning the mess, so it will be bigger than yours. Sorry, I

Re: mm: compaction: buffer overflow in isolate_migratepages_range

2014-08-13 Thread Rafael Aquini
On Sun, Aug 10, 2014 at 12:49:47PM +0400, Andrey Ryabinin wrote: > 2014-08-10 5:45 GMT+04:00 Sasha Levin : > > Hi all, > > > > While fuzzing with trinity inside a KVM tools guest running the latest -next > > kernel with the KASAN patchset, I've stumbled on the following spew: > > > > > > [

Re: mm: compaction: buffer overflow in isolate_migratepages_range

2014-08-13 Thread Rafael Aquini
On Sun, Aug 10, 2014 at 12:49:47PM +0400, Andrey Ryabinin wrote: 2014-08-10 5:45 GMT+04:00 Sasha Levin sasha.le...@oracle.com: Hi all, While fuzzing with trinity inside a KVM tools guest running the latest -next kernel with the KASAN patchset, I've stumbled on the following spew: [

Re: mm: compaction: buffer overflow in isolate_migratepages_range

2014-08-10 Thread Andrey Ryabinin
2014-08-10 5:45 GMT+04:00 Sasha Levin : > Hi all, > > While fuzzing with trinity inside a KVM tools guest running the latest -next > kernel with the KASAN patchset, I've stumbled on the following spew: > > > [ 3837.070452] > == > [

Re: mm: compaction: buffer overflow in isolate_migratepages_range

2014-08-10 Thread Andrey Ryabinin
2014-08-10 5:45 GMT+04:00 Sasha Levin sasha.le...@oracle.com: Hi all, While fuzzing with trinity inside a KVM tools guest running the latest -next kernel with the KASAN patchset, I've stumbled on the following spew: [ 3837.070452]

mm: compaction: buffer overflow in isolate_migratepages_range

2014-08-09 Thread Sasha Levin
Hi all, While fuzzing with trinity inside a KVM tools guest running the latest -next kernel with the KASAN patchset, I've stumbled on the following spew: [ 3837.070452] == [ 3837.073101] AddressSanitizer: buffer overflow in

mm: compaction: buffer overflow in isolate_migratepages_range

2014-08-09 Thread Sasha Levin
Hi all, While fuzzing with trinity inside a KVM tools guest running the latest -next kernel with the KASAN patchset, I've stumbled on the following spew: [ 3837.070452] == [ 3837.073101] AddressSanitizer: buffer overflow in