Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
Content-Type: text/plain;
        charset=us-ascii
MIME-Version: 1.0
Subject: Re: [PATCH] mm: kfence: fix handling discontiguous page
From:   Muchun Song <muchun.song@linux.dev>
In-Reply-To: <20230323151850.e2785b1cff37fba078f26f2b@linux-foundation.org>
Date:   Fri, 24 Mar 2023 09:59:16 +0800
Cc:     Muchun Song <songmuchun@bytedance.com>, glider@google.com,
        elver@google.com, dvyukov@google.com, jannh@google.com,
        sjpark@amazon.de, kasan-dev@googlegroups.com,
        Linux Memory Management List <linux-mm@kvack.org>,
        linux-kernel@vger.kernel.org
Content-Transfer-Encoding: quoted-printable
Message-Id: <FEB74A1F-9DA2-4B37-8AD5-5E41A399046C@linux.dev>
References: <20230323025003.94447-1-songmuchun@bytedance.com>
 <20230323151850.e2785b1cff37fba078f26f2b@linux-foundation.org>
To:     Andrew Morton <akpm@linux-foundation.org>
Precedence: bulk


> On Mar 24, 2023, at 06:18, Andrew Morton <akpm@linux-foundation.org> =
wrote:
>=20
> On Thu, 23 Mar 2023 10:50:03 +0800 Muchun Song =
<songmuchun@bytedance.com> wrote:
>=20
>> The struct pages could be discontiguous when the kfence pool is =
allocated
>> via alloc_contig_pages() with CONFIG_SPARSEMEM and =
!CONFIG_SPARSEMEM_VMEMMAP.
>> So, the iteration should use nth_page().
>=20
> What are the user-visible runtime effects of this flaw?

Set the PG_slab and memcg_data to a arbitrary address (may be not used =
as a struct
page), so the worst case may corrupt the kernel.

Thanks.

>=20
> Thanks.