linux-kernel - Re: [PATCH 1/1] mm: compaction: avoid fast_isolate_around() to set pageblock

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20201125103053.GL3306@suse.de>
Date:   Wed, 25 Nov 2020 10:30:53 +0000
From:   Mel Gorman <mgorman@...e.de>
To:     Andrea Arcangeli <aarcange@...hat.com>
Cc:     Vlastimil Babka <vbabka@...e.cz>,
        Andrew Morton <akpm@...ux-foundation.org>, linux-mm@...ck.org,
        Qian Cai <cai@....pw>, Michal Hocko <mhocko@...nel.org>,
        David Hildenbrand <david@...hat.com>,
        linux-kernel@...r.kernel.org, Mike Rapoport <rppt@...ux.ibm.com>,
        Baoquan He <bhe@...hat.com>
Subject: Re: [PATCH 1/1] mm: compaction: avoid fast_isolate_around() to set
 pageblock_skip on reserved pages

On Tue, Nov 24, 2020 at 03:56:22PM -0500, Andrea Arcangeli wrote:
> Hello,
> 
> On Tue, Nov 24, 2020 at 01:32:05PM +0000, Mel Gorman wrote:
> > I would hope that is not the case because they are not meant to overlap.
> > However, if the beginning of the pageblock was not the start of a zone
> > then the pages would be valid but the pfn would still be outside the
> > zone boundary. If it was reserved, the struct page is valid but not
> > suitable for set_pfnblock_flags_mask. However, it is a concern in
> > general because the potential is there that pages are isolated from the
> > wrong zone.
> 
> I guess we have more than one issue to correct in that function
> because the same BUG_ON reproduced again even with the tentative patch
> I posted earlier.
> 
> So my guess is that the problematic reserved page isn't pointed by the
> min_pfn, but it must have been pointed by the "highest" variable
> calculated below?
> 
> 			if (pfn >= highest)
> 				highest = pageblock_start_pfn(pfn);
> 
> When I looked at where "highest" comes from, it lacks
> pageblock_pfn_to_page check (which was added around v5.7 to min_pfn).
> 
> Is that the real bug, which may be fixed by something like this? (untested)
> 

It's plausible as it is a potential source of leaking but as you note
in another mail, it's surprising to me that valid struct pages, even if
within memory holes and reserved would have broken node/zone information
in the page flags.

-- 
Mel Gorman
SUSE Labs