From: Matthew Wilcox <willy@infradead.org>
To: Pavel Tatashin <pasha.tatashin@soleen.com>
Cc: linux-mm@kvack.org
Subject: compound_head() vs uninitialized struct page poisoning
Date: Wed, 1 May 2019 13:24:33 -0700 [thread overview]
Message-ID: <20190501202433.GC28500@bombadil.infradead.org> (raw)
Hi Pavel,
This strikes me as wrong:
#define PF_HEAD(page, enforce) PF_POISONED_CHECK(compound_head(page))
If we hit a page which is poisoned, PAGE_POISON_PATTERN is ~0, so PageTail
is set, and compound_head will return() 0xfff..ffe. PagePoisoned()
will then try to derefence that pointer and we'll get an oops that isn't
obviously PagePoisoned.
I think this should have been:
#define PF_HEAD(page, enforce) compound_head(PF_POISONED_CHECK(page))
One could make the argument for double-checking:
#define PF_HEAD(page, enforce) PF_POISONED_CHECK(compound_head(PF_POISONED_CHECK(page)))
but I think this is overkill; if a tail page is initialised, then there's
no way that its head page should have been uninitialised.
Would a patch something along these lines make sense? Compile-tested only.
diff --git a/include/linux/page-flags.h b/include/linux/page-flags.h
index 9f8712a4b1a5..1d25d0899854 100644
--- a/include/linux/page-flags.h
+++ b/include/linux/page-flags.h
@@ -227,16 +227,18 @@ static inline void page_init_poison(struct page *page, size_t size)
VM_BUG_ON_PGFLAGS(PagePoisoned(page), page); \
page; })
#define PF_ANY(page, enforce) PF_POISONED_CHECK(page)
-#define PF_HEAD(page, enforce) PF_POISONED_CHECK(compound_head(page))
+#define PF_HEAD(page, enforce) compound_head(PF_POISONED_CHECK(page))
#define PF_ONLY_HEAD(page, enforce) ({ \
+ PF_POISONED_CHECK(page); \
VM_BUG_ON_PGFLAGS(PageTail(page), page); \
- PF_POISONED_CHECK(page); })
+ page; })
#define PF_NO_TAIL(page, enforce) ({ \
VM_BUG_ON_PGFLAGS(enforce && PageTail(page), page); \
- PF_POISONED_CHECK(compound_head(page)); })
+ compound_head(PF_POISONED_CHECK(page)); })
#define PF_NO_COMPOUND(page, enforce) ({ \
+ PF_POISONED_CHECK(page); \
VM_BUG_ON_PGFLAGS(enforce && PageCompound(page), page); \
- PF_POISONED_CHECK(page); })
+ page; })
/*
* Macros to create function definitions for page flags
next reply other threads:[~2019-05-01 20:24 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-05-01 20:24 Matthew Wilcox [this message]
2019-05-01 20:32 ` compound_head() vs uninitialized struct page poisoning Pavel Tatashin
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20190501202433.GC28500@bombadil.infradead.org \
--to=willy@infradead.org \
--cc=linux-mm@kvack.org \
--cc=pasha.tatashin@soleen.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).