| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <20150925022034.GA31309@gmail.com>
Date: Thu, 24 Sep 2015 22:20:38 -0400
From: Jerome Glisse <j.glisse@...il.com>
To: "Kirill A. Shutemov" <kirill.shutemov@...ux.intel.com>
Cc: Andrew Morton <akpm@...ux-foundation.org>,
Andrea Arcangeli <aarcange@...hat.com>,
Hugh Dickins <hughd@...gle.com>,
Dave Hansen <dave.hansen@...el.com>,
Mel Gorman <mgorman@...e.de>, Rik van Riel <riel@...hat.com>,
Vlastimil Babka <vbabka@...e.cz>,
Christoph Lameter <cl@...two.org>,
Naoya Horiguchi <n-horiguchi@...jp.nec.com>,
Steve Capper <steve.capper@...aro.org>,
"Aneesh Kumar K.V" <aneesh.kumar@...ux.vnet.ibm.com>,
Johannes Weiner <hannes@...xchg.org>,
Michal Hocko <mhocko@...e.cz>,
Jerome Marchand <jmarchan@...hat.com>,
Sasha Levin <sasha.levin@...cle.com>,
linux-kernel@...r.kernel.org, linux-mm@...ck.org
Subject: Re: [PATCH 16/16] mm: sanitize page->mapping for tail pages
On Thu, Sep 24, 2015 at 05:51:04PM +0300, Kirill A. Shutemov wrote:
> We don't define meaning of page->mapping for tail pages. Currently it's
> always NULL, which can be inconsistent with head page and potentially lead
> to problems.
>
> Let's poison the pointer to catch all illigal uses.
>
> page_rmapping(), page_mapping() and page_anon_vma() are changed to look on
> head page.
>
> The only illegal use I've caught so far is __GPF_COMP pages from sound
> subsystem, mapped with PTEs. do_shared_fault() is changed to use
> page_rmapping() instead of direct access to fault_page->mapping.
>
> Signed-off-by: Kirill A. Shutemov <kirill.shutemov@...ux.intel.com>
Just a nitpick but page_rmapping() is already using compound_head() and
thus commit message is missleading. I was expecting to see some changes
to page_rmapping(). Anyway:
Reviewed-by: Jérôme Glisse <jglisse@...hat.com>
> ---
> include/linux/poison.h | 4 ++++
> mm/huge_memory.c | 2 +-
> mm/memory.c | 2 +-
> mm/page_alloc.c | 6 ++++++
> mm/util.c | 10 ++++++----
> 5 files changed, 18 insertions(+), 6 deletions(-)
>
> diff --git a/include/linux/poison.h b/include/linux/poison.h
> index 317e16de09e5..76c3b6c38c16 100644
> --- a/include/linux/poison.h
> +++ b/include/linux/poison.h
> @@ -32,6 +32,10 @@
> /********** mm/debug-pagealloc.c **********/
> #define PAGE_POISON 0xaa
>
> +/********** mm/page_alloc.c ************/
> +
> +#define TAIL_MAPPING ((void *) 0x01014A11 + POISON_POINTER_DELTA)
> +
> /********** mm/slab.c **********/
> /*
> * Magic nums for obj red zoning.
> diff --git a/mm/huge_memory.c b/mm/huge_memory.c
> index 244c852d565c..65ab7858bbcc 100644
> --- a/mm/huge_memory.c
> +++ b/mm/huge_memory.c
> @@ -1836,7 +1836,7 @@ static void __split_huge_page_refcount(struct page *page,
> */
> page_tail->_mapcount = page->_mapcount;
>
> - BUG_ON(page_tail->mapping);
> + BUG_ON(page_tail->mapping != TAIL_MAPPING);
> page_tail->mapping = page->mapping;
>
> page_tail->index = page->index + i;
> diff --git a/mm/memory.c b/mm/memory.c
> index caecc64301e9..3bd465a6fa0d 100644
> --- a/mm/memory.c
> +++ b/mm/memory.c
> @@ -3087,7 +3087,7 @@ static int do_shared_fault(struct mm_struct *mm, struct vm_area_struct *vma,
> * pinned by vma->vm_file's reference. We rely on unlock_page()'s
> * release semantics to prevent the compiler from undoing this copying.
> */
> - mapping = fault_page->mapping;
> + mapping = page_rmapping(fault_page);
> unlock_page(fault_page);
> if ((dirtied || vma->vm_ops->page_mkwrite) && mapping) {
> /*
> diff --git a/mm/page_alloc.c b/mm/page_alloc.c
> index 321a91747949..9bcfd70b1eb8 100644
> --- a/mm/page_alloc.c
> +++ b/mm/page_alloc.c
> @@ -473,6 +473,7 @@ void prep_compound_page(struct page *page, unsigned int order)
> for (i = 1; i < nr_pages; i++) {
> struct page *p = page + i;
> set_page_count(p, 0);
> + p->mapping = TAIL_MAPPING;
> set_compound_head(p, page);
> }
> }
> @@ -864,6 +865,10 @@ static int free_tail_pages_check(struct page *head_page, struct page *page)
> ret = 0;
> goto out;
> }
> + if (page->mapping != TAIL_MAPPING) {
> + bad_page(page, "corrupted mapping in tail page", 0);
> + goto out;
> + }
> if (unlikely(!PageTail(page))) {
> bad_page(page, "PageTail not set", 0);
> goto out;
> @@ -874,6 +879,7 @@ static int free_tail_pages_check(struct page *head_page, struct page *page)
> }
> ret = 0;
> out:
> + page->mapping = NULL;
> clear_compound_head(page);
> return ret;
> }
> diff --git a/mm/util.c b/mm/util.c
> index 9af1c12b310c..902b65a43899 100644
> --- a/mm/util.c
> +++ b/mm/util.c
> @@ -355,7 +355,9 @@ struct anon_vma *page_anon_vma(struct page *page)
>
> struct address_space *page_mapping(struct page *page)
> {
> - unsigned long mapping;
> + struct address_space *mapping;
> +
> + page = compound_head(page);
>
> /* This happens if someone calls flush_dcache_page on slab page */
> if (unlikely(PageSlab(page)))
> @@ -368,10 +370,10 @@ struct address_space *page_mapping(struct page *page)
> return swap_address_space(entry);
> }
>
> - mapping = (unsigned long)page->mapping;
> - if (mapping & PAGE_MAPPING_FLAGS)
> + mapping = page->mapping;
> + if ((unsigned long)mapping & PAGE_MAPPING_FLAGS)
> return NULL;
> - return page->mapping;
> + return mapping;
> }
>
> int overcommit_ratio_handler(struct ctl_table *table, int write,
> --
> 2.5.1
>
> --
> To unsubscribe, send a message with 'unsubscribe linux-mm' in
> the body to majordomo@...ck.org. For more info on Linux MM,
> see: http://www.linux-mm.org/ .
> Don't email: <a href=mailto:"dont@...ck.org"> email@...ck.org </a>
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
Powered by blists - more mailing lists