linux-kernel - Re: [PATCHv2] mm: check high-order page when free it to pcp

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Tue, 20 Sep 2022 11:55:39 +0100
From:   Mel Gorman <mgorman@...hsingularity.net>
To:     Zhaoyang Huang <huangzhaoyang@...il.com>
Cc:     "zhaoyang.huang" <zhaoyang.huang@...soc.com>,
        Andrew Morton <akpm@...ux-foundation.org>,
        "open list:MEMORY MANAGEMENT" <linux-mm@...ck.org>,
        LKML <linux-kernel@...r.kernel.org>, Ke Wang <ke.wang@...soc.com>
Subject: Re: [PATCHv2] mm: check high-order page when free it to pcp

On Tue, Sep 20, 2022 at 05:07:33PM +0800, Zhaoyang Huang wrote:
> On Tue, Sep 20, 2022 at 4:55 PM Mel Gorman <mgorman@...hsingularity.net> wrote:
> >
> > On Tue, Sep 20, 2022 at 08:49:00AM +0800, zhaoyang.huang wrote:
> > > From: Zhaoyang Huang <zhaoyang.huang@...soc.com>
> > >
> > > High-order pcp page escaped from checking when both of DEBUG_VM and debug_pagealloc
> > > are all disabled if it allocated again from pcp_list without going to global
> > > free list, which should be introduced by 44042b4498.
> > >
> > > fix:44042b4498
> > >
> > > Signed-off-by: Zhaoyang Huang <zhaoyang.huang@...soc.com>
> >
> > Why is the order check needed? In this case, I think the comment itself was
> > wrong and should be corrected. free_pcp_prepare is called when dealing with
> > a PCP page being freed and these days that may order-0 or high-order pages.
> > Wieh DEBUG_VM disabled, the pages are checked in by bulkfree_pcp_prepare
> > when freeing pages from PCP to the core allocator. Why would just
> > high-order pages be checked in free_pcp_prepare and checked again in
> > bulkfree_pcp_prepare?
>
> for high-order pcp pages(head page in fact), they might escape from
> bulkfree_pcp_prepare if they were allocated from pcp-list
> again(pcp->count < high) prior to going to core allocator.

This is expected. The DEBUG_VM checks when enabled are more paranoid and are
more likely to catch corruption or a use-after-free issue. For !DEBUG_VM,
there is partial checking which is faster but leaves the possibility that
a corruption of struct page will be missed.

-- 
Mel Gorman
SUSE Labs