linux-kernel - Re: [PATCH RFC] mm: entirely reuse the whole anon mTHP in do_wp

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <c0f79761-f753-4df7-9d02-3bbcbfbd902f@redhat.com>
Date: Sat, 31 Aug 2024 11:59:12 +0200
From: David Hildenbrand <david@...hat.com>
To: Barry Song <21cnbao@...il.com>, akpm@...ux-foundation.org,
 linux-mm@...ck.org
Cc: linux-kernel@...r.kernel.org, Barry Song <v-songbaohua@...o.com>,
 Chuanhua Han <hanchuanhua@...o.com>,
 Baolin Wang <baolin.wang@...ux.alibaba.com>,
 Ryan Roberts <ryan.roberts@....com>, Zi Yan <ziy@...dia.com>,
 Chris Li <chrisl@...nel.org>, Kairui Song <kasong@...cent.com>,
 Kalesh Singh <kaleshsingh@...gle.com>, Suren Baghdasaryan <surenb@...gle.com>
Subject: Re: [PATCH RFC] mm: entirely reuse the whole anon mTHP in do_wp_page


> +		idx = folio_page_idx(folio, vmf->page);
> +		folio_start = address - idx * PAGE_SIZE;
> +		folio_end = folio_start + nr * PAGE_SIZE;
> +
> +		if (unlikely(folio_start < max(address & PMD_MASK, vma->vm_start)))
> +			return false;
> +		if (unlikely(folio_end > pmd_addr_end(address, vma->vm_end)))
> +			return false;
> +		folio_ptep = vmf->pte - idx;
> +		folio_pte = ptep_get(folio_ptep);
> +		if (!pte_present(folio_pte) || pte_pfn(folio_pte) != folio_pfn(folio))
> +			return false;
> +		if (folio_pte_batch(folio, folio_start, folio_ptep, folio_pte, nr, 0,
> +				NULL, NULL, NULL) != nr)
> +			return false;
> +		if (folio_mapcount(folio) != nr)
> +			return false;

BTW, you're not checking against the refcount (and it's all a bit racy 
on concurrent unmapping!). So you're re-introducing the vmsplice 
child->parent attak.

-- 
Cheers,

David / dhildenb