linux-kernel - [PATCH 5.4 35/85] net: introduce helper sendpage

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Mon, 12 Oct 2020 15:26:58 +0200
From:   Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To:     linux-kernel@...r.kernel.org
Cc:     Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
        stable@...r.kernel.org, Coly Li <colyli@...e.de>,
        Chaitanya Kulkarni <chaitanya.kulkarni@....com>,
        Christoph Hellwig <hch@....de>, Hannes Reinecke <hare@...e.de>,
        Jan Kara <jack@...e.com>, Jens Axboe <axboe@...nel.dk>,
        Mikhail Skorzhinskii <mskorzhinskiy@...arflare.com>,
        Philipp Reisner <philipp.reisner@...bit.com>,
        Sagi Grimberg <sagi@...mberg.me>,
        Vlastimil Babka <vbabka@...e.com>,
        "David S. Miller" <davem@...emloft.net>
Subject: [PATCH 5.4 35/85] net: introduce helper sendpage_ok() in include/linux/net.h

From: Coly Li <colyli@...e.de>

commit c381b07941adc2274ce552daf86c94701c5e265a upstream.

The original problem was from nvme-over-tcp code, who mistakenly uses
kernel_sendpage() to send pages allocated by __get_free_pages() without
__GFP_COMP flag. Such pages don't have refcount (page_count is 0) on
tail pages, sending them by kernel_sendpage() may trigger a kernel panic
from a corrupted kernel heap, because these pages are incorrectly freed
in network stack as page_count 0 pages.

This patch introduces a helper sendpage_ok(), it returns true if the
checking page,
- is not slab page: PageSlab(page) is false.
- has page refcount: page_count(page) is not zero

All drivers who want to send page to remote end by kernel_sendpage()
may use this helper to check whether the page is OK. If the helper does
not return true, the driver should try other non sendpage method (e.g.
sock_no_sendpage()) to handle the page.

Signed-off-by: Coly Li <colyli@...e.de>
Cc: Chaitanya Kulkarni <chaitanya.kulkarni@....com>
Cc: Christoph Hellwig <hch@....de>
Cc: Hannes Reinecke <hare@...e.de>
Cc: Jan Kara <jack@...e.com>
Cc: Jens Axboe <axboe@...nel.dk>
Cc: Mikhail Skorzhinskii <mskorzhinskiy@...arflare.com>
Cc: Philipp Reisner <philipp.reisner@...bit.com>
Cc: Sagi Grimberg <sagi@...mberg.me>
Cc: Vlastimil Babka <vbabka@...e.com>
Cc: stable@...r.kernel.org
Signed-off-by: David S. Miller <davem@...emloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@...uxfoundation.org>

---
 include/linux/net.h |   16 ++++++++++++++++
 1 file changed, 16 insertions(+)

--- a/include/linux/net.h
+++ b/include/linux/net.h
@@ -21,6 +21,7 @@
 #include <linux/rcupdate.h>
 #include <linux/once.h>
 #include <linux/fs.h>
+#include <linux/mm.h>

 #include <uapi/linux/net.h>

@@ -288,6 +289,21 @@ do {									\
 #define net_get_random_once_wait(buf, nbytes)			\
 	get_random_once_wait((buf), (nbytes))

+/*
+ * E.g. XFS meta- & log-data is in slab pages, or bcache meta
+ * data pages, or other high order pages allocated by
+ * __get_free_pages() without __GFP_COMP, which have a page_count
+ * of 0 and/or have PageSlab() set. We cannot use send_page for
+ * those, as that does get_page(); put_page(); and would cause
+ * either a VM_BUG directly, or __page_cache_release a page that
+ * would actually still be referenced by someone, leading to some
+ * obscure delayed Oops somewhere else.
+ */
+static inline bool sendpage_ok(struct page *page)
+{
+	return !PageSlab(page) && page_count(page) >= 1;
+}
+
 int kernel_sendmsg(struct socket *sock, struct msghdr *msg, struct kvec *vec,
 		   size_t num, size_t len);
 int kernel_sendmsg_locked(struct sock *sk, struct msghdr *msg,