lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Message-ID: <CAFL455=bAEXeyUPjDPZm-hK-K8aKJSw7wRQ0CCYoKWO8VMJUqw@mail.gmail.com> Date: Wed, 6 Jul 2022 17:21:31 +0200 From: Maurizio Lombardi <mlombard@...hat.com> To: Alexander Duyck <alexander.duyck@...il.com> Cc: 愚树 <chen45464546@....com>, Jakub Kicinski <kuba@...nel.org>, Andrew Morton <akpm@...ux-foundation.org>, linux-mm <linux-mm@...ck.org>, LKML <linux-kernel@...r.kernel.org>, Netdev <netdev@...r.kernel.org> Subject: Re: Re: [PATCH v2] mm: page_frag: Warn_on when frag_alloc size is bigger than PAGE_SIZE st 1. 6. 2022 v 17:05 odesílatel Alexander Duyck <alexander.duyck@...il.com> napsal: > > diff --git a/mm/page_alloc.c b/mm/page_alloc.c > > index e6f211d..ac60a97 100644 > > --- a/mm/page_alloc.c > > +++ b/mm/page_alloc.c > > @@ -5580,6 +5580,7 @@ void *page_frag_alloc_align(struct page_frag_cache *nc, > > /* reset page count bias and offset to start of new frag */ > > nc->pagecnt_bias = PAGE_FRAG_CACHE_MAX_SIZE + 1; > > offset = size - fragsz; > > + BUG_ON(offset < 0); > > } > > > > nc->pagecnt_bias--; > > > > > I think I could be onboard with a patch like this. The test shouldn't > add more than 1 instruction since it is essentially just a jump if > signed test which will be performed after the size - fragsz check. FYI, I hit this problem a few days ago with the nfp network driver, it uses page_frag_alloc() with a frag size larger than PAGE_SIZE when MTU is set to 9000, this may result in memory corruptions when the system runs out of memory. The solution I was working on was something like the following, this makes the allocation fail if fragsz is greater than the cache size. diff --git a/mm/page_alloc.c b/mm/page_alloc.c index 4dc0d333279f..c6b40b85c55d 100644 --- a/mm/page_alloc.c +++ b/mm/page_alloc.c @@ -5544,12 +5544,17 @@ void *page_frag_alloc_align(struct page_frag_cache *nc, /* if size can vary use size else just use PAGE_SIZE */ size = nc->size; #endif - /* OK, page count is 0, we can safely set it */ - set_page_count(page, PAGE_FRAG_CACHE_MAX_SIZE + 1); - /* reset page count bias and offset to start of new frag */ nc->pagecnt_bias = PAGE_FRAG_CACHE_MAX_SIZE + 1; offset = size - fragsz; + if (unlikely(offset < 0)) { + free_the_page(page, compound_order(page)); + nc->va = NULL; + return NULL; + } + + /* OK, page count is 0, we can safely set it */ + set_page_count(page, PAGE_FRAG_CACHE_MAX_SIZE + 1); } nc->pagecnt_bias--; Maurizio
Powered by blists - more mailing lists