mirror of
https://github.com/edk2-porting/linux-next.git
synced 2024-12-15 16:53:54 +08:00
mm: sanitize page->mapping for tail pages
We don't define meaning of page->mapping for tail pages. Currently it's always NULL, which can be inconsistent with head page and potentially lead to problems. Let's poison the pointer to catch all illigal uses. page_rmapping(), page_mapping() and page_anon_vma() are changed to look on head page. The only illegal use I've caught so far is __GPF_COMP pages from sound subsystem, mapped with PTEs. do_shared_fault() is changed to use page_rmapping() instead of direct access to fault_page->mapping. Signed-off-by: Kirill A. Shutemov <kirill.shutemov@linux.intel.com> Reviewed-by: Jérôme Glisse <jglisse@redhat.com> Cc: Andrea Arcangeli <aarcange@redhat.com> Cc: Hugh Dickins <hughd@google.com> Cc: Dave Hansen <dave.hansen@intel.com> Cc: Mel Gorman <mgorman@suse.de> Cc: Rik van Riel <riel@redhat.com> Cc: Vlastimil Babka <vbabka@suse.cz> Cc: Christoph Lameter <cl@linux.com> Cc: Naoya Horiguchi <n-horiguchi@ah.jp.nec.com> Cc: Steve Capper <steve.capper@linaro.org> Cc: "Aneesh Kumar K.V" <aneesh.kumar@linux.vnet.ibm.com> Cc: Johannes Weiner <hannes@cmpxchg.org> Cc: Michal Hocko <mhocko@suse.cz> Cc: Jerome Marchand <jmarchan@redhat.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
This commit is contained in:
parent
822cdd1152
commit
1c290f6421
@ -32,6 +32,10 @@
|
||||
/********** mm/debug-pagealloc.c **********/
|
||||
#define PAGE_POISON 0xaa
|
||||
|
||||
/********** mm/page_alloc.c ************/
|
||||
|
||||
#define TAIL_MAPPING ((void *) 0x01014A11 + POISON_POINTER_DELTA)
|
||||
|
||||
/********** mm/slab.c **********/
|
||||
/*
|
||||
* Magic nums for obj red zoning.
|
||||
|
@ -1805,7 +1805,7 @@ static void __split_huge_page_refcount(struct page *page,
|
||||
*/
|
||||
page_tail->_mapcount = page->_mapcount;
|
||||
|
||||
BUG_ON(page_tail->mapping);
|
||||
BUG_ON(page_tail->mapping != TAIL_MAPPING);
|
||||
page_tail->mapping = page->mapping;
|
||||
|
||||
page_tail->index = page->index + i;
|
||||
|
@ -3096,7 +3096,7 @@ static int do_shared_fault(struct mm_struct *mm, struct vm_area_struct *vma,
|
||||
* pinned by vma->vm_file's reference. We rely on unlock_page()'s
|
||||
* release semantics to prevent the compiler from undoing this copying.
|
||||
*/
|
||||
mapping = fault_page->mapping;
|
||||
mapping = page_rmapping(fault_page);
|
||||
unlock_page(fault_page);
|
||||
if ((dirtied || vma->vm_ops->page_mkwrite) && mapping) {
|
||||
/*
|
||||
|
@ -466,6 +466,7 @@ void prep_compound_page(struct page *page, unsigned int order)
|
||||
for (i = 1; i < nr_pages; i++) {
|
||||
struct page *p = page + i;
|
||||
set_page_count(p, 0);
|
||||
p->mapping = TAIL_MAPPING;
|
||||
set_compound_head(p, page);
|
||||
}
|
||||
}
|
||||
@ -856,6 +857,10 @@ static int free_tail_pages_check(struct page *head_page, struct page *page)
|
||||
ret = 0;
|
||||
goto out;
|
||||
}
|
||||
if (page->mapping != TAIL_MAPPING) {
|
||||
bad_page(page, "corrupted mapping in tail page", 0);
|
||||
goto out;
|
||||
}
|
||||
if (unlikely(!PageTail(page))) {
|
||||
bad_page(page, "PageTail not set", 0);
|
||||
goto out;
|
||||
@ -866,6 +871,7 @@ static int free_tail_pages_check(struct page *head_page, struct page *page)
|
||||
}
|
||||
ret = 0;
|
||||
out:
|
||||
page->mapping = NULL;
|
||||
clear_compound_head(page);
|
||||
return ret;
|
||||
}
|
||||
|
10
mm/util.c
10
mm/util.c
@ -386,7 +386,9 @@ struct anon_vma *page_anon_vma(struct page *page)
|
||||
|
||||
struct address_space *page_mapping(struct page *page)
|
||||
{
|
||||
unsigned long mapping;
|
||||
struct address_space *mapping;
|
||||
|
||||
page = compound_head(page);
|
||||
|
||||
/* This happens if someone calls flush_dcache_page on slab page */
|
||||
if (unlikely(PageSlab(page)))
|
||||
@ -399,10 +401,10 @@ struct address_space *page_mapping(struct page *page)
|
||||
return swap_address_space(entry);
|
||||
}
|
||||
|
||||
mapping = (unsigned long)page->mapping;
|
||||
if (mapping & PAGE_MAPPING_FLAGS)
|
||||
mapping = page->mapping;
|
||||
if ((unsigned long)mapping & PAGE_MAPPING_FLAGS)
|
||||
return NULL;
|
||||
return page->mapping;
|
||||
return mapping;
|
||||
}
|
||||
|
||||
int overcommit_ratio_handler(struct ctl_table *table, int write,
|
||||
|
Loading…
Reference in New Issue
Block a user