On Mon, May 08, 2023 at 05:27:10PM -0400, Pasha Tatashin wrote:
> > static void page_table_check_set(struct mm_struct *mm, unsigned long addr,
> > unsigned long pfn, unsigned long pgcnt,
> > bool rw)
> > {
> > // ...
> > anon = PageAnon(page);
> > for (i = 0; i < pgcnt; i++) {
> > // ...
> > if (anon) {
> > BUG_ON(atomic_read(&ptc->file_map_count));
> > BUG_ON(atomic_inc_return(&ptc->anon_map_count) > 1 && rw);
> > } else {
> > BUG_ON(atomic_read(&ptc->anon_map_count));
> > BUG_ON(atomic_inc_return(&ptc->file_map_count) < 0);
> > }
> > // ...
> > }
> > // ...
> > }
> >
> > This call to PageAnon is invalid for slab pages because slab reuses the bits
> > in struct page/folio to store its internal states, and the anonymity bit only
> > exists in struct page/folio. As a result, the counters are incorrectly updated
> > and checked in page_table_check_set and page_table_check_clear, leading to the
> > bug being raised.
>
> We should change anon boolean to be:
>
> anon = !PageSlab(page) && PageAnon(page);
No. Slab pages are not elegible for mapping into userspace. That's
all. There should be a BUG() for that. And I do mean BUG(), not
"return error to user". Something has gone horribly wrong, and it's
time to crash.
