linux-kernel - Re: [patch] mm, page_alloc: move_freepages should not examine struct page of reserved memory

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Mon, 19 Aug 2019 14:35:41 +0100
From:   Mel Gorman <mgorman@...hsingularity.net>
To:     Andrew Morton <akpm@...ux-foundation.org>
Cc:     David Rientjes <rientjes@...gle.com>,
        Vlastimil Babka <vbabka@...e.cz>,
        Naoya Horiguchi <n-horiguchi@...jp.nec.com>,
        linux-mm@...ck.org, linux-kernel@...r.kernel.org
Subject: Re: [patch] mm, page_alloc: move_freepages should not examine struct
 page of reserved memory

On Wed, Aug 14, 2019 at 03:49:29PM -0700, Andrew Morton wrote:
> On Tue, 13 Aug 2019 16:31:35 -0700 (PDT) David Rientjes <rientjes@...gle.com> wrote:
> 
> > > > Move the debug checks to after verifying PageBuddy is true.  This isolates
> > > > the scope of the checks to only be for buddy pages which are on the zone's
> > > > freelist which move_freepages_block() is operating on.  In this case, an
> > > > incorrect node or zone is a bug worthy of being warned about (and the
> > > > examination of struct page is acceptable bcause this memory is not
> > > > reserved).
> > > 
> > > I'm thinking Fixes:907ec5fca3dc and Cc:stable?  But 907ec5fca3dc is
> > > almost a year old, so you were doing something special to trigger this?
> > > 
> > 
> > We noticed it almost immediately after bringing 907ec5fca3dc in on 
> > CONFIG_DEBUG_VM builds.  It depends on finding specific free pages in the 
> > per-zone free area where the math in move_freepages() will bring the start 
> > or end pfn into reserved memory and wanting to claim that entire pageblock 
> > as a new migratetype.  So the path will be rare, require CONFIG_DEBUG_VM, 
> > and require fallback to a different migratetype.
> > 
> > Some struct pages were already zeroed from reserve pages before 
> > 907ec5fca3c so it theoretically could trigger before this commit.  I think 
> > it's rare enough under a config option that most people don't run that 
> > others may not have noticed.  I wouldn't argue against a stable tag and 
> > the backport should be easy enough, but probably wouldn't single out a 
> > commit that this is fixing.
> 
> OK, thanks.  I added the above two paragraphs to the changelog and
> removed the Fixes:
> 
> Hopefully Mel will be able to review this for us.

Bit late as I was offline but FWIW

Acked-by: Mel Gorman <mgorman@...hsingularity.net>

That said, the overhead of the debugging check is higher with this
patch although it'll only affect debug builds and the path is not
particularly hot. If this was a concern, I think it would be reasonable
to simply remove the debugging check as the zone boundaries are checked
in move_freepages_block and we never expect a zone/node to be smaller
than a pageblock and stuck in the middle of another zone.

-- 
Mel Gorman
SUSE Labs