linux-kernel - Re: [PATCH v2] mm: page_alloc: check the order of compound page even when the order is zero

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Fri, 27 Oct 2023 15:54:24 +0200
From:   David Hildenbrand <david@...hat.com>
To:     Hyesoo Yu <hyesoo.yu@...sung.com>
Cc:     Vishal Moola <vishal.moola@...il.com>,
        Andrew Morton <akpm@...ux-foundation.org>, linux-mm@...ck.org,
        linux-kernel@...r.kernel.org
Subject: Re: [PATCH v2] mm: page_alloc: check the order of compound page even
 when the order is zero

On 23.10.23 10:32, Hyesoo Yu wrote:
> For compound pages, the head sets the PG_head flag and
> the tail sets the compound_head to indicate the head page.
> If a user allocates a compound page and frees it with a different
> order, the compound page information will not be properly
> initialized. To detect this problem, compound_order(page) and
> the order argument are compared, but this is not checked
> when the order argument is zero. That error should be checked
> regardless of the order.
> 
> Reviewed-by: Vishal Moola (Oracle) <vishal.moola@...il.com>
> Signed-off-by: Hyesoo Yu <hyesoo.yu@...sung.com>
> ---
>   mm/page_alloc.c | 6 +++---
>   1 file changed, 3 insertions(+), 3 deletions(-)
> 
> diff --git a/mm/page_alloc.c b/mm/page_alloc.c
> index 95546f376302..fc92ac93c7c8 100644
> --- a/mm/page_alloc.c
> +++ b/mm/page_alloc.c
> @@ -1078,6 +1078,7 @@ static __always_inline bool free_pages_prepare(struct page *page,
>   	int bad = 0;
>   	bool skip_kasan_poison = should_skip_kasan_poison(page, fpi_flags);
>   	bool init = want_init_on_free();
> +	bool compound = PageCompound(page);
>   
>   	VM_BUG_ON_PAGE(PageTail(page), page);
>   
> @@ -1096,16 +1097,15 @@ static __always_inline bool free_pages_prepare(struct page *page,
>   		return false;
>   	}
>   
> +	VM_BUG_ON_PAGE(compound && compound_order(page) != order, page);
> +
>   	/*
>   	 * Check tail pages before head page information is cleared to
>   	 * avoid checking PageCompound for order-0 pages.
>   	 */
>   	if (unlikely(order)) {
> -		bool compound = PageCompound(page);
>   		int i;
>   
> -		VM_BUG_ON_PAGE(compound && compound_order(page) != order, page);
> -
>   		if (compound)
>   			page[1].flags &= ~PAGE_FLAGS_SECOND;
>   		for (i = 1; i < (1 << order); i++) {

Acked-by: David Hildenbrand <david@...hat.com>

-- 
Cheers,

David / dhildenb