Re: mm: use-after-free in collapse_huge_page

2016-09-07 Thread Andrea Arcangeli
On Wed, Sep 07, 2016 at 03:25:59PM +0300, Kirill A. Shutemov wrote: > Here's updated version. > > From 14d748bd8a7eb003efc10b1e5d5b8a644e7181b1 Mon Sep 17 00:00:00 2001 > From: "Kirill A. Shutemov" > Date: Mon, 29 Aug 2016 15:32:50 +0300 > Subject: [PATCH] khugepaged: fix use-after-free in collap

Re: mm: use-after-free in collapse_huge_page

2016-09-07 Thread Kirill A. Shutemov
On Mon, Aug 29, 2016 at 05:35:48PM +0200, Andrea Arcangeli wrote: > Hello Kirill, > > On Mon, Aug 29, 2016 at 03:42:33PM +0300, Kirill A. Shutemov wrote: > > @@ -898,13 +899,13 @@ static bool __collapse_huge_page_swapin(struct > > mm_struct *mm, > > /* do_swap_page returns VM_FAULT_RE

Re: mm: use-after-free in collapse_huge_page

2016-09-02 Thread Ebru Akagunduz
> > @@ -898,13 +899,13 @@ static bool __collapse_huge_page_swapin(struct > mm_struct *mm, > /* do_swap_page returns VM_FAULT_RETRY with released mmap_sem */ > if (ret & VM_FAULT_RETRY) { > down_read(&mm->mmap_sem); > - if (hug

Re: mm: use-after-free in collapse_huge_page

2016-08-29 Thread Andrea Arcangeli
Hello Kirill, On Mon, Aug 29, 2016 at 03:42:33PM +0300, Kirill A. Shutemov wrote: > @@ -898,13 +899,13 @@ static bool __collapse_huge_page_swapin(struct > mm_struct *mm, > /* do_swap_page returns VM_FAULT_RETRY with released mmap_sem */ > if (ret & VM_FAULT_RETRY) { >

Re: mm: use-after-free in collapse_huge_page

2016-08-29 Thread Kirill A. Shutemov
On Sun, Aug 28, 2016 at 12:42:21PM +0200, Dmitry Vyukov wrote: > Hello, > > I've git the following use-after-free in collapse_huge_page while > running syzkaller fuzzer. It is in khugepaged, so not reproducible. On > commit 61c04572de404e52a655a36752e696bbcb483cf5 (Aug 25). > > ==

mm: use-after-free in collapse_huge_page

2016-08-28 Thread Dmitry Vyukov
Hello, I've git the following use-after-free in collapse_huge_page while running syzkaller fuzzer. It is in khugepaged, so not reproducible. On commit 61c04572de404e52a655a36752e696bbcb483cf5 (Aug 25). == BUG: KASAN: use-after-free i