* [PATCH] mm/khugepaged: Fix invalid page access in release_pte_pages()
@ 2023-02-13 21:43 ` Vishal Moola (Oracle)
2023-02-13 22:56 ` Marek Szyprowski
` (2 more replies)
0 siblings, 3 replies; 5+ messages in thread
From: Vishal Moola (Oracle) @ 2023-02-13 21:43 UTC (permalink / raw)
To: akpm; +Cc: willy, m.szyprowski, alex, linux-mm, Vishal Moola (Oracle)
release_pte_pages() converts from a pfn to a folio by using pfn_folio().
If the pte is not mapped, pfn_folio() will result in undefined behavior
which ends up causing a kernel panic[1].
Only call pfn_folio() once we have validated that the pte is both valid
and mapped to fix the issue.
[1] https://lore.kernel.org/linux-mm/ff300770-afe9-908d-23ed-d23e0796e899@samsung.com/
Fixes: 9bdfeea46f49 ("mm/khugepaged: convert release_pte_pages() to use folios")
Reported-by: Marek Szyprowski <m.szyprowski@samsung.com>
Debugged-by: Alexandre Ghiti <alex@ghiti.fr>
Cc: Matthew Wilcox <willy@infradead.org>
Signed-off-by: Vishal Moola (Oracle) <vishal.moola@gmail.com>
---
mm/khugepaged.c | 14 ++++++++++----
1 file changed, 10 insertions(+), 4 deletions(-)
diff --git a/mm/khugepaged.c b/mm/khugepaged.c
index b39ab219d5b7..bd54b957f69a 100644
--- a/mm/khugepaged.c
+++ b/mm/khugepaged.c
@@ -511,11 +511,17 @@ static void release_pte_pages(pte_t *pte, pte_t *_pte,
while (--_pte >= pte) {
pte_t pteval = *_pte;
+ unsigned long pfn;
- folio = pfn_folio(pte_pfn(pteval));
- if (!pte_none(pteval) && !is_zero_pfn(pte_pfn(pteval)) &&
- !folio_test_large(folio))
- release_pte_folio(folio);
+ if (pte_none(pteval))
+ continue;
+ pfn = pte_pfn(pteval);
+ if (is_zero_pfn(pfn))
+ continue;
+ folio = pfn_folio(pfn);
+ if (folio_test_large(folio))
+ continue;
+ release_pte_folio(folio);
}
list_for_each_entry_safe(folio, tmp, compound_pagelist, lru) {
--
2.39.1
^ permalink raw reply related [flat|nested] 5+ messages in thread
* Re: [PATCH] mm/khugepaged: Fix invalid page access in release_pte_pages()
2023-02-13 21:43 ` [PATCH] mm/khugepaged: Fix invalid page access in release_pte_pages() Vishal Moola (Oracle)
@ 2023-02-13 22:56 ` Marek Szyprowski
2023-02-14 8:04 ` Alexandre Ghiti
2023-02-14 12:06 ` David Hildenbrand
2023-02-14 17:25 ` Yang Shi
2 siblings, 1 reply; 5+ messages in thread
From: Marek Szyprowski @ 2023-02-13 22:56 UTC (permalink / raw)
To: Vishal Moola (Oracle), akpm; +Cc: willy, alex, linux-mm
On 13.02.2023 22:43, Vishal Moola (Oracle) wrote:
> release_pte_pages() converts from a pfn to a folio by using pfn_folio().
> If the pte is not mapped, pfn_folio() will result in undefined behavior
> which ends up causing a kernel panic[1].
>
> Only call pfn_folio() once we have validated that the pte is both valid
> and mapped to fix the issue.
>
> [1] https://lore.kernel.org/linux-mm/ff300770-afe9-908d-23ed-d23e0796e899@samsung.com/
>
> Fixes: 9bdfeea46f49 ("mm/khugepaged: convert release_pte_pages() to use folios")
> Reported-by: Marek Szyprowski <m.szyprowski@samsung.com>
> Debugged-by: Alexandre Ghiti <alex@ghiti.fr>
> Cc: Matthew Wilcox <willy@infradead.org>
> Signed-off-by: Vishal Moola (Oracle) <vishal.moola@gmail.com>
Tested-by: Marek Szyprowski <m.szyprowski@samsung.com>
> ---
> mm/khugepaged.c | 14 ++++++++++----
> 1 file changed, 10 insertions(+), 4 deletions(-)
>
> diff --git a/mm/khugepaged.c b/mm/khugepaged.c
> index b39ab219d5b7..bd54b957f69a 100644
> --- a/mm/khugepaged.c
> +++ b/mm/khugepaged.c
> @@ -511,11 +511,17 @@ static void release_pte_pages(pte_t *pte, pte_t *_pte,
>
> while (--_pte >= pte) {
> pte_t pteval = *_pte;
> + unsigned long pfn;
>
> - folio = pfn_folio(pte_pfn(pteval));
> - if (!pte_none(pteval) && !is_zero_pfn(pte_pfn(pteval)) &&
> - !folio_test_large(folio))
> - release_pte_folio(folio);
> + if (pte_none(pteval))
> + continue;
> + pfn = pte_pfn(pteval);
> + if (is_zero_pfn(pfn))
> + continue;
> + folio = pfn_folio(pfn);
> + if (folio_test_large(folio))
> + continue;
> + release_pte_folio(folio);
> }
>
> list_for_each_entry_safe(folio, tmp, compound_pagelist, lru) {
Best regards
--
Marek Szyprowski, PhD
Samsung R&D Institute Poland
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [PATCH] mm/khugepaged: Fix invalid page access in release_pte_pages()
2023-02-13 22:56 ` Marek Szyprowski
@ 2023-02-14 8:04 ` Alexandre Ghiti
0 siblings, 0 replies; 5+ messages in thread
From: Alexandre Ghiti @ 2023-02-14 8:04 UTC (permalink / raw)
To: Marek Szyprowski, Vishal Moola (Oracle), akpm; +Cc: willy, linux-mm
On 2/13/23 23:56, Marek Szyprowski wrote:
> On 13.02.2023 22:43, Vishal Moola (Oracle) wrote:
>> release_pte_pages() converts from a pfn to a folio by using pfn_folio().
>> If the pte is not mapped, pfn_folio() will result in undefined behavior
>> which ends up causing a kernel panic[1].
>>
>> Only call pfn_folio() once we have validated that the pte is both valid
>> and mapped to fix the issue.
>>
>> [1] https://lore.kernel.org/linux-mm/ff300770-afe9-908d-23ed-d23e0796e899@samsung.com/
>>
>> Fixes: 9bdfeea46f49 ("mm/khugepaged: convert release_pte_pages() to use folios")
>> Reported-by: Marek Szyprowski <m.szyprowski@samsung.com>
>> Debugged-by: Alexandre Ghiti <alex@ghiti.fr>
>> Cc: Matthew Wilcox <willy@infradead.org>
>> Signed-off-by: Vishal Moola (Oracle) <vishal.moola@gmail.com>
> Tested-by: Marek Szyprowski <m.szyprowski@samsung.com>
Reviewed-by: Alexandre Ghiti <alexghiti@rivosinc.com>
Tested-by: Alexandre Ghiti <alexghiti@rivosinc.com>
Thanks!
Alex
>
>> ---
>> mm/khugepaged.c | 14 ++++++++++----
>> 1 file changed, 10 insertions(+), 4 deletions(-)
>>
>> diff --git a/mm/khugepaged.c b/mm/khugepaged.c
>> index b39ab219d5b7..bd54b957f69a 100644
>> --- a/mm/khugepaged.c
>> +++ b/mm/khugepaged.c
>> @@ -511,11 +511,17 @@ static void release_pte_pages(pte_t *pte, pte_t *_pte,
>>
>> while (--_pte >= pte) {
>> pte_t pteval = *_pte;
>> + unsigned long pfn;
>>
>> - folio = pfn_folio(pte_pfn(pteval));
>> - if (!pte_none(pteval) && !is_zero_pfn(pte_pfn(pteval)) &&
>> - !folio_test_large(folio))
>> - release_pte_folio(folio);
>> + if (pte_none(pteval))
>> + continue;
>> + pfn = pte_pfn(pteval);
>> + if (is_zero_pfn(pfn))
>> + continue;
>> + folio = pfn_folio(pfn);
>> + if (folio_test_large(folio))
>> + continue;
>> + release_pte_folio(folio);
>> }
>>
>> list_for_each_entry_safe(folio, tmp, compound_pagelist, lru) {
> Best regards
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [PATCH] mm/khugepaged: Fix invalid page access in release_pte_pages()
2023-02-13 21:43 ` [PATCH] mm/khugepaged: Fix invalid page access in release_pte_pages() Vishal Moola (Oracle)
2023-02-13 22:56 ` Marek Szyprowski
@ 2023-02-14 12:06 ` David Hildenbrand
2023-02-14 17:25 ` Yang Shi
2 siblings, 0 replies; 5+ messages in thread
From: David Hildenbrand @ 2023-02-14 12:06 UTC (permalink / raw)
To: Vishal Moola (Oracle), akpm; +Cc: willy, m.szyprowski, alex, linux-mm
On 13.02.23 22:43, Vishal Moola (Oracle) wrote:
> release_pte_pages() converts from a pfn to a folio by using pfn_folio().
> If the pte is not mapped, pfn_folio() will result in undefined behavior
> which ends up causing a kernel panic[1].
>
> Only call pfn_folio() once we have validated that the pte is both valid
> and mapped to fix the issue.
>
> [1] https://lore.kernel.org/linux-mm/ff300770-afe9-908d-23ed-d23e0796e899@samsung.com/
>
> Fixes: 9bdfeea46f49 ("mm/khugepaged: convert release_pte_pages() to use folios")
> Reported-by: Marek Szyprowski <m.szyprowski@samsung.com>
> Debugged-by: Alexandre Ghiti <alex@ghiti.fr>
> Cc: Matthew Wilcox <willy@infradead.org>
> Signed-off-by: Vishal Moola (Oracle) <vishal.moola@gmail.com>
> ---
> mm/khugepaged.c | 14 ++++++++++----
> 1 file changed, 10 insertions(+), 4 deletions(-)
>
> diff --git a/mm/khugepaged.c b/mm/khugepaged.c
> index b39ab219d5b7..bd54b957f69a 100644
> --- a/mm/khugepaged.c
> +++ b/mm/khugepaged.c
> @@ -511,11 +511,17 @@ static void release_pte_pages(pte_t *pte, pte_t *_pte,
>
> while (--_pte >= pte) {
> pte_t pteval = *_pte;
> + unsigned long pfn;
>
> - folio = pfn_folio(pte_pfn(pteval));
> - if (!pte_none(pteval) && !is_zero_pfn(pte_pfn(pteval)) &&
> - !folio_test_large(folio))
> - release_pte_folio(folio);
> + if (pte_none(pteval))
> + continue;
> + pfn = pte_pfn(pteval);
> + if (is_zero_pfn(pfn))
> + continue;
> + folio = pfn_folio(pfn);
> + if (folio_test_large(folio))
> + continue;
> + release_pte_folio(folio);
> }
>
> list_for_each_entry_safe(folio, tmp, compound_pagelist, lru) {
Reviewed-by: David Hildenbrand <david@redhat.com>
--
Thanks,
David / dhildenb
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [PATCH] mm/khugepaged: Fix invalid page access in release_pte_pages()
2023-02-13 21:43 ` [PATCH] mm/khugepaged: Fix invalid page access in release_pte_pages() Vishal Moola (Oracle)
2023-02-13 22:56 ` Marek Szyprowski
2023-02-14 12:06 ` David Hildenbrand
@ 2023-02-14 17:25 ` Yang Shi
2 siblings, 0 replies; 5+ messages in thread
From: Yang Shi @ 2023-02-14 17:25 UTC (permalink / raw)
To: Vishal Moola (Oracle); +Cc: akpm, willy, m.szyprowski, alex, linux-mm
On Mon, Feb 13, 2023 at 1:44 PM Vishal Moola (Oracle)
<vishal.moola@gmail.com> wrote:
>
> release_pte_pages() converts from a pfn to a folio by using pfn_folio().
> If the pte is not mapped, pfn_folio() will result in undefined behavior
> which ends up causing a kernel panic[1].
>
> Only call pfn_folio() once we have validated that the pte is both valid
> and mapped to fix the issue.
>
> [1] https://lore.kernel.org/linux-mm/ff300770-afe9-908d-23ed-d23e0796e899@samsung.com/
>
> Fixes: 9bdfeea46f49 ("mm/khugepaged: convert release_pte_pages() to use folios")
> Reported-by: Marek Szyprowski <m.szyprowski@samsung.com>
> Debugged-by: Alexandre Ghiti <alex@ghiti.fr>
> Cc: Matthew Wilcox <willy@infradead.org>
> Signed-off-by: Vishal Moola (Oracle) <vishal.moola@gmail.com>
Reviewed-by: Yang Shi <shy828301@gmail.com>
Shall cc to stable?
> ---
> mm/khugepaged.c | 14 ++++++++++----
> 1 file changed, 10 insertions(+), 4 deletions(-)
>
> diff --git a/mm/khugepaged.c b/mm/khugepaged.c
> index b39ab219d5b7..bd54b957f69a 100644
> --- a/mm/khugepaged.c
> +++ b/mm/khugepaged.c
> @@ -511,11 +511,17 @@ static void release_pte_pages(pte_t *pte, pte_t *_pte,
>
> while (--_pte >= pte) {
> pte_t pteval = *_pte;
> + unsigned long pfn;
>
> - folio = pfn_folio(pte_pfn(pteval));
> - if (!pte_none(pteval) && !is_zero_pfn(pte_pfn(pteval)) &&
> - !folio_test_large(folio))
> - release_pte_folio(folio);
> + if (pte_none(pteval))
> + continue;
> + pfn = pte_pfn(pteval);
> + if (is_zero_pfn(pfn))
> + continue;
> + folio = pfn_folio(pfn);
> + if (folio_test_large(folio))
> + continue;
> + release_pte_folio(folio);
> }
>
> list_for_each_entry_safe(folio, tmp, compound_pagelist, lru) {
> --
> 2.39.1
>
>
^ permalink raw reply [flat|nested] 5+ messages in thread
end of thread, other threads:[~2023-02-14 17:25 UTC | newest]
Thread overview: 5+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
[not found] <CGME20230213214446eucas1p2630d6c5cb27183f546c2d9561d99b00a@eucas1p2.samsung.com>
2023-02-13 21:43 ` [PATCH] mm/khugepaged: Fix invalid page access in release_pte_pages() Vishal Moola (Oracle)
2023-02-13 22:56 ` Marek Szyprowski
2023-02-14 8:04 ` Alexandre Ghiti
2023-02-14 12:06 ` David Hildenbrand
2023-02-14 17:25 ` Yang Shi
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.