2023-10-23 08:43:25

by Hyesoo Yu

Subject: [PATCH v2] mm: page_alloc: check the order of compound page even when the order is zero

For compound pages, the head sets the PG_head flag and
the tail sets the compound_head to indicate the head page.
If a user allocates a compound page and frees it with a different
order, the compound page information will not be properly
initialized. To detect this problem, compound_order(page) and
the order argument are compared, but this is not checked
when the order argument is zero. That error should be checked
regardless of the order.

Reviewed-by: Vishal Moola (Oracle) <[email protected]>
Signed-off-by: Hyesoo Yu <[email protected]>
---
mm/page_alloc.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/mm/page_alloc.c b/mm/page_alloc.c
index 95546f376302..fc92ac93c7c8 100644
--- a/mm/page_alloc.c
+++ b/mm/page_alloc.c
@@ -1078,6 +1078,7 @@ static __always_inline bool free_pages_prepare(struct page *page,
int bad = 0;
bool skip_kasan_poison = should_skip_kasan_poison(page, fpi_flags);
bool init = want_init_on_free();
+ bool compound = PageCompound(page);

VM_BUG_ON_PAGE(PageTail(page), page);

@@ -1096,16 +1097,15 @@ static __always_inline bool free_pages_prepare(struct page *page,
return false;
}

+ VM_BUG_ON_PAGE(compound && compound_order(page) != order, page);
+
/*
* Check tail pages before head page information is cleared to
* avoid checking PageCompound for order-0 pages.
*/
if (unlikely(order)) {
- bool compound = PageCompound(page);
int i;

- VM_BUG_ON_PAGE(compound && compound_order(page) != order, page);
-
if (compound)
page[1].flags &= ~PAGE_FLAGS_SECOND;
for (i = 1; i < (1 << order); i++) {
--
2.25.1

2023-10-27 13:56:35

by David Hildenbrand

Subject: Re: [PATCH v2] mm: page_alloc: check the order of compound page even when the order is zero

On 23.10.23 10:32, Hyesoo Yu wrote:
> For compound pages, the head sets the PG_head flag and
> the tail sets the compound_head to indicate the head page.
> If a user allocates a compound page and frees it with a different
> order, the compound page information will not be properly
> initialized. To detect this problem, compound_order(page) and
> the order argument are compared, but this is not checked
> when the order argument is zero. That error should be checked
> regardless of the order.
>
> Reviewed-by: Vishal Moola (Oracle) <[email protected]>
> Signed-off-by: Hyesoo Yu <[email protected]>
> ---
> mm/page_alloc.c | 6 +++---
> 1 file changed, 3 insertions(+), 3 deletions(-)
>
> diff --git a/mm/page_alloc.c b/mm/page_alloc.c
> index 95546f376302..fc92ac93c7c8 100644
> --- a/mm/page_alloc.c
> +++ b/mm/page_alloc.c
> @@ -1078,6 +1078,7 @@ static __always_inline bool free_pages_prepare(struct page *page,
> int bad = 0;
> bool skip_kasan_poison = should_skip_kasan_poison(page, fpi_flags);
> bool init = want_init_on_free();
> + bool compound = PageCompound(page);
>
> VM_BUG_ON_PAGE(PageTail(page), page);
>
> @@ -1096,16 +1097,15 @@ static __always_inline bool free_pages_prepare(struct page *page,
> return false;
> }
>
> + VM_BUG_ON_PAGE(compound && compound_order(page) != order, page);
> +
> /*
> * Check tail pages before head page information is cleared to
> * avoid checking PageCompound for order-0 pages.
> */
> if (unlikely(order)) {
> - bool compound = PageCompound(page);
> int i;
>
> - VM_BUG_ON_PAGE(compound && compound_order(page) != order, page);
> -
> if (compound)
> page[1].flags &= ~PAGE_FLAGS_SECOND;
> for (i = 1; i < (1 << order); i++) {

Acked-by: David Hildenbrand <[email protected]>

--
Cheers,

David / dhildenb