linux-kernel - Re: [PATCH net] page_pool: mask the page->signature before the checking

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <YQtDynWsDxZ/T41e@casper.infradead.org>
Date:   Thu, 5 Aug 2021 02:50:02 +0100
From:   Matthew Wilcox <willy@...radead.org>
To:     Yunsheng Lin <linyunsheng@...wei.com>
Cc:     davem@...emloft.net, kuba@...nel.org, hawk@...nel.org,
        ilias.apalodimas@...aro.org, mcroce@...rosoft.com,
        alexander.duyck@...il.com, netdev@...r.kernel.org,
        linux-kernel@...r.kernel.org, linuxarm@...neuler.org,
        chenhao288@...ilicon.com
Subject: Re: [PATCH net] page_pool: mask the page->signature before the
 checking

On Thu, Aug 05, 2021 at 09:06:57AM +0800, Yunsheng Lin wrote:
> As mentioned in commit c07aea3ef4d4 ("mm: add a signature
> in struct page"):
> "The page->signature field is aliased to page->lru.next and
> page->compound_head."
> 
> And as the comment in page_is_pfmemalloc():
> "lru.next has bit 1 set if the page is allocated from the
> pfmemalloc reserves. Callers may simply overwrite it if they
> do not need to preserve that information."
> 
> The page->signature is or’ed with PP_SIGNATURE when a page is
> allocated in page pool, see __page_pool_alloc_pages_slow(),
> and page->signature is checked directly with PP_SIGNATURE in
> page_pool_return_skb_page(), which might cause resoure leaking
> problem for a page from page pool if bit 1 of lru.next is set for
> a pfmemalloc page.
> 
> As bit 0 is page->compound_head, So mask both bit 0 and 1 before
> the checking in page_pool_return_skb_page().

No, you don't understand.  We *want* the check to fail if we were low
on memory so we return the emergency allocation.