Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1232160 > unrolled thread

[PATCH 16/16] mm: sanitize page->mapping for tail pages

Back to article view | Back to linux.kernel

This discussion starts older than the indexed window; earlier articles aren't shown. The article labeled Started by below is the oldest one visible, not the original post.

Contents

  [PATCH 16/16] mm: sanitize page->mapping for tail pages "Kirill A. Shutemov" <kirill.shutemov@linux.intel.com> - 2015-09-24 17:00 +0200
    Re: [PATCH 16/16] mm: sanitize page->mapping for tail pages Jerome Glisse <j.glisse@gmail.com> - 2015-09-25 04:30 +0200

#1232160 — [PATCH 16/16] mm: sanitize page->mapping for tail pages

We don't define meaning of page->mapping for tail pages.  Currently it's
always NULL, which can be inconsistent with head page and potentially lead
to problems.

Let's poison the pointer to catch all illigal uses.

page_rmapping(), page_mapping() and page_anon_vma() are changed to look on
head page.

The only illegal use I've caught so far is __GPF_COMP pages from sound
subsystem, mapped with PTEs.  do_shared_fault() is changed to use
page_rmapping() instead of direct access to fault_page->mapping.

Signed-off-by: Kirill A. Shutemov <kirill.shutemov@linux.intel.com>
---
 include/linux/poison.h |  4 ++++
 mm/huge_memory.c       |  2 +-
 mm/memory.c            |  2 +-
 mm/page_alloc.c        |  6 ++++++
 mm/util.c              | 10 ++++++----
 5 files changed, 18 insertions(+), 6 deletions(-)

diff --git a/include/linux/poison.h b/include/linux/poison.h
index 317e16de09e5..76c3b6c38c16 100644
--- a/include/linux/poison.h
+++ b/include/linux/poison.h
@@ -32,6 +32,10 @@
 /********** mm/debug-pagealloc.c **********/
 #define PAGE_POISON 0xaa
 
+/********** mm/page_alloc.c ************/
+
+#define TAIL_MAPPING	((void *) 0x01014A11 + POISON_POINTER_DELTA)
+
 /********** mm/slab.c **********/
 /*
  * Magic nums for obj red zoning.
diff --git a/mm/huge_memory.c b/mm/huge_memory.c
index 244c852d565c..65ab7858bbcc 100644
--- a/mm/huge_memory.c
+++ b/mm/huge_memory.c
@@ -1836,7 +1836,7 @@ static void __split_huge_page_refcount(struct page *page,
 		*/
 		page_tail->_mapcount = page->_mapcount;
 
-		BUG_ON(page_tail->mapping);
+		BUG_ON(page_tail->mapping != TAIL_MAPPING);
 		page_tail->mapping = page->mapping;
 
 		page_tail->index = page->index + i;
diff --git a/mm/memory.c b/mm/memory.c
index caecc64301e9..3bd465a6fa0d 100644
--- a/mm/memory.c
+++ b/mm/memory.c
@@ -3087,7 +3087,7 @@ static int do_shared_fault(struct mm_struct *mm, struct vm_area_struct *vma,
 	 * pinned by vma->vm_file's reference.  We rely on unlock_page()'s
 	 * release semantics to prevent the compiler from undoing this copying.
 	 */
-	mapping = fault_page->mapping;
+	mapping = page_rmapping(fault_page);
 	unlock_page(fault_page);
 	if ((dirtied || vma->vm_ops->page_mkwrite) && mapping) {
 		/*
diff --git a/mm/page_alloc.c b/mm/page_alloc.c
index 321a91747949..9bcfd70b1eb8 100644
--- a/mm/page_alloc.c
+++ b/mm/page_alloc.c
@@ -473,6 +473,7 @@ void prep_compound_page(struct page *page, unsigned int order)
 	for (i = 1; i < nr_pages; i++) {
 		struct page *p = page + i;
 		set_page_count(p, 0);
+		p->mapping = TAIL_MAPPING;
 		set_compound_head(p, page);
 	}
 }
@@ -864,6 +865,10 @@ static int free_tail_pages_check(struct page *head_page, struct page *page)
 		ret = 0;
 		goto out;
 	}
+	if (page->mapping != TAIL_MAPPING) {
+		bad_page(page, "corrupted mapping in tail page", 0);
+		goto out;
+	}
 	if (unlikely(!PageTail(page))) {
 		bad_page(page, "PageTail not set", 0);
 		goto out;
@@ -874,6 +879,7 @@ static int free_tail_pages_check(struct page *head_page, struct page *page)
 	}
 	ret = 0;
 out:
+	page->mapping = NULL;
 	clear_compound_head(page);
 	return ret;
 }
diff --git a/mm/util.c b/mm/util.c
index 9af1c12b310c..902b65a43899 100644
--- a/mm/util.c
+++ b/mm/util.c
@@ -355,7 +355,9 @@ struct anon_vma *page_anon_vma(struct page *page)
 
 struct address_space *page_mapping(struct page *page)
 {
-	unsigned long mapping;
+	struct address_space *mapping;
+
+	page = compound_head(page);
 
 	/* This happens if someone calls flush_dcache_page on slab page */
 	if (unlikely(PageSlab(page)))
@@ -368,10 +370,10 @@ struct address_space *page_mapping(struct page *page)
 		return swap_address_space(entry);
 	}
 
-	mapping = (unsigned long)page->mapping;
-	if (mapping & PAGE_MAPPING_FLAGS)
+	mapping = page->mapping;
+	if ((unsigned long)mapping & PAGE_MAPPING_FLAGS)
 		return NULL;
-	return page->mapping;
+	return mapping;
 }
 
 int overcommit_ratio_handler(struct ctl_table *table, int write,
-- 
2.5.1

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[toc] | [next] | [standalone]

#1232540

On Thu, Sep 24, 2015 at 05:51:04PM +0300, Kirill A. Shutemov wrote:
> We don't define meaning of page->mapping for tail pages.  Currently it's
> always NULL, which can be inconsistent with head page and potentially lead
> to problems.
> 
> Let's poison the pointer to catch all illigal uses.
> 
> page_rmapping(), page_mapping() and page_anon_vma() are changed to look on
> head page.
> 
> The only illegal use I've caught so far is __GPF_COMP pages from sound
> subsystem, mapped with PTEs.  do_shared_fault() is changed to use
> page_rmapping() instead of direct access to fault_page->mapping.
> 
> Signed-off-by: Kirill A. Shutemov <kirill.shutemov@linux.intel.com>


Just a nitpick but page_rmapping() is already using compound_head() and
thus commit message is missleading. I was expecting to see some changes
to page_rmapping(). Anyway:

Reviewed-by: Jérôme Glisse <jglisse@redhat.com>


> ---
>  include/linux/poison.h |  4 ++++
>  mm/huge_memory.c       |  2 +-
>  mm/memory.c            |  2 +-
>  mm/page_alloc.c        |  6 ++++++
>  mm/util.c              | 10 ++++++----
>  5 files changed, 18 insertions(+), 6 deletions(-)
> 
> diff --git a/include/linux/poison.h b/include/linux/poison.h
> index 317e16de09e5..76c3b6c38c16 100644
> --- a/include/linux/poison.h
> +++ b/include/linux/poison.h
> @@ -32,6 +32,10 @@
>  /********** mm/debug-pagealloc.c **********/
>  #define PAGE_POISON 0xaa
>  
> +/********** mm/page_alloc.c ************/
> +
> +#define TAIL_MAPPING	((void *) 0x01014A11 + POISON_POINTER_DELTA)
> +
>  /********** mm/slab.c **********/
>  /*
>   * Magic nums for obj red zoning.
> diff --git a/mm/huge_memory.c b/mm/huge_memory.c
> index 244c852d565c..65ab7858bbcc 100644
> --- a/mm/huge_memory.c
> +++ b/mm/huge_memory.c
> @@ -1836,7 +1836,7 @@ static void __split_huge_page_refcount(struct page *page,
>  		*/
>  		page_tail->_mapcount = page->_mapcount;
>  
> -		BUG_ON(page_tail->mapping);
> +		BUG_ON(page_tail->mapping != TAIL_MAPPING);
>  		page_tail->mapping = page->mapping;
>  
>  		page_tail->index = page->index + i;
> diff --git a/mm/memory.c b/mm/memory.c
> index caecc64301e9..3bd465a6fa0d 100644
> --- a/mm/memory.c
> +++ b/mm/memory.c
> @@ -3087,7 +3087,7 @@ static int do_shared_fault(struct mm_struct *mm, struct vm_area_struct *vma,
>  	 * pinned by vma->vm_file's reference.  We rely on unlock_page()'s
>  	 * release semantics to prevent the compiler from undoing this copying.
>  	 */
> -	mapping = fault_page->mapping;
> +	mapping = page_rmapping(fault_page);
>  	unlock_page(fault_page);
>  	if ((dirtied || vma->vm_ops->page_mkwrite) && mapping) {
>  		/*
> diff --git a/mm/page_alloc.c b/mm/page_alloc.c
> index 321a91747949..9bcfd70b1eb8 100644
> --- a/mm/page_alloc.c
> +++ b/mm/page_alloc.c
> @@ -473,6 +473,7 @@ void prep_compound_page(struct page *page, unsigned int order)
>  	for (i = 1; i < nr_pages; i++) {
>  		struct page *p = page + i;
>  		set_page_count(p, 0);
> +		p->mapping = TAIL_MAPPING;
>  		set_compound_head(p, page);
>  	}
>  }
> @@ -864,6 +865,10 @@ static int free_tail_pages_check(struct page *head_page, struct page *page)
>  		ret = 0;
>  		goto out;
>  	}
> +	if (page->mapping != TAIL_MAPPING) {
> +		bad_page(page, "corrupted mapping in tail page", 0);
> +		goto out;
> +	}
>  	if (unlikely(!PageTail(page))) {
>  		bad_page(page, "PageTail not set", 0);
>  		goto out;
> @@ -874,6 +879,7 @@ static int free_tail_pages_check(struct page *head_page, struct page *page)
>  	}
>  	ret = 0;
>  out:
> +	page->mapping = NULL;
>  	clear_compound_head(page);
>  	return ret;
>  }
> diff --git a/mm/util.c b/mm/util.c
> index 9af1c12b310c..902b65a43899 100644
> --- a/mm/util.c
> +++ b/mm/util.c
> @@ -355,7 +355,9 @@ struct anon_vma *page_anon_vma(struct page *page)
>  
>  struct address_space *page_mapping(struct page *page)
>  {
> -	unsigned long mapping;
> +	struct address_space *mapping;
> +
> +	page = compound_head(page);
>  
>  	/* This happens if someone calls flush_dcache_page on slab page */
>  	if (unlikely(PageSlab(page)))
> @@ -368,10 +370,10 @@ struct address_space *page_mapping(struct page *page)
>  		return swap_address_space(entry);
>  	}
>  
> -	mapping = (unsigned long)page->mapping;
> -	if (mapping & PAGE_MAPPING_FLAGS)
> +	mapping = page->mapping;
> +	if ((unsigned long)mapping & PAGE_MAPPING_FLAGS)
>  		return NULL;
> -	return page->mapping;
> +	return mapping;
>  }
>  
>  int overcommit_ratio_handler(struct ctl_table *table, int write,
> -- 
> 2.5.1
> 
> --
> To unsubscribe, send a message with 'unsubscribe linux-mm' in
> the body to majordomo@kvack.org.  For more info on Linux MM,
> see: http://www.linux-mm.org/ .
> Don't email: <a href=mailto:"dont@kvack.org"> email@kvack.org </a>
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[toc] | [prev] | [standalone]

Back to top | Article view | linux.kernel

csiph-web