| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <20150402112055.GA24028@node.dhcp.inet.fi>
Date: Thu, 2 Apr 2015 14:20:55 +0300
From: "Kirill A. Shutemov" <kirill@...temov.name>
To: akpm@...ux-foundation.org
Cc: linux-kernel@...r.kernel.org, kirill.shutemov@...ux.intel.com,
aarcange@...hat.com, aneesh.kumar@...ux.vnet.ibm.com, cl@...ux.com,
dave.hansen@...el.com, hannes@...xchg.org, hughd@...gle.com,
jmarchan@...hat.com, mgorman@...e.de, mhocko@...e.cz,
n-horiguchi@...jp.nec.com, riel@...hat.com,
steve.capper@...aro.org, vbabka@...e.cz, mm-commits@...r.kernel.org
Subject: Re: + mm-sanitize-page-mapping-for-tail-pages.patch added to -mm tree
On Fri, Mar 20, 2015 at 01:36:30PM -0700, akpm@...ux-foundation.org wrote:
>
> The patch titled
> Subject: mm: sanitize page->mapping for tail pages
> has been added to the -mm tree. Its filename is
> mm-sanitize-page-mapping-for-tail-pages.patch
>
> This patch should soon appear at
> http://ozlabs.org/~akpm/mmots/broken-out/mm-sanitize-page-mapping-for-tail-pages.patch
> and later at
> http://ozlabs.org/~akpm/mmotm/broken-out/mm-sanitize-page-mapping-for-tail-pages.patch
>
> Before you just go and hit "reply", please:
> a) Consider who else should be cc'ed
> b) Prefer to cc a suitable mailing list as well
> c) Ideally: find the original patch on the mailing list and do a
> reply-to-all to that, adding suitable additional cc's
>
> *** Remember to use Documentation/SubmitChecklist when testing your code ***
>
> The -mm tree is included into linux-next and is updated
> there every 3-4 working days
>
> ------------------------------------------------------
> From: "Kirill A. Shutemov" <kirill.shutemov@...ux.intel.com>
> Subject: mm: sanitize page->mapping for tail pages
>
> We don't define meaning of page->mapping for tail pages. Currently it's
> always NULL, which can be inconsistent with head page and potentially lead
> to problems.
>
> Let's poison the pointer to catch all illigal uses.
>
> page_rmapping() and page_mapping() are changed to look on head page.
Could you replace the patch with the patch below. It also takes care about
page_anon_vma().
>From fa89941045b74fa9912758267813b904443b023a Mon Sep 17 00:00:00 2001
From: "Kirill A. Shutemov" <kirill.shutemov@...ux.intel.com>
Date: Thu, 2 Apr 2015 09:28:20 +1100
Subject: [PATCH] mm: sanitize page->mapping for tail pages
We don't define meaning of page->mapping for tail pages. Currently it's
always NULL, which can be inconsistent with head page and potentially lead
to problems.
Let's poison the pointer to catch all illigal uses.
page_rmapping(), page_mapping() and page_anon_vma() are changed to look
on head page.
The only illegal use I've caught so far is __GPF_COMP pages from sound
subsystem, mapped with PTEs. do_shared_fault() is changed to use
page_rmapping() instead of direct access to fault_page->mapping.
Signed-off-by: Kirill A. Shutemov <kirill.shutemov@...ux.intel.com>
Cc: Andrea Arcangeli <aarcange@...hat.com>
Cc: Hugh Dickins <hughd@...gle.com>
Cc: Dave Hansen <dave.hansen@...el.com>
Cc: Mel Gorman <mgorman@...e.de>
Cc: Rik van Riel <riel@...hat.com>
Cc: Vlastimil Babka <vbabka@...e.cz>
Cc: Christoph Lameter <cl@...ux.com>
Cc: Naoya Horiguchi <n-horiguchi@...jp.nec.com>
Cc: Steve Capper <steve.capper@...aro.org>
Cc: "Aneesh Kumar K.V" <aneesh.kumar@...ux.vnet.ibm.com>
Cc: Johannes Weiner <hannes@...xchg.org>
Cc: Michal Hocko <mhocko@...e.cz>
Cc: Jerome Marchand <jmarchan@...hat.com>
Signed-off-by: Andrew Morton <akpm@...ux-foundation.org>
Signed-off-by: Kirill A. Shutemov <kirill.shutemov@...ux.intel.com>
---
include/linux/mm.h | 1 +
include/linux/poison.h | 4 ++++
include/linux/rmap.h | 1 +
mm/huge_memory.c | 2 +-
mm/memory.c | 2 +-
mm/page_alloc.c | 7 +++++++
mm/util.c | 5 ++++-
7 files changed, 19 insertions(+), 3 deletions(-)
diff --git a/include/linux/mm.h b/include/linux/mm.h
index 9287fffd9f0d..16fe322b66ea 100644
--- a/include/linux/mm.h
+++ b/include/linux/mm.h
@@ -915,6 +915,7 @@ extern struct address_space *page_mapping(struct page *page);
/* Neutral page->mapping pointer to address_space or anon_vma or other */
static inline void *page_rmapping(struct page *page)
{
+ page = compound_head(page);
return (void *)((unsigned long)page->mapping & ~PAGE_MAPPING_FLAGS);
}
diff --git a/include/linux/poison.h b/include/linux/poison.h
index 2110a81c5e2a..7b2a7fcde6a3 100644
--- a/include/linux/poison.h
+++ b/include/linux/poison.h
@@ -32,6 +32,10 @@
/********** mm/debug-pagealloc.c **********/
#define PAGE_POISON 0xaa
+/********** mm/page_alloc.c ************/
+
+#define TAIL_MAPPING ((void *) 0x01014A11 + POISON_POINTER_DELTA)
+
/********** mm/slab.c **********/
/*
* Magic nums for obj red zoning.
diff --git a/include/linux/rmap.h b/include/linux/rmap.h
index c4c559a45dc8..6e7b0443afb0 100644
--- a/include/linux/rmap.h
+++ b/include/linux/rmap.h
@@ -107,6 +107,7 @@ static inline void put_anon_vma(struct anon_vma *anon_vma)
static inline struct anon_vma *page_anon_vma(struct page *page)
{
+ page = compound_head(page);
if (((unsigned long)page->mapping & PAGE_MAPPING_FLAGS) !=
PAGE_MAPPING_ANON)
return NULL;
diff --git a/mm/huge_memory.c b/mm/huge_memory.c
index 3afb5cbe1312..7ce6b6c2d1f4 100644
--- a/mm/huge_memory.c
+++ b/mm/huge_memory.c
@@ -1703,7 +1703,7 @@ static void __split_huge_page_refcount(struct page *page,
*/
page_tail->_mapcount = page->_mapcount;
- BUG_ON(page_tail->mapping);
+ BUG_ON(page_tail->mapping != TAIL_MAPPING);
page_tail->mapping = page->mapping;
page_tail->index = page->index + i;
diff --git a/mm/memory.c b/mm/memory.c
index ac20b2a6a0c3..fc91fcb407cc 100644
--- a/mm/memory.c
+++ b/mm/memory.c
@@ -3033,7 +3033,7 @@ static int do_shared_fault(struct mm_struct *mm, struct vm_area_struct *vma,
* pinned by vma->vm_file's reference. We rely on unlock_page()'s
* release semantics to prevent the compiler from undoing this copying.
*/
- mapping = fault_page->mapping;
+ mapping = page_rmapping(fault_page);
unlock_page(fault_page);
if ((dirtied || vma->vm_ops->page_mkwrite) && mapping) {
/*
diff --git a/mm/page_alloc.c b/mm/page_alloc.c
index 1b849500640c..e73ecbbfa69f 100644
--- a/mm/page_alloc.c
+++ b/mm/page_alloc.c
@@ -373,6 +373,7 @@ void prep_compound_page(struct page *page, unsigned long order)
for (i = 1; i < nr_pages; i++) {
struct page *p = page + i;
set_page_count(p, 0);
+ p->mapping = TAIL_MAPPING;
p->first_page = page;
/* Make sure p->first_page is always valid for PageTail() */
smp_wmb();
@@ -765,6 +766,12 @@ static void free_one_page(struct zone *zone,
static int free_tail_pages_check(struct page *head_page, struct page *page)
{
+ if (page->mapping != TAIL_MAPPING) {
+ bad_page(page, "corrupted mapping in tail page", 0);
+ page->mapping = NULL;
+ return 1;
+ }
+ page->mapping = NULL;
if (!IS_ENABLED(CONFIG_DEBUG_VM))
return 0;
if (unlikely(!PageTail(page))) {
diff --git a/mm/util.c b/mm/util.c
index 3981ae9d1b15..e78968bd11e7 100644
--- a/mm/util.c
+++ b/mm/util.c
@@ -327,7 +327,10 @@ EXPORT_SYMBOL(kvfree);
struct address_space *page_mapping(struct page *page)
{
- struct address_space *mapping = page->mapping;
+ struct address_space *mapping;
+
+ page = compound_head(page);
+ mapping = page->mapping;
/* This happens if someone calls flush_dcache_page on slab page */
if (unlikely(PageSlab(page)))
--
Kirill A. Shutemov
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
Powered by blists - more mailing lists