linux-kernel - Re: [PATCH] mm/huge_memory: Return from zap_huge_pmd after WARN

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Mon, 18 Jul 2022 14:49:33 +0800
From:   Zhou Guanghui <zhouguanghui1@...wei.com>
To:     Matthew Wilcox <willy@...radead.org>
CC:     <akpm@...ux-foundation.org>, <linux-kernel@...r.kernel.org>,
        <linux-mm@...ck.org>, <zi.yan@...rutgers.edu>
Subject: Re: [PATCH] mm/huge_memory: Return from zap_huge_pmd after WARN_ONCE.



On 2022/7/16 1:50, Matthew Wilcox wrote:
> On Fri, Jul 15, 2022 at 09:22:38AM +0000, Zhou Guanghui wrote:
>> After WARN_ONCE is processed, the subsequent page judgment results
>> in NULL pointer access. It is more reasonable to return from the
>> function here.
> 
> I'm not sure this is a good idea.  Probably better to crash than
> continue.

Except present pmd and pmd migration entry, there should be no other possible scenarios. Whether crash or warn is unnecessary. However, the current process that crashes after a warning is reported is not reasonable.

Like this:
if (pmd_present(orig_pmd)) {
	xxx
} else {
	swp_entry_t entry;

	VM_BUG_ON(!is_pmd_migration_entry(orig_pmd));
	entry = pmd_to_swp_entry(orig_pmd);
	page = pfn_to_page(swp_offset(entry));
	flush_needed = 0;
}

Thanks.

> 
>> Signed-off-by: Zhou Guanghui <zhouguanghui1@...wei.com>
>> ---
>>  mm/huge_memory.c | 5 ++++-
>>  1 file changed, 4 insertions(+), 1 deletion(-)
>>
>> diff --git a/mm/huge_memory.c b/mm/huge_memory.c
>> index 834f288b3769..7f5ccca6792a 100644
>> --- a/mm/huge_memory.c
>> +++ b/mm/huge_memory.c
>> @@ -1601,8 +1601,11 @@ int zap_huge_pmd(struct mmu_gather *tlb, struct vm_area_struct *vma,
>>  			entry = pmd_to_swp_entry(orig_pmd);
>>  			page = pfn_swap_entry_to_page(entry);
>>  			flush_needed = 0;
>> -		} else
>> +		} else {
>> +			spin_unlock(ptl);
>>  			WARN_ONCE(1, "Non present huge pmd without pmd migration enabled!");
>> +			return 1;
>> +		}
>>  
>>  		if (PageAnon(page)) {
>>  			zap_deposited_table(tlb->mm, pmd);
>> -- 
>> 2.17.1
>>
>>
> 
> .