Re: [PATCH] uprobes: mmap_region() corrupts mm->mm_rb if uprobe_mmap() fails

2012-08-03 Thread Srikar Dronamraju
* Oleg Nesterov [2012-07-28 18:31:57]: > https://bugzilla.redhat.com/show_bug.cgi?id=843640 > > If mmap_region()->uprobe_mmap() fails, unmap_and_free_vma path > does unmap_region() but does not remove the soon-to-be-freed vma > from rb tree (actually there are more problems). > > Perhaps we

Re: [PATCH] uprobes: mmap_region() corrupts mm-mm_rb if uprobe_mmap() fails

2012-08-03 Thread Srikar Dronamraju
* Oleg Nesterov o...@redhat.com [2012-07-28 18:31:57]: https://bugzilla.redhat.com/show_bug.cgi?id=843640 If mmap_region()-uprobe_mmap() fails, unmap_and_free_vma path does unmap_region() but does not remove the soon-to-be-freed vma from rb tree (actually there are more problems).

Re: [PATCH] uprobes: mmap_region() corrupts mm->mm_rb if uprobe_mmap() fails

2012-07-31 Thread Oleg Nesterov
On 07/31, Oleg Nesterov wrote: > > OK, so what you suggest for now? > > Please note that it is very trivial to crash the kernel. Just > do something like > > echo "p /bin/true:OFFSET_OF_SYSCALL_INSN" > > /sys/kernel/debug/tracing/uprobe_events > /bin/true Forgot to mention... And

Re: [PATCH] uprobes: mmap_region() corrupts mm->mm_rb if uprobe_mmap() fails

2012-07-31 Thread Oleg Nesterov
On 07/31, Srikar Dronamraju wrote: > > > --- a/kernel/fork.c > > +++ b/kernel/fork.c > > @@ -454,8 +454,8 @@ static int dup_mmap(struct mm_struct *mm, struct > > mm_struct *oldmm) > > if (retval) > > goto out; > > > > - if (file && uprobe_mmap(tmp)) > > -

Re: [PATCH] uprobes: mmap_region() corrupts mm->mm_rb if uprobe_mmap() fails

2012-07-31 Thread Srikar Dronamraju
> > If mmap_region()->uprobe_mmap() fails, unmap_and_free_vma path > does unmap_region() but does not remove the soon-to-be-freed vma > from rb tree (actually there are more problems). > > Perhaps we could do do_munmap() + return in this case, but in fact > it is simply wrong to abort if

Re: [PATCH] uprobes: mmap_region() corrupts mm-mm_rb if uprobe_mmap() fails

2012-07-31 Thread Srikar Dronamraju
If mmap_region()-uprobe_mmap() fails, unmap_and_free_vma path does unmap_region() but does not remove the soon-to-be-freed vma from rb tree (actually there are more problems). Perhaps we could do do_munmap() + return in this case, but in fact it is simply wrong to abort if uprobe_mmap()

Re: [PATCH] uprobes: mmap_region() corrupts mm-mm_rb if uprobe_mmap() fails

2012-07-31 Thread Oleg Nesterov
On 07/31, Srikar Dronamraju wrote: --- a/kernel/fork.c +++ b/kernel/fork.c @@ -454,8 +454,8 @@ static int dup_mmap(struct mm_struct *mm, struct mm_struct *oldmm) if (retval) goto out; - if (file uprobe_mmap(tmp)) -

Re: [PATCH] uprobes: mmap_region() corrupts mm-mm_rb if uprobe_mmap() fails

2012-07-31 Thread Oleg Nesterov
On 07/31, Oleg Nesterov wrote: OK, so what you suggest for now? Please note that it is very trivial to crash the kernel. Just do something like echo p /bin/true:OFFSET_OF_SYSCALL_INSN /sys/kernel/debug/tracing/uprobe_events /bin/true Forgot to mention... And even it it

Re: [PATCH] uprobes: mmap_region() corrupts mm->mm_rb if uprobe_mmap() fails

2012-07-30 Thread William Cohen
On 07/28/2012 12:31 PM, Oleg Nesterov wrote: > https://bugzilla.redhat.com/show_bug.cgi?id=843640 Hi Oleg, I checked the following patch and it does fix the problem on the 3.5.0+ kernel. -Will > > If mmap_region()->uprobe_mmap() fails, unmap_and_free_vma path > does unmap_region() but does

Re: [PATCH] uprobes: mmap_region() corrupts mm-mm_rb if uprobe_mmap() fails

2012-07-30 Thread William Cohen
On 07/28/2012 12:31 PM, Oleg Nesterov wrote: https://bugzilla.redhat.com/show_bug.cgi?id=843640 Hi Oleg, I checked the following patch and it does fix the problem on the 3.5.0+ kernel. -Will If mmap_region()-uprobe_mmap() fails, unmap_and_free_vma path does unmap_region() but does not

Re: [PATCH] uprobes: mmap_region() corrupts mm->mm_rb if uprobe_mmap() fails

2012-07-28 Thread Oleg Nesterov
On 07/28, Oleg Nesterov wrote: > > https://bugzilla.redhat.com/show_bug.cgi?id=843640 > > If mmap_region()->uprobe_mmap() fails, unmap_and_free_vma path > does unmap_region() but does not remove the soon-to-be-freed vma > from rb tree (actually there are more problems). Just in case... Ingo,

[PATCH] uprobes: mmap_region() corrupts mm->mm_rb if uprobe_mmap() fails

2012-07-28 Thread Oleg Nesterov
https://bugzilla.redhat.com/show_bug.cgi?id=843640 If mmap_region()->uprobe_mmap() fails, unmap_and_free_vma path does unmap_region() but does not remove the soon-to-be-freed vma from rb tree (actually there are more problems). Perhaps we could do do_munmap() + return in this case, but in fact

[PATCH] uprobes: mmap_region() corrupts mm-mm_rb if uprobe_mmap() fails

2012-07-28 Thread Oleg Nesterov
https://bugzilla.redhat.com/show_bug.cgi?id=843640 If mmap_region()-uprobe_mmap() fails, unmap_and_free_vma path does unmap_region() but does not remove the soon-to-be-freed vma from rb tree (actually there are more problems). Perhaps we could do do_munmap() + return in this case, but in fact it

Re: [PATCH] uprobes: mmap_region() corrupts mm-mm_rb if uprobe_mmap() fails

2012-07-28 Thread Oleg Nesterov
On 07/28, Oleg Nesterov wrote: https://bugzilla.redhat.com/show_bug.cgi?id=843640 If mmap_region()-uprobe_mmap() fails, unmap_and_free_vma path does unmap_region() but does not remove the soon-to-be-freed vma from rb tree (actually there are more problems). Just in case... Ingo, this is