On Fri, Mar 20, 2015 at 01:36:30PM -0700, [email protected] wrote: > > The patch titled > Subject: mm: sanitize page->mapping for tail pages > has been added to the -mm tree. Its filename is > mm-sanitize-page-mapping-for-tail-pages.patch > > This patch should soon appear at > > http://ozlabs.org/~akpm/mmots/broken-out/mm-sanitize-page-mapping-for-tail-pages.patch > and later at > > http://ozlabs.org/~akpm/mmotm/broken-out/mm-sanitize-page-mapping-for-tail-pages.patch > > Before you just go and hit "reply", please: > a) Consider who else should be cc'ed > b) Prefer to cc a suitable mailing list as well > c) Ideally: find the original patch on the mailing list and do a > reply-to-all to that, adding suitable additional cc's > > *** Remember to use Documentation/SubmitChecklist when testing your code *** > > The -mm tree is included into linux-next and is updated > there every 3-4 working days > > ------------------------------------------------------ > From: "Kirill A. Shutemov" <[email protected]> > Subject: mm: sanitize page->mapping for tail pages > > We don't define meaning of page->mapping for tail pages. Currently it's > always NULL, which can be inconsistent with head page and potentially lead > to problems. > > Let's poison the pointer to catch all illigal uses. > > page_rmapping() and page_mapping() are changed to look on head page.
Could you replace the patch with the patch below. It also takes care about page_anon_vma(). >From fa89941045b74fa9912758267813b904443b023a Mon Sep 17 00:00:00 2001 From: "Kirill A. Shutemov" <[email protected]> Date: Thu, 2 Apr 2015 09:28:20 +1100 Subject: [PATCH] mm: sanitize page->mapping for tail pages We don't define meaning of page->mapping for tail pages. Currently it's always NULL, which can be inconsistent with head page and potentially lead to problems. Let's poison the pointer to catch all illigal uses. page_rmapping(), page_mapping() and page_anon_vma() are changed to look on head page. The only illegal use I've caught so far is __GPF_COMP pages from sound subsystem, mapped with PTEs. do_shared_fault() is changed to use page_rmapping() instead of direct access to fault_page->mapping. Signed-off-by: Kirill A. Shutemov <[email protected]> Cc: Andrea Arcangeli <[email protected]> Cc: Hugh Dickins <[email protected]> Cc: Dave Hansen <[email protected]> Cc: Mel Gorman <[email protected]> Cc: Rik van Riel <[email protected]> Cc: Vlastimil Babka <[email protected]> Cc: Christoph Lameter <[email protected]> Cc: Naoya Horiguchi <[email protected]> Cc: Steve Capper <[email protected]> Cc: "Aneesh Kumar K.V" <[email protected]> Cc: Johannes Weiner <[email protected]> Cc: Michal Hocko <[email protected]> Cc: Jerome Marchand <[email protected]> Signed-off-by: Andrew Morton <[email protected]> Signed-off-by: Kirill A. Shutemov <[email protected]> --- include/linux/mm.h | 1 + include/linux/poison.h | 4 ++++ include/linux/rmap.h | 1 + mm/huge_memory.c | 2 +- mm/memory.c | 2 +- mm/page_alloc.c | 7 +++++++ mm/util.c | 5 ++++- 7 files changed, 19 insertions(+), 3 deletions(-) diff --git a/include/linux/mm.h b/include/linux/mm.h index 9287fffd9f0d..16fe322b66ea 100644 --- a/include/linux/mm.h +++ b/include/linux/mm.h @@ -915,6 +915,7 @@ extern struct address_space *page_mapping(struct page *page); /* Neutral page->mapping pointer to address_space or anon_vma or other */ static inline void *page_rmapping(struct page *page) { + page = compound_head(page); return (void *)((unsigned long)page->mapping & ~PAGE_MAPPING_FLAGS); } diff --git a/include/linux/poison.h b/include/linux/poison.h index 2110a81c5e2a..7b2a7fcde6a3 100644 --- a/include/linux/poison.h +++ b/include/linux/poison.h @@ -32,6 +32,10 @@ /********** mm/debug-pagealloc.c **********/ #define PAGE_POISON 0xaa +/********** mm/page_alloc.c ************/ + +#define TAIL_MAPPING ((void *) 0x01014A11 + POISON_POINTER_DELTA) + /********** mm/slab.c **********/ /* * Magic nums for obj red zoning. diff --git a/include/linux/rmap.h b/include/linux/rmap.h index c4c559a45dc8..6e7b0443afb0 100644 --- a/include/linux/rmap.h +++ b/include/linux/rmap.h @@ -107,6 +107,7 @@ static inline void put_anon_vma(struct anon_vma *anon_vma) static inline struct anon_vma *page_anon_vma(struct page *page) { + page = compound_head(page); if (((unsigned long)page->mapping & PAGE_MAPPING_FLAGS) != PAGE_MAPPING_ANON) return NULL; diff --git a/mm/huge_memory.c b/mm/huge_memory.c index 3afb5cbe1312..7ce6b6c2d1f4 100644 --- a/mm/huge_memory.c +++ b/mm/huge_memory.c @@ -1703,7 +1703,7 @@ static void __split_huge_page_refcount(struct page *page, */ page_tail->_mapcount = page->_mapcount; - BUG_ON(page_tail->mapping); + BUG_ON(page_tail->mapping != TAIL_MAPPING); page_tail->mapping = page->mapping; page_tail->index = page->index + i; diff --git a/mm/memory.c b/mm/memory.c index ac20b2a6a0c3..fc91fcb407cc 100644 --- a/mm/memory.c +++ b/mm/memory.c @@ -3033,7 +3033,7 @@ static int do_shared_fault(struct mm_struct *mm, struct vm_area_struct *vma, * pinned by vma->vm_file's reference. We rely on unlock_page()'s * release semantics to prevent the compiler from undoing this copying. */ - mapping = fault_page->mapping; + mapping = page_rmapping(fault_page); unlock_page(fault_page); if ((dirtied || vma->vm_ops->page_mkwrite) && mapping) { /* diff --git a/mm/page_alloc.c b/mm/page_alloc.c index 1b849500640c..e73ecbbfa69f 100644 --- a/mm/page_alloc.c +++ b/mm/page_alloc.c @@ -373,6 +373,7 @@ void prep_compound_page(struct page *page, unsigned long order) for (i = 1; i < nr_pages; i++) { struct page *p = page + i; set_page_count(p, 0); + p->mapping = TAIL_MAPPING; p->first_page = page; /* Make sure p->first_page is always valid for PageTail() */ smp_wmb(); @@ -765,6 +766,12 @@ static void free_one_page(struct zone *zone, static int free_tail_pages_check(struct page *head_page, struct page *page) { + if (page->mapping != TAIL_MAPPING) { + bad_page(page, "corrupted mapping in tail page", 0); + page->mapping = NULL; + return 1; + } + page->mapping = NULL; if (!IS_ENABLED(CONFIG_DEBUG_VM)) return 0; if (unlikely(!PageTail(page))) { diff --git a/mm/util.c b/mm/util.c index 3981ae9d1b15..e78968bd11e7 100644 --- a/mm/util.c +++ b/mm/util.c @@ -327,7 +327,10 @@ EXPORT_SYMBOL(kvfree); struct address_space *page_mapping(struct page *page) { - struct address_space *mapping = page->mapping; + struct address_space *mapping; + + page = compound_head(page); + mapping = page->mapping; /* This happens if someone calls flush_dcache_page on slab page */ if (unlikely(PageSlab(page))) -- Kirill A. Shutemov -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to [email protected] More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
