Commit 1c290f64 authored by Kirill A. Shutemov's avatar Kirill A. Shutemov Committed by Linus Torvalds
Browse files

mm: sanitize page->mapping for tail pages 



We don't define meaning of page->mapping for tail pages.  Currently it's
always NULL, which can be inconsistent with head page and potentially
lead to problems.

Let's poison the pointer to catch all illigal uses.

page_rmapping(), page_mapping() and page_anon_vma() are changed to look
on head page.

The only illegal use I've caught so far is __GPF_COMP pages from sound
subsystem, mapped with PTEs.  do_shared_fault() is changed to use
page_rmapping() instead of direct access to fault_page->mapping.

Signed-off-by: default avatarKirill A. Shutemov <kirill.shutemov@linux.intel.com>
Reviewed-by: default avatarJérôme Glisse <jglisse@redhat.com>
Cc: Andrea Arcangeli <aarcange@redhat.com>
Cc: Hugh Dickins <hughd@google.com>
Cc: Dave Hansen <dave.hansen@intel.com>
Cc: Mel Gorman <mgorman@suse.de>
Cc: Rik van Riel <riel@redhat.com>
Cc: Vlastimil Babka <vbabka@suse.cz>
Cc: Christoph Lameter <cl@linux.com>
Cc: Naoya Horiguchi <n-horiguchi@ah.jp.nec.com>
Cc: Steve Capper <steve.capper@linaro.org>
Cc: "Aneesh Kumar K.V" <aneesh.kumar@linux.vnet.ibm.com>
Cc: Johannes Weiner <hannes@cmpxchg.org>
Cc: Michal Hocko <mhocko@suse.cz>
Cc: Jerome Marchand <jmarchan@redhat.com>
Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
parent 822cdd11

include/linux/poison.h

+4 −0
Original line number Diff line number Diff line
@@ -32,6 +32,10 @@ 
/********** mm/debug-pagealloc.c **********/

#define PAGE_POISON 0xaa



/********** mm/page_alloc.c ************/



#define TAIL_MAPPING	((void *) 0x01014A11 + POISON_POINTER_DELTA)



/********** mm/slab.c **********/

/*

 * Magic nums for obj red zoning.

mm/huge_memory.c

+1 −1
Original line number Diff line number Diff line
@@ -1805,7 +1805,7 @@ static void __split_huge_page_refcount(struct page *page, 
		*/

		page_tail->_mapcount = page->_mapcount;



		BUG_ON(page_tail->mapping);

		BUG_ON(page_tail->mapping != TAIL_MAPPING);

		page_tail->mapping = page->mapping;



		page_tail->index = page->index + i;

mm/memory.c

+1 −1
Original line number Diff line number Diff line
@@ -3096,7 +3096,7 @@ static int do_shared_fault(struct mm_struct *mm, struct vm_area_struct *vma, 
	 * pinned by vma->vm_file's reference.  We rely on unlock_page()'s

	 * release semantics to prevent the compiler from undoing this copying.

	 */

	mapping = fault_page->mapping;

	mapping = page_rmapping(fault_page);

	unlock_page(fault_page);

	if ((dirtied || vma->vm_ops->page_mkwrite) && mapping) {

		/*

mm/page_alloc.c

+6 −0
Original line number Diff line number Diff line
@@ -466,6 +466,7 @@ void prep_compound_page(struct page *page, unsigned int order) 
	for (i = 1; i < nr_pages; i++) {

		struct page *p = page + i;

		set_page_count(p, 0);

		p->mapping = TAIL_MAPPING;

		set_compound_head(p, page);

	}

}
@@ -856,6 +857,10 @@ static int free_tail_pages_check(struct page *head_page, struct page *page) 
		ret = 0;

		goto out;

	}

	if (page->mapping != TAIL_MAPPING) {

		bad_page(page, "corrupted mapping in tail page", 0);

		goto out;

	}

	if (unlikely(!PageTail(page))) {

		bad_page(page, "PageTail not set", 0);

		goto out;
@@ -866,6 +871,7 @@ static int free_tail_pages_check(struct page *head_page, struct page *page) 
	}

	ret = 0;

out:

	page->mapping = NULL;

	clear_compound_head(page);

	return ret;

}

mm/util.c

+6 −4
Original line number Diff line number Diff line
@@ -386,7 +386,9 @@ struct anon_vma *page_anon_vma(struct page *page) 


struct address_space *page_mapping(struct page *page)

{

	unsigned long mapping;

	struct address_space *mapping;



	page = compound_head(page);



	/* This happens if someone calls flush_dcache_page on slab page */

	if (unlikely(PageSlab(page)))
@@ -399,10 +401,10 @@ struct address_space *page_mapping(struct page *page) 
		return swap_address_space(entry);

	}



	mapping = (unsigned long)page->mapping;

	if (mapping & PAGE_MAPPING_FLAGS)

	mapping = page->mapping;

	if ((unsigned long)mapping & PAGE_MAPPING_FLAGS)

		return NULL;

	return page->mapping;

	return mapping;

}



int overcommit_ratio_handler(struct ctl_table *table, int write,

CRA Git | Maintained and supported by SUSTech CRA and CCSE