lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Tue, 26 Oct 2021 17:38:19 +0000 From: Pasha Tatashin <pasha.tatashin@...een.com> To: pasha.tatashin@...een.com, linux-kernel@...r.kernel.org, linux-mm@...ck.org, linux-m68k@...ts.linux-m68k.org, anshuman.khandual@....com, willy@...radead.org, akpm@...ux-foundation.org, william.kucharski@...cle.com, mike.kravetz@...cle.com, vbabka@...e.cz, geert@...ux-m68k.org, schmitzmic@...il.com, rostedt@...dmis.org, mingo@...hat.com, hannes@...xchg.org, guro@...com, songmuchun@...edance.com, weixugc@...gle.com, gthelen@...gle.com Subject: [RFC 5/8] mm: avoid using set_page_count() when pages are freed into allocator When struct pages are first initialized the page->_refcount field is set 1. However, later when pages are freed into allocator we set _refcount to 0 via set_page_count(). Unconditionally resetting _refcount is dangerous. Instead use page_ref_dec_return(), and verify that the _refcount is what is expected. Signed-off-by: Pasha Tatashin <pasha.tatashin@...een.com> --- mm/page_alloc.c | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) diff --git a/mm/page_alloc.c b/mm/page_alloc.c index 6af4596bddc2..9d18e5f9a85a 100644 --- a/mm/page_alloc.c +++ b/mm/page_alloc.c @@ -1659,6 +1659,7 @@ void __free_pages_core(struct page *page, unsigned int order) unsigned int nr_pages = 1 << order; struct page *p = page; unsigned int loop; + int refcnt; /* * When initializing the memmap, __init_single_page() sets the refcount @@ -1669,10 +1670,12 @@ void __free_pages_core(struct page *page, unsigned int order) for (loop = 0; loop < (nr_pages - 1); loop++, p++) { prefetchw(p + 1); __ClearPageReserved(p); - set_page_count(p, 0); + refcnt = page_ref_dec_return(p); + VM_BUG_ON_PAGE(refcnt, p); } __ClearPageReserved(p); - set_page_count(p, 0); + refcnt = page_ref_dec_return(p); + VM_BUG_ON_PAGE(refcnt, p); atomic_long_add(nr_pages, &page_zone(page)->managed_pages); @@ -2244,10 +2247,12 @@ void __init init_cma_reserved_pageblock(struct page *page) { unsigned i = pageblock_nr_pages; struct page *p = page; + int refcnt; do { __ClearPageReserved(p); - set_page_count(p, 0); + refcnt = page_ref_dec_return(p); + VM_BUG_ON_PAGE(refcnt, p); } while (++p, --i); set_pageblock_migratetype(page, MIGRATE_CMA); -- 2.33.0.1079.g6e70778dc9-goog
Powered by blists - more mailing lists