linux-kernel - Question regarding map count for compound pages

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <OFC84A937E.DCF95A5F-ON0025878A.0080F49D-8525878B.0070F4CB@ibm.com>
Date:   Fri, 12 Nov 2021 16:33:47 -0400
From:   "Harish Mara" <Harish.Mara@....com>
To:     linux-kernel <linux-kernel@...r.kernel.org>
Cc:     "Aniket Kulkarni" <aniket.kulkarni@...ibm.com>,
        "Rajshekar Iyer" <iyerr@...ibm.com>,
        "Pawan Powar" <ppowar@...ibm.com>, ask@...ux.vnet.ibm.com
Subject: Question regarding map count for compound pages

Background:
On older kernel?s, we could have our device driver create char devices and 
implement file_operations and vm_operations for open, release, mmap, fault 
etc. The driver allocates memory (128KB, order 5) as compound pages.
The user application would then map/mmap these device files to perform 
read/write operations.

On recent kernels, this creates problems when the user space maps multiple 
128KB chunks that exceed 2MB. This would sometime result in bad page 
getting mapped to the user space process. Almost always we see ?Bad page 
map? errors during munmap because the map count is going below 0.

It looks like the culprit is zap_pte_range(), which calls 
page_remove_rmap() with the compound_flag = false. As a result, instead of 
decrementing the compound_mapcount for the page the page->_mapcount is 
decremented causing a lot of bad page errors.

Questions:
Is this the right usage of compound pages? I.e can I allocate compound 
pages in my kernel driver to be mapped to char device file by a user 
process?
If yes, then why does it fail on latest kernel when the mmap-ed size 
exceeds 2MB?
If no, why was it working on the older kernels? If it worked then, 
shouldn?t it work now?
What is special about map size being greater than 2MB to trigger this?
Should compound pages be used for Anonymous purposes only?