From: Chen Lin <chen45464546@163.com>
To: akpm@linux-foundation.org
Cc: linux-mm@kvack.org, linux-kernel@vger.kernel.org,
alexander.h.duyck@linux.intel.com, netdev@vger.kernel.org,
Chen Lin <chen45464546@163.com>
Subject: [PATCH v2] mm: page_frag: Warn_on when frag_alloc size is bigger than PAGE_SIZE
Date: Mon, 30 May 2022 21:39:02 +0800 [thread overview]
Message-ID: <1653917942-5982-1-git-send-email-chen45464546@163.com> (raw)
In-Reply-To: <20220529163029.12425c1e5286d7c7e3fe3708@linux-foundation.org>
netdev_alloc_frag->page_frag_alloc may cause memory corruption in
the following process:
1. A netdev_alloc_frag function call need alloc 200 Bytes to build a skb.
2. Insufficient memory to alloc PAGE_FRAG_CACHE_MAX_ORDER(32K) in
__page_frag_cache_refill to fill frag cache, then one page(eg:4K)
is allocated, now current frag cache is 4K, alloc is success,
nc->pagecnt_bias--.
3. Then this 200 bytes skb in step 1 is freed, page->_refcount--.
4. Another netdev_alloc_frag function call need alloc 5k, page->_refcount
is equal to nc->pagecnt_bias, reset page count bias and offset to
start of new frag. page_frag_alloc will return the 4K memory for a
5K memory request.
5. The caller write on the extra 1k memory which is not actual allocated
will cause memory corruption.
page_frag_alloc is for fragmented allocation. We should warn the caller
to avoid memory corruption.
When fragsz is larger than one page, we report the failure and return.
I don't think it is a good idea to make efforts to support the
allocation of more than one page in this function because the total
frag cache size(PAGE_FRAG_CACHE_MAX_SIZE 32768) is relatively small.
When the request is larger than one page, the caller should switch to
use other kernel interfaces, such as kmalloc and alloc_Pages.
This bug is mainly caused by the reuse of the previously allocated
frag cache memory by the following LARGER allocations. This bug existed
before page_frag_alloc was ported from __netdev_alloc_frag in
net/core/skbuff.c, so most Linux versions have this problem.
Signed-off-by: Chen Lin <chen45464546@163.com>
---
mm/page_alloc.c | 10 ++++++++++
1 file changed, 10 insertions(+)
diff --git a/mm/page_alloc.c b/mm/page_alloc.c
index e008a3d..1e9e2c4 100644
--- a/mm/page_alloc.c
+++ b/mm/page_alloc.c
@@ -5574,6 +5574,16 @@ void *page_frag_alloc_align(struct page_frag_cache *nc,
struct page *page;
int offset;
+ /* frag_alloc is not suitable for memory alloc which fragsz
+ * is bigger than PAGE_SIZE, use kmalloc or alloc_pages instead.
+ */
+ if (unlikely(fragsz > PAGE_SIZE)) {
+ WARN(1, "alloc fragsz(%d) > PAGE_SIZE(%ld) not supported,
+ alloc fail\n", fragsz, PAGE_SIZE);
+
+ return NULL;
+ }
+
if (unlikely(!nc->va)) {
refill:
page = __page_frag_cache_refill(nc, gfp_mask);
--
1.7.9.5
next prev parent reply other threads:[~2022-05-30 14:12 UTC|newest]
Thread overview: 16+ messages / expand[flat|nested] mbox.gz Atom feed top
[not found] <1653752373-3172-1-git-send-email-chen45464546@163.com>
2022-05-29 23:30 ` [PATCH] mm: page_frag: Warn_on when frag_alloc size is bigger than PAGE_SIZE Andrew Morton
2022-05-30 13:39 ` Chen Lin [this message]
2022-05-30 19:27 ` [PATCH v2] " Jakub Kicinski
2022-05-30 19:29 ` Jakub Kicinski
2022-05-31 14:41 ` Chen Lin
2022-05-31 15:14 ` Jakub Kicinski
2022-05-31 15:36 ` Chen Lin
2022-05-31 15:47 ` Jakub Kicinski
2022-05-31 18:28 ` Alexander Duyck
2022-06-01 12:32 ` 愚树
2022-06-01 15:04 ` Alexander Duyck
2022-07-06 15:21 ` Maurizio Lombardi
2022-07-08 8:06 ` Maurizio Lombardi
2022-05-30 20:07 ` Andrew Morton
2022-05-31 14:43 ` [PATCH v3] " Chen Lin
2022-05-31 23:45 ` Eric Dumazet
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1653917942-5982-1-git-send-email-chen45464546@163.com \
--to=chen45464546@163.com \
--cc=akpm@linux-foundation.org \
--cc=alexander.h.duyck@linux.intel.com \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-mm@kvack.org \
--cc=netdev@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).