linux-kernel - [PATCH] mm: avoid VM_BUG_ON when try to map an anon large folio to zero page.

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20241023171236.1122535-1-ziy@nvidia.com>
Date: Wed, 23 Oct 2024 13:12:36 -0400
From: Zi Yan <ziy@...dia.com>
To: linux-mm@...ck.org,
	Andrew Morton <akpm@...ux-foundation.org>
Cc: usamaarif642@...il.com,
	baohua@...nel.org,
	cerasuolodomenico@...il.com,
	corbet@....net,
	david@...hat.com,
	hannes@...xchg.org,
	kernel-team@...a.com,
	linux-doc@...r.kernel.org,
	linux-kernel@...r.kernel.org,
	npache@...hat.com,
	riel@...riel.com,
	roman.gushchin@...ux.dev,
	rppt@...nel.org,
	ryan.roberts@....com,
	ryncsn@...il.com,
	shakeel.butt@...ux.dev,
	willy@...radead.org,
	yuzhao@...gle.com,
	Zi Yan <ziy@...dia.com>
Subject: [PATCH] mm: avoid VM_BUG_ON when try to map an anon large folio to zero page.

An anonymous large folio can be split into non order-0 folios,
try_to_map_unused_to_zeropage() should not VM_BUG_ON compound pages but
just return false. This fixes the crash when splitting anonymous large
folios to non order-0 folios.

Fixes: b1f202060afe ("mm: remap unused subpages to shared zeropage when splitting isolated thp")
Signed-off-by: Zi Yan <ziy@...dia.com>
---
 mm/migrate.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/mm/migrate.c b/mm/migrate.c
index e950fd62607f..7ffdbe078aa7 100644
--- a/mm/migrate.c
+++ b/mm/migrate.c
@@ -206,7 +206,8 @@ static bool try_to_map_unused_to_zeropage(struct page_vma_mapped_walk *pvmw,
 	pte_t newpte;
 	void *addr;
 
-	VM_BUG_ON_PAGE(PageCompound(page), page);
+	if (PageCompound(page))
+		return false;
 	VM_BUG_ON_PAGE(!PageAnon(page), page);
 	VM_BUG_ON_PAGE(!PageLocked(page), page);
 	VM_BUG_ON_PAGE(pte_present(*pvmw->pte), page);
-- 
2.45.2