mm/debug.c: do not dereference i_ino blindly (853322a6) · Commits · 戴 / test

__dump_page() checks i_dentry is fetchable and i_ino is earlier in the struct than i_ino, so it ought to work fine, but it's possible that struct randomisation has reordered i_ino after i_dentry and the pointer is just wild enough that i_dentry is fetchable and i_ino isn't. Also print the inode number if the dentry is invalid. Reported-by:

Vlastimil Babka <vbabka@suse.cz> Signed-off-by:

Matthew Wilcox (Oracle) <willy@infradead.org> Signed-off-by:

Andrew Morton <akpm@linux-foundation.org> Reviewed-by:

John Hubbard <jhubbard@nvidia.com> Reviewed-by:

Mike Rapoport <rppt@linux.ibm.com> Link: https://lkml.kernel.org/r/20200819185710.28180-1-willy@infradead.org Signed-off-by:

Linus Torvalds <torvalds@linux-foundation.org>

mm/debug.c

+7 −5

Original line number	Diff line number	Diff line
		@@ -120,6 +120,7 @@ void __dump_page(struct page page, const char reason)
		struct hlist_node *dentry_first;
		struct dentry *dentry_ptr;
		struct dentry dentry;
		unsigned long ino;

		/*
		* mapping can be invalid pointer and we don't want to crash
		@@ -136,21 +137,22 @@ void __dump_page(struct page page, const char reason)
		goto out_mapping;
		}

		if (get_kernel_nofault(dentry_first, &host->i_dentry.first)) {
		if (get_kernel_nofault(dentry_first, &host->i_dentry.first) \|\|
		get_kernel_nofault(ino, &host->i_ino)) {
		pr_warn("aops:%ps with invalid host inode %px\n",
		a_ops, host);
		goto out_mapping;
		}

		if (!dentry_first) {
		pr_warn("aops:%ps ino:%lx\n", a_ops, host->i_ino);
		pr_warn("aops:%ps ino:%lx\n", a_ops, ino);
		goto out_mapping;
		}

		dentry_ptr = container_of(dentry_first, struct dentry, d_u.d_alias);
		if (get_kernel_nofault(dentry, dentry_ptr)) {
		pr_warn("aops:%ps with invalid dentry %px\n", a_ops,
		dentry_ptr);
		pr_warn("aops:%ps ino:%lx with invalid dentry %px\n",
		a_ops, ino, dentry_ptr);
		} else {
		/*
		* if dentry is corrupted, the %pd handler may still
		@@ -158,7 +160,7 @@ void __dump_page(struct page page, const char reason)
		* corrupted struct page
		*/
		pr_warn("aops:%ps ino:%lx dentry name:\"%pd\"\n",
		a_ops, host->i_ino, &dentry);
		a_ops, ino, &dentry);
		}
		}
		out_mapping:

Admin message