linux-kernel - [PATCH] mm/hugetlb: Guard dequeue_hugetlb_folio_nodemask against NUMA_NO

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date: Wed, 12 Jun 2024 10:29:36 +0200
From: Oscar Salvador <osalvador@...e.de>
To: Andrew Morton <akpm@...ux-foundation.org>
Cc: linux-kernel@...r.kernel.org,
	linux-mm@...ck.org,
	Muchun Song <muchun.song@...ux.dev>,
	Vivek Kasireddy <vivek.kasireddy@...el.com>,
	Oscar Salvador <osalvador@...e.de>,
	syzbot+569ed13f4054f271087b@...kaller.appspotmail.com
Subject: [PATCH] mm/hugetlb: Guard dequeue_hugetlb_folio_nodemask against NUMA_NO_NODE uses

dequeue_hugetlb_folio_nodemask() expects a preferred node where to get the
hugetlb page from.
It does not expect, though, users to pass NUMA_NO_NODE, otherwise we will
get trash when trying to get the zonelist from that node.
All current users are careful enough to not pass NUMA_NO_NODE, but
it opens the door for new users to get this wrong since it is not
documented [0].
Guard against this by getting the local nid if NUMA_NO_NODE was passed.

[0] https://lore.kernel.org/linux-mm/0000000000004f12bb061a9acf07@google.com/

Closes: https://lore.kernel.org/linux-mm/0000000000004f12bb061a9acf07@google.com/
Reported-and-tested-by: syzbot+569ed13f4054f271087b@...kaller.appspotmail.com
Signed-off-by: Oscar Salvador <osalvador@...e.de>
---
 mm/hugetlb.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/mm/hugetlb.c b/mm/hugetlb.c
index 3518321f6598..6a5ea898e4da 100644
--- a/mm/hugetlb.c
+++ b/mm/hugetlb.c
@@ -1355,6 +1355,10 @@ static struct folio *dequeue_hugetlb_folio_nodemask(struct hstate *h, gfp_t gfp_
 	struct zoneref *z;
 	int node = NUMA_NO_NODE;
 
+	/* 'nid' should not be NUMA_NO_NODE. Try to catch any misuse of it and rectifiy. */
+	if (nid == NUMA_NO_NODE)
+		nid = numa_node_id();
+
 	zonelist = node_zonelist(nid, gfp_mask);
 
 retry_cpuset:
-- 
2.45.2