linux-kernel - Re: [PATCH] mm: Fix __dump_page when mapping->host is not set

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Fri, 15 Mar 2019 13:47:33 +0100
From:   Michal Hocko <mhocko@...nel.org>
To:     Oscar Salvador <osalvador@...e.de>
Cc:     akpm@...ux-foundation.org, anshuman.khandual@....com,
        william.kucharski@...cle.com, linux-mm@...ck.org,
        linux-kernel@...r.kernel.org, Jan Kara <jack@...e.cz>,
        Hugh Dickins <hughd@...gle.com>
Subject: Re: [PATCH] mm: Fix __dump_page when mapping->host is not set

[Cc Jack and Hugh - the full patch is http://lkml.kernel.org/r/20190315121826.23609-1-osalvador@suse.de]

On Fri 15-03-19 13:18:26, Oscar Salvador wrote:
> While debugging something, I added a dump_page() into do_swap_page(),
> and I got the splat from below.
> The issue happens when dereferencing mapping->host in __dump_page():
> 
> ...
> else if (mapping) {
> 	pr_warn("%ps ", mapping->a_ops);
> 	if (mapping->host->i_dentry.first) {
> 		struct dentry *dentry;
> 		dentry = container_of(mapping->host->i_dentry.first, struct dentry, d_u.d_alias);
> 		pr_warn("name:\"%pd\" ", dentry);
> 	}
> }
> ...
> 
> Swap address space does not contain an inode information, and so mapping->host
> equals NULL.
> 
> Although the dump_page() call was added artificially into do_swap_page(),
> I am not sure if we can hit this from any other path, so it looks worth
> fixing it.

It is certainly worth fixing. We cannot assume anything about the
calling context for __dump_page

> We can easily do that by cheking mapping->host first.
[...]

The splat is still surprising to me because I thought that all file
backed mappings have a host. Swap file/partition certainly has a
mapping but swapcache mapping is special because the underlying swap
storage is hidden in the swap_info_struct. I am wondering whether we
should do that special casing for PageSwapCache in __dump_page rather
than hid the mapping details instead


diff --git a/mm/debug.c b/mm/debug.c
index 1611cf00a137..499c26d5ebe5 100644
--- a/mm/debug.c
+++ b/mm/debug.c
@@ -78,6 +78,9 @@ void __dump_page(struct page *page, const char *reason)
 	else if (PageKsm(page))
 		pr_warn("ksm ");
 	else if (mapping) {
+		if (PageSwapCache(page))
+			mapping = page_swap_info(page)->swap_file->f_mapping;
+
 		pr_warn("%ps ", mapping->a_ops);
 		if (mapping->host->i_dentry.first) {
 			struct dentry *dentry;

But I am not really sure this will work for all swap cases.

Thanks for reporting this Oscar!

> Fixes: 1c6fb1d89e73c ("mm: print more information about mapping in __dump_page")
> Signed-off-by: Oscar Salvador <osalvador@...e.de>
> ---
>  mm/debug.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/mm/debug.c b/mm/debug.c
> index c0b31b6c3877..7759f12a8fbb 100644
> --- a/mm/debug.c
> +++ b/mm/debug.c
> @@ -79,7 +79,7 @@ void __dump_page(struct page *page, const char *reason)
>  		pr_warn("ksm ");
>  	else if (mapping) {
>  		pr_warn("%ps ", mapping->a_ops);
> -		if (mapping->host->i_dentry.first) {
> +		if (mapping->host && mapping->host->i_dentry.first) {
>  			struct dentry *dentry;
>  			dentry = container_of(mapping->host->i_dentry.first, struct dentry, d_u.d_alias);
>  			pr_warn("name:\"%pd\" ", dentry);
> -- 
> 2.13.7

-- 
Michal Hocko
SUSE Labs