linux-kernel - [PATCH 1/2] mm: page_frag: Check fragsz at the beginning of __page_frag_alloc

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <1743715309-318-2-git-send-email-haiyangz@microsoft.com>
Date: Thu,  3 Apr 2025 14:21:48 -0700
From: Haiyang Zhang <haiyangz@...rosoft.com>
To: linux-hyperv@...r.kernel.org,
	akpm@...ux-foundation.org,
	corbet@....net,
	linux-mm@...ck.org,
	linux-doc@...r.kernel.org
Cc: haiyangz@...rosoft.com,
	decui@...rosoft.com,
	kys@...rosoft.com,
	paulros@...rosoft.com,
	olaf@...fle.de,
	vkuznets@...hat.com,
	davem@...emloft.net,
	wei.liu@...nel.org,
	longli@...rosoft.com,
	linux-kernel@...r.kernel.org
Subject: [PATCH 1/2] mm: page_frag: Check fragsz at the beginning of __page_frag_alloc_align()

Frag allocator is not designed for fragsz > PAGE_SIZE. So, check and return
the error at the beginning of __page_frag_alloc_align(), instead of
succeed for a few times, then fail due to not refilling the cache.

Signed-off-by: Haiyang Zhang <haiyangz@...rosoft.com>
---
 mm/page_frag_cache.c | 22 +++++++++-------------
 1 file changed, 9 insertions(+), 13 deletions(-)

diff --git a/mm/page_frag_cache.c b/mm/page_frag_cache.c
index d2423f30577e..d6bf022087e7 100644
--- a/mm/page_frag_cache.c
+++ b/mm/page_frag_cache.c
@@ -98,6 +98,15 @@ void *__page_frag_alloc_align(struct page_frag_cache *nc,
 	unsigned int size, offset;
 	struct page *page;
 
+	if (unlikely(fragsz > PAGE_SIZE)) {
+		/*
+		 * The caller is trying to allocate a fragment
+		 * with fragsz > PAGE_SIZE which is not supported
+		 * by design. So we simply return NULL here.
+		 */
+		return NULL;
+	}
+
 	if (unlikely(!encoded_page)) {
 refill:
 		page = __page_frag_cache_refill(nc, gfp_mask);
@@ -119,19 +128,6 @@ void *__page_frag_alloc_align(struct page_frag_cache *nc,
 	size = PAGE_SIZE << encoded_page_decode_order(encoded_page);
 	offset = __ALIGN_KERNEL_MASK(nc->offset, ~align_mask);
 	if (unlikely(offset + fragsz > size)) {
-		if (unlikely(fragsz > PAGE_SIZE)) {
-			/*
-			 * The caller is trying to allocate a fragment
-			 * with fragsz > PAGE_SIZE but the cache isn't big
-			 * enough to satisfy the request, this may
-			 * happen in low memory conditions.
-			 * We don't release the cache page because
-			 * it could make memory pressure worse
-			 * so we simply return NULL here.
-			 */
-			return NULL;
-		}
-
 		page = encoded_page_decode_page(encoded_page);
 
 		if (!page_ref_sub_and_test(page, nc->pagecnt_bias))
-- 
2.34.1