Re: [PATCH] mm/khugepaged: Fix invalid page access in release_pte_pages()

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



On 13.02.2023 22:43, Vishal Moola (Oracle) wrote:
> release_pte_pages() converts from a pfn to a folio by using pfn_folio().
> If the pte is not mapped, pfn_folio() will result in undefined behavior
> which ends up causing a kernel panic[1].
>
> Only call pfn_folio() once we have validated that the pte is both valid
> and mapped to fix the issue.
>
> [1] https://lore.kernel.org/linux-mm/ff300770-afe9-908d-23ed-d23e0796e899@xxxxxxxxxxx/
>
> Fixes: 9bdfeea46f49 ("mm/khugepaged: convert release_pte_pages() to use folios")
> Reported-by: Marek Szyprowski <m.szyprowski@xxxxxxxxxxx>
> Debugged-by: Alexandre Ghiti <alex@xxxxxxxx>
> Cc: Matthew Wilcox <willy@xxxxxxxxxxxxx>
> Signed-off-by: Vishal Moola (Oracle) <vishal.moola@xxxxxxxxx>

Tested-by: Marek Szyprowski <m.szyprowski@xxxxxxxxxxx>

> ---
>   mm/khugepaged.c | 14 ++++++++++----
>   1 file changed, 10 insertions(+), 4 deletions(-)
>
> diff --git a/mm/khugepaged.c b/mm/khugepaged.c
> index b39ab219d5b7..bd54b957f69a 100644
> --- a/mm/khugepaged.c
> +++ b/mm/khugepaged.c
> @@ -511,11 +511,17 @@ static void release_pte_pages(pte_t *pte, pte_t *_pte,
>   
>   	while (--_pte >= pte) {
>   		pte_t pteval = *_pte;
> +		unsigned long pfn;
>   
> -		folio = pfn_folio(pte_pfn(pteval));
> -		if (!pte_none(pteval) && !is_zero_pfn(pte_pfn(pteval)) &&
> -				!folio_test_large(folio))
> -			release_pte_folio(folio);
> +		if (pte_none(pteval))
> +			continue;
> +		pfn = pte_pfn(pteval);
> +		if (is_zero_pfn(pfn))
> +			continue;
> +		folio = pfn_folio(pfn);
> +		if (folio_test_large(folio))
> +			continue;
> +		release_pte_folio(folio);
>   	}
>   
>   	list_for_each_entry_safe(folio, tmp, compound_pagelist, lru) {

Best regards
-- 
Marek Szyprowski, PhD
Samsung R&D Institute Poland





[Index of Archives]     [Linux ARM Kernel]     [Linux ARM]     [Linux Omap]     [Fedora ARM]     [IETF Annouce]     [Bugtraq]     [Linux OMAP]     [Linux MIPS]     [eCos]     [Asterisk Internet PBX]     [Linux API]

  Powered by Linux