From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-9.1 required=3.0 tests=DKIMWL_WL_HIGH,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,INCLUDES_PATCH,MAILING_LIST_MULTI,SIGNED_OFF_BY, SPF_PASS,USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 3ABC9C43381 for ; Mon, 11 Mar 2019 19:59:38 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 0EBB82173C for ; Mon, 11 Mar 2019 19:59:38 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1552334378; bh=XvHTynYYjho/ocuBvOKjHCIiHUp4C0UmYEyfVhjekqQ=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=QNGH08NJrZnNM69DTkXRwE3JE9czxfU4K37Nakq0VfDr8mEqrMI4Fz1czhtksHaUB i40XHJ5XsVhA5y05F8fCQaPr/BGlVN45PfqpD98DSUiwAzhcIQi7CwFrM8U37qGOd1 10CJTQQ7WTL0qbMor2CM49Qt5cC9C27C5yL7iMRA= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1729124AbfCKT7g (ORCPT ); Mon, 11 Mar 2019 15:59:36 -0400 Received: from mail.kernel.org ([198.145.29.99]:36934 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1729623AbfCKT7b (ORCPT ); Mon, 11 Mar 2019 15:59:31 -0400 Received: from sasha-vm.mshome.net (c-73-47-72-35.hsd1.nh.comcast.net [73.47.72.35]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 4DAB42087C; Mon, 11 Mar 2019 19:59:30 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1552334371; bh=XvHTynYYjho/ocuBvOKjHCIiHUp4C0UmYEyfVhjekqQ=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=a0WVV8KkyLxpevI5Rv79g6hVw5Rtd4PjgspX93GV3IhuC6lPNevqhqElKfRtfH6mn NKRKkY4h14hGdC8g6biGYF/EMBAqq0c31pd8f78+AokwQrMlM3GxWTFVrObD0gf0Ri XRQzMVjRekkCHVZdTiXBMeznPkqg308/7ryslmDw= From: Sasha Levin To: linux-kernel@vger.kernel.org, stable@vger.kernel.org Cc: Jann Horn , "David S . Miller" , Sasha Levin , linux-mm@kvack.org Subject: [PATCH AUTOSEL 4.9 09/12] mm: page_alloc: fix ref bias in page_frag_alloc() for 1-byte allocs Date: Mon, 11 Mar 2019 15:59:09 -0400 Message-Id: <20190311195912.139410-9-sashal@kernel.org> X-Mailer: git-send-email 2.19.1 In-Reply-To: <20190311195912.139410-1-sashal@kernel.org> References: <20190311195912.139410-1-sashal@kernel.org> MIME-Version: 1.0 X-Patchwork-Hint: Ignore Content-Transfer-Encoding: 8bit Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Jann Horn [ Upstream commit 2c2ade81741c66082f8211f0b96cf509cc4c0218 ] The basic idea behind ->pagecnt_bias is: If we pre-allocate the maximum number of references that we might need to create in the fastpath later, the bump-allocation fastpath only has to modify the non-atomic bias value that tracks the number of extra references we hold instead of the atomic refcount. The maximum number of allocations we can serve (under the assumption that no allocation is made with size 0) is nc->size, so that's the bias used. However, even when all memory in the allocation has been given away, a reference to the page is still held; and in the `offset < 0` slowpath, the page may be reused if everyone else has dropped their references. This means that the necessary number of references is actually `nc->size+1`. Luckily, from a quick grep, it looks like the only path that can call page_frag_alloc(fragsz=1) is TAP with the IFF_NAPI_FRAGS flag, which requires CAP_NET_ADMIN in the init namespace and is only intended to be used for kernel testing and fuzzing. To test for this issue, put a `WARN_ON(page_ref_count(page) == 0)` in the `offset < 0` path, below the virt_to_page() call, and then repeatedly call writev() on a TAP device with IFF_TAP|IFF_NO_PI|IFF_NAPI_FRAGS|IFF_NAPI, with a vector consisting of 15 elements containing 1 byte each. Signed-off-by: Jann Horn Signed-off-by: David S. Miller Signed-off-by: Sasha Levin --- mm/page_alloc.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/mm/page_alloc.c b/mm/page_alloc.c index 3af727d95c17..05f141e39ac1 100644 --- a/mm/page_alloc.c +++ b/mm/page_alloc.c @@ -3955,11 +3955,11 @@ void *__alloc_page_frag(struct page_frag_cache *nc, /* Even if we own the page, we do not use atomic_set(). * This would break get_page_unless_zero() users. */ - page_ref_add(page, size - 1); + page_ref_add(page, size); /* reset page count bias and offset to start of new frag */ nc->pfmemalloc = page_is_pfmemalloc(page); - nc->pagecnt_bias = size; + nc->pagecnt_bias = size + 1; nc->offset = size; } @@ -3975,10 +3975,10 @@ void *__alloc_page_frag(struct page_frag_cache *nc, size = nc->size; #endif /* OK, page count is 0, we can safely set it */ - set_page_count(page, size); + set_page_count(page, size + 1); /* reset page count bias and offset to start of new frag */ - nc->pagecnt_bias = size; + nc->pagecnt_bias = size + 1; offset = size - fragsz; } -- 2.19.1