From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id AA7D3C19F2D for ; Tue, 9 Aug 2022 11:45:38 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S241189AbiHILph (ORCPT ); Tue, 9 Aug 2022 07:45:37 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:35774 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S230508AbiHILpe (ORCPT ); Tue, 9 Aug 2022 07:45:34 -0400 Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.133.124]) by lindbergh.monkeyblade.net (Postfix) with ESMTP id 3E28E18B31 for ; Tue, 9 Aug 2022 04:45:33 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1660045532; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=YrRdlwFzhyL1JgoDWLNI0P7/kC4GOv+tysqYh41vN90=; b=ICp4GNofDMWn7SdwBngqYBVgP4mmy06XJ6zP7FS2Jas25LBJm2C6O7YUa7Lds2Yp6yIsCW EGs0HOMWTgNIVqsczCO4RGGdAGUbfCvSRMNoqvjmpL0TRKAu5ozioHKVi9V1tHzKzdeet7 kzR+j5stiIPhxpb+IpoyIjpuXQ2PD/o= Received: from mail-vs1-f72.google.com (mail-vs1-f72.google.com [209.85.217.72]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id us-mta-300-AlZ_RwlOP_-OB1JgLxca5w-1; Tue, 09 Aug 2022 07:45:31 -0400 X-MC-Unique: AlZ_RwlOP_-OB1JgLxca5w-1 Received: by mail-vs1-f72.google.com with SMTP id t62-20020a675f41000000b003880bf5661fso2203676vsb.19 for ; Tue, 09 Aug 2022 04:45:31 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc:content-transfer-encoding; bh=YrRdlwFzhyL1JgoDWLNI0P7/kC4GOv+tysqYh41vN90=; b=OD3oNDV5VmlnRR7k2AJBqGAYlxrzmck5OT6DnOFRtGAoRsgLf5A/kPkGXptR8Z/7wT ilC4Ia7OZcrdbFN0sL0Q7OpfHRXkaZof9FZalc0U6O+vPWxtWP4bp+UrRg/HrzgwtvsU wxbG/hRaiqvNY/ceVK5xku0yamxl2apErdX6U/9Rf80F+z/9eZyOxi+aL5so/ZGOxVWc t4lDfgkQzyrkJiP4N8kjyg5z7AOoAYxqd9hmTo+QaOoHOjoradBA6h7Ap3nub5eutGhi OjPGu0jnYCax7nCfkj9KaedZ3YAYRC5iHFCMJ4Iu+MAYu3U5CFltP5jWSpnPIUz5XS9g QP1g== X-Gm-Message-State: ACgBeo3PiU6xu3ypN1T3kcFsSkXX5WAKaT9zfQZWlNwqOAfaVOVo2Jl4 XN12G8pSYxXSUryGBgdvTD6clGfHU8X41RusVQYvpvqxejxTQdUFw3Knu1N41Ytr0zZOSnE8vwF QSYpjBW7rSM/LrPVqKGtBWLzLrJwWEI7oBZgkv44q X-Received: by 2002:a05:6102:5cb:b0:388:9ab7:5f58 with SMTP id v11-20020a05610205cb00b003889ab75f58mr5724776vsf.68.1660045530353; Tue, 09 Aug 2022 04:45:30 -0700 (PDT) X-Google-Smtp-Source: AA6agR7ATkZeriMmKJlv9Q/gYEYNsFbbd3PSLoYo/Er47sV5yGli/esQODsILES0uQaO3ilqkvc1/fcF5waK8hyF1xI= X-Received: by 2002:a05:6102:5cb:b0:388:9ab7:5f58 with SMTP id v11-20020a05610205cb00b003889ab75f58mr5724765vsf.68.1660045530147; Tue, 09 Aug 2022 04:45:30 -0700 (PDT) MIME-Version: 1.0 References: <20220715125013.247085-1-mlombard@redhat.com> <20220808171452.d870753e1494b92ba2142116@linux-foundation.org> In-Reply-To: <20220808171452.d870753e1494b92ba2142116@linux-foundation.org> From: Maurizio Lombardi Date: Tue, 9 Aug 2022 13:45:19 +0200 Message-ID: Subject: Re: [PATCH V3] mm: prevent page_frag_alloc() from corrupting the memory To: Andrew Morton Cc: Alexander Duyck , Jakub Kicinski , linux-mm , LKML , Netdev , =?UTF-8?B?5oSa5qCR?= Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org =C3=BAt 9. 8. 2022 v 2:14 odes=C3=ADlatel Andrew Morton napsal: > > On Fri, 15 Jul 2022 14:50:13 +0200 Maurizio Lombardi wrote: > > > A number of drivers call page_frag_alloc() with a > > fragment's size > PAGE_SIZE. > > In low memory conditions, __page_frag_cache_refill() may fail the order= 3 > > cache allocation and fall back to order 0; > > In this case, the cache will be smaller than the fragment, causing > > memory corruptions. > > > > Prevent this from happening by checking if the newly allocated cache > > is large enough for the fragment; if not, the allocation will fail > > and page_frag_alloc() will return NULL. > > Can we come up with a Fixes: for this? I think the bug has been introduced in kernel 3.19-rc1 Fixes: ffde7328a36d16e626bae8468571858d71cd010b > > Should this fix be backported into -stable kernels? Yes, IMO this should be backported to -stable Thanks, Maurizio