linux-kernel - Re: [PATCH v2 1/8] mm: dump_page: print head page's refcount, for compound pages

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <c9aea9a3-53b1-83f0-9f69-c294647e0925@nvidia.com>
Date:   Wed, 29 Jan 2020 22:30:56 -0800
From:   John Hubbard <jhubbard@...dia.com>
To:     Matthew Wilcox <willy@...radead.org>
CC:     "Kirill A. Shutemov" <kirill@...temov.name>,
        Andrew Morton <akpm@...ux-foundation.org>,
        Al Viro <viro@...iv.linux.org.uk>,
        Christoph Hellwig <hch@...radead.org>,
        Dan Williams <dan.j.williams@...el.com>,
        Dave Chinner <david@...morbit.com>,
        Ira Weiny <ira.weiny@...el.com>, Jan Kara <jack@...e.cz>,
        Jason Gunthorpe <jgg@...pe.ca>,
        Jonathan Corbet <corbet@....net>,
        Jérôme Glisse <jglisse@...hat.com>,
        Michal Hocko <mhocko@...e.com>,
        Mike Kravetz <mike.kravetz@...cle.com>,
        Shuah Khan <shuah@...nel.org>,
        Vlastimil Babka <vbabka@...e.cz>, <linux-doc@...r.kernel.org>,
        <linux-fsdevel@...r.kernel.org>, <linux-kselftest@...r.kernel.org>,
        <linux-rdma@...r.kernel.org>, <linux-mm@...ck.org>,
        LKML <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH v2 1/8] mm: dump_page: print head page's refcount, for
 compound pages

On 1/29/20 10:23 PM, John Hubbard wrote:
> On 1/29/20 2:59 PM, Matthew Wilcox wrote:
> ...
>> I have a hunk in my current tree which looks like this:
>>
>> @@ -77,6 +77,11 @@ void __dump_page(struct page *page, const char *reason)
>>                  pr_warn("page:%px refcount:%d mapcount:%d mapping:%px index:%#lx
>> \n",
>>                          page, page_ref_count(page), mapcount,
>>                          page->mapping, page_to_pgoff(page));
>> +       if (PageTail(page)) {
>> +               struct page *head = compound_head(page);
>> +               pr_warn("head:%px mapping:%px index:%#lx\n",
>> +                       head, head->mapping, page_to_pgoff(head));
>> +       }
>>          if (PageKsm(page))
>>                  pr_warn("ksm flags: %#lx(%pGp)\n", page->flags, &page->flags);
>>          else if (PageAnon(page))
>>
>> I wonder if we can combine these two patches in some more useful way?
>>
>> I also think we probably want a sanity check that 'head' and 'page'
>> are within a sane range of each other (ie head < page and head +
>> MAX_ORDER_NR_PAGES > page) to protect against a struct page that contains
>> complete garbage.
>>
> 
> OK, here's a go at combining those. I like the observation, implicit in your
> diffs, that PageTail rather than PageCompound is the key differentiator in
> deciding what to print. How's this look:
> 
> diff --git a/mm/debug.c b/mm/debug.c
> index a90da5337c14..944652843e7b 100644
> --- a/mm/debug.c
> +++ b/mm/debug.c
> @@ -75,12 +75,31 @@ void __dump_page(struct page *page, const char *reason)
>        */
>       mapcount = PageSlab(page) ? 0 : page_mapcount(page);
> 
> -    if (PageCompound(page))
> -        pr_warn("page:%px refcount:%d mapcount:%d mapping:%px "
> -            "index:%#lx compound_mapcount: %d\n",
> -            page, page_ref_count(page), mapcount,
> -            page->mapping, page_to_pgoff(page),
> -            compound_mapcount(page));
> +    if (PageTail(page)) {
> +        struct page *head = compound_head(page);
> +
> +        if ((page < head) || (page >= head + MAX_ORDER_NR_PAGES)) {
> +            /*
> +             * Page is hopelessly corrupted, so limit any reporting
> +             * to information about the page itself. Do not attempt
> +             * to look at the head page.
> +             */
> +            pr_warn("page:%px refcount:%d mapcount:%d mapping:%px "
> +                "index:%#lx (corrupted tail page case)\n",
> +                page, page_ref_count(page), mapcount,
> +                page->mapping, page_to_pgoff(page));
> +        } else {
> +            pr_warn("page:%px compound refcount:%d mapcount:%d "
> +                "mapping:%px index:%#lx compound_mapcount:%d\n",
> +                page, page_ref_count(head),
> +                mapcount, head->mapping, page_to_pgoff(head),
> +                compound_mapcount(page));
> +
> +            if (page_ref_count(page) != 0)
> +                pr_warn("page:%px PROBLEM: non-zero refcount (==%d) on "
> +                    "this tail page\n", page, page_ref_count(page));

...ahem, I sorta botched the above statement, because that should
be outside (just below) the "else" statement--it can be done whether or
not the page fails the safety/bounds check. :)

thanks,
-- 
John Hubbard
NVIDIA