linux-kernel - Re: [PATCH] mm/page_isolation: don't putback unisolated page

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <b0a2947b-360a-40c2-03e4-f0f67845f4c3@huawei.com>
Date:   Mon, 6 Sep 2021 20:45:13 +0800
From:   Miaohe Lin <linmiaohe@...wei.com>
To:     David Hildenbrand <david@...hat.com>, <akpm@...ux-foundation.org>
CC:     <vbabka@...e.cz>, <iamjoonsoo.kim@....com>, <linux-mm@...ck.org>,
        <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH] mm/page_isolation: don't putback unisolated page

On 2021/9/6 20:11, David Hildenbrand wrote:
> On 06.09.21 14:02, David Hildenbrand wrote:
>> On 04.09.21 11:18, Miaohe Lin wrote:
>>> If __isolate_free_page() failed, due to zone watermark check, the page is
>>> still on the free list. But this page will be put back to free list again
>>> via __putback_isolated_page() now. This may trigger page->flags checks in
>>> __free_one_page() if PageReported is set. Or we will corrupt the free list
>>> because list_add() will be called for pages already on another list.
>>>
>>> Fixes: 3c605096d315 ("mm/page_alloc: restrict max order of merging on isolated pageblock")
>>> Signed-off-by: Miaohe Lin <linmiaohe@...wei.com>
>>> ---
>>>    mm/page_isolation.c | 6 ++----
>>>    1 file changed, 2 insertions(+), 4 deletions(-)
>>>
>>> diff --git a/mm/page_isolation.c b/mm/page_isolation.c
>>> index 9bb562d5d194..7d70d772525c 100644
>>> --- a/mm/page_isolation.c
>>> +++ b/mm/page_isolation.c
>>> @@ -93,10 +93,8 @@ static void unset_migratetype_isolate(struct page *page, unsigned migratetype)
>>>                buddy_pfn = __find_buddy_pfn(pfn, order);
>>>                buddy = page + (buddy_pfn - pfn);
>>>    -            if (!is_migrate_isolate_page(buddy)) {
>>> -                __isolate_free_page(page, order);
>>> -                isolated_page = true;
>>> -            }
>>> +            if (!is_migrate_isolate_page(buddy))
>>> +                isolated_page = !!__isolate_free_page(page, order);
>>>            }
>>>        }
>>>   
>>
>> Thanks!
>>
>> Reviewed-by: David Hildenbrand <david@...hat.com>
>>
> 
> To make the confusion perfect (sorry) :D I tripple-checked:
> 
> In unset_migratetype_isolate() we check that is_migrate_isolate_page(page) holds, otherwise we return.
> 
> We call __isolate_free_page() only for such pages.
> 
> __isolate_free_page() won't perform watermark checks on is_migrate_isolate().
> 
> Consequently, __isolate_free_page() should never fail when called from unset_migratetype_isolate()
> 
> If that's correct then we  could instead maybe add a VM_BUG_ON() and a comment why this can't fail.
> 
> 
> Makes sense or am I missing something?

I think you're right. __isolate_free_page() should never fail when called from unset_migratetype_isolate()
as explained by you. But it might be too fragile to reply on the failure conditions of __isolate_free_page().
If that changes, VM_BUG_ON() here might trigger unexpectedly. Or am I just over-worried as failure conditions
of __isolate_free_page() can hardly change?

Many thanks. :)

>