netdev - Re:Re: [PATCH V3] mm: prevent page_frag_alloc() from corrupting the memory

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Mon, 18 Jul 2022 22:40:07 +0800 (CST)
From:   "Chen Lin" <chen45464546@....com>
To:     "Maurizio Lombardi" <mlombard@...hat.com>
Cc:     "Alexander Duyck" <alexander.duyck@...il.com>,
        "Jakub Kicinski" <kuba@...nel.org>,
        "Andrew Morton" <akpm@...ux-foundation.org>,
        linux-mm <linux-mm@...ck.org>,
        LKML <linux-kernel@...r.kernel.org>,
        Netdev <netdev@...r.kernel.org>
Subject: Re:Re: [PATCH V3] mm: prevent page_frag_alloc() from corrupting the
 memory


At 2022-07-18 21:50:41, "Maurizio Lombardi" <mlombard@...hat.com> wrote:
>po 18. 7. 2022 v 15:14 odesílatel Chen Lin <chen45464546@....com> napsal:
>> ----------------------------------------
>> If we can accept adding a branch to this process, why not add it at the beginning like below?
>> The below changes are also more in line with the definition of "page fragment",
>> which i mean the above changes may make the allocation of more than one page successful.
>>
>> index 7a28f7d..9d09ea5 100644
>> --- a/mm/page_alloc.c
>> +++ b/mm/page_alloc.c
>> @@ -5551,6 +5551,8 @@ void *page_frag_alloc_align(struct page_frag_cache *nc,
>>
>>         offset = nc->offset - fragsz;
>>         if (unlikely(offset < 0)) {
>> +               if (unlikely(fragsz > PAGE_SIZE))
>> +                       return NULL;
>>                 page = virt_to_page(nc->va);
>>
>>                 if (!page_ref_sub_and_test(page, nc->pagecnt_bias))
>>
>
>This will make *all* page_frag_alloc() calls with fragsz > PAGE_SIZE
>fail, so it will
>basically break all those drivers that are relying on the current behaviour.
>With my patch it will return NULL only if the cache isn't big enough.
>
>Maurizio.

But the original intention of page frag interface is indeed to allocate memory 
less than one page. It's not a good idea to  complicate the definition of 
"page fragment".

Furthermore, the patch above is easier to synchronize to lower versions.