linux-kernel - Re: [patch] mm, page_alloc: move_freepages should not examine struct page of reserved memory

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Wed, 14 Aug 2019 15:49:29 -0700
From:   Andrew Morton <akpm@...ux-foundation.org>
To:     David Rientjes <rientjes@...gle.com>
Cc:     Vlastimil Babka <vbabka@...e.cz>,
        Naoya Horiguchi <n-horiguchi@...jp.nec.com>,
        Mel Gorman <mgorman@...hsingularity.net>, linux-mm@...ck.org,
        linux-kernel@...r.kernel.org
Subject: Re: [patch] mm, page_alloc: move_freepages should not examine
 struct page of reserved memory

On Tue, 13 Aug 2019 16:31:35 -0700 (PDT) David Rientjes <rientjes@...gle.com> wrote:

> > > Move the debug checks to after verifying PageBuddy is true.  This isolates
> > > the scope of the checks to only be for buddy pages which are on the zone's
> > > freelist which move_freepages_block() is operating on.  In this case, an
> > > incorrect node or zone is a bug worthy of being warned about (and the
> > > examination of struct page is acceptable bcause this memory is not
> > > reserved).
> > 
> > I'm thinking Fixes:907ec5fca3dc and Cc:stable?  But 907ec5fca3dc is
> > almost a year old, so you were doing something special to trigger this?
> > 
> 
> We noticed it almost immediately after bringing 907ec5fca3dc in on 
> CONFIG_DEBUG_VM builds.  It depends on finding specific free pages in the 
> per-zone free area where the math in move_freepages() will bring the start 
> or end pfn into reserved memory and wanting to claim that entire pageblock 
> as a new migratetype.  So the path will be rare, require CONFIG_DEBUG_VM, 
> and require fallback to a different migratetype.
> 
> Some struct pages were already zeroed from reserve pages before 
> 907ec5fca3c so it theoretically could trigger before this commit.  I think 
> it's rare enough under a config option that most people don't run that 
> others may not have noticed.  I wouldn't argue against a stable tag and 
> the backport should be easy enough, but probably wouldn't single out a 
> commit that this is fixing.

OK, thanks.  I added the above two paragraphs to the changelog and
removed the Fixes:

Hopefully Mel will be able to review this for us.