* [PATCH] mm/debug: Do not dereference i_ino blindly
@ 2020-08-19 18:57 Matthew Wilcox (Oracle)
2020-08-19 19:10 ` John Hubbard
2020-08-19 21:00 ` Mike Rapoport
0 siblings, 2 replies; 3+ messages in thread
From: Matthew Wilcox (Oracle) @ 2020-08-19 18:57 UTC (permalink / raw)
To: linux-mm
Cc: Matthew Wilcox (Oracle),
Andrew Morton, John Hubbard, Mike Rapoport, Vlastimil Babka
We check i_dentry is fetchable and i_ino is earlier in the struct
than i_ino, so it ought to work fine, but it's possible that struct
randomisation has reordered i_ino after i_dentry and the pointer is
just wild enough that i_dentry is fetchable and i_ino isn't.
Also print the inode number if the dentry is invalid.
Reported-by: Vlastimil Babka <vbabka@suse.cz>
Signed-off-by: Matthew Wilcox (Oracle) <willy@infradead.org>
---
mm/debug.c | 12 +++++++-----
1 file changed, 7 insertions(+), 5 deletions(-)
diff --git a/mm/debug.c b/mm/debug.c
index ca8d1cacdecc..2a767865145c 100644
--- a/mm/debug.c
+++ b/mm/debug.c
@@ -120,6 +120,7 @@ void __dump_page(struct page *page, const char *reason)
struct hlist_node *dentry_first;
struct dentry *dentry_ptr;
struct dentry dentry;
+ unsigned long ino;
/*
* mapping can be invalid pointer and we don't want to crash
@@ -136,21 +137,22 @@ void __dump_page(struct page *page, const char *reason)
goto out_mapping;
}
- if (get_kernel_nofault(dentry_first, &host->i_dentry.first)) {
+ if (get_kernel_nofault(dentry_first, &host->i_dentry.first) ||
+ get_kernel_nofault(ino, &host->i_ino)) {
pr_warn("aops:%ps with invalid host inode %px\n",
a_ops, host);
goto out_mapping;
}
if (!dentry_first) {
- pr_warn("aops:%ps ino:%lx\n", a_ops, host->i_ino);
+ pr_warn("aops:%ps ino:%lx\n", a_ops, ino);
goto out_mapping;
}
dentry_ptr = container_of(dentry_first, struct dentry, d_u.d_alias);
if (get_kernel_nofault(dentry, dentry_ptr)) {
- pr_warn("aops:%ps with invalid dentry %px\n", a_ops,
- dentry_ptr);
+ pr_warn("aops:%ps ino:%lx with invalid dentry %px\n",
+ a_ops, ino, dentry_ptr);
} else {
/*
* if dentry is corrupted, the %pd handler may still
@@ -158,7 +160,7 @@ void __dump_page(struct page *page, const char *reason)
* corrupted struct page
*/
pr_warn("aops:%ps ino:%lx dentry name:\"%pd\"\n",
- a_ops, host->i_ino, &dentry);
+ a_ops, ino, &dentry);
}
}
out_mapping:
--
2.28.0
^ permalink raw reply [flat|nested] 3+ messages in thread* Re: [PATCH] mm/debug: Do not dereference i_ino blindly
2020-08-19 18:57 [PATCH] mm/debug: Do not dereference i_ino blindly Matthew Wilcox (Oracle)
@ 2020-08-19 19:10 ` John Hubbard
2020-08-19 21:00 ` Mike Rapoport
1 sibling, 0 replies; 3+ messages in thread
From: John Hubbard @ 2020-08-19 19:10 UTC (permalink / raw)
To: Matthew Wilcox (Oracle), linux-mm
Cc: Andrew Morton, Mike Rapoport, Vlastimil Babka
On 8/19/20 11:57 AM, Matthew Wilcox (Oracle) wrote:
> We check i_dentry is fetchable and i_ino is earlier in the struct
> than i_ino, so it ought to work fine, but it's possible that struct
> randomisation has reordered i_ino after i_dentry and the pointer is
> just wild enough that i_dentry is fetchable and i_ino isn't.
>
> Also print the inode number if the dentry is invalid.
>
> Reported-by: Vlastimil Babka <vbabka@suse.cz>
> Signed-off-by: Matthew Wilcox (Oracle) <willy@infradead.org>
> ---
> mm/debug.c | 12 +++++++-----
> 1 file changed, 7 insertions(+), 5 deletions(-)
>
It's hard to write software that reports what's wrong with
itself. Let's just keep adding to the pile, then. :)
Reviewed-by: John Hubbard <jhubbard@nvidia.com>
thanks,
--
John Hubbard
NVIDIA
> diff --git a/mm/debug.c b/mm/debug.c
> index ca8d1cacdecc..2a767865145c 100644
> --- a/mm/debug.c
> +++ b/mm/debug.c
> @@ -120,6 +120,7 @@ void __dump_page(struct page *page, const char *reason)
> struct hlist_node *dentry_first;
> struct dentry *dentry_ptr;
> struct dentry dentry;
> + unsigned long ino;
>
> /*
> * mapping can be invalid pointer and we don't want to crash
> @@ -136,21 +137,22 @@ void __dump_page(struct page *page, const char *reason)
> goto out_mapping;
> }
>
> - if (get_kernel_nofault(dentry_first, &host->i_dentry.first)) {
> + if (get_kernel_nofault(dentry_first, &host->i_dentry.first) ||
> + get_kernel_nofault(ino, &host->i_ino)) {
> pr_warn("aops:%ps with invalid host inode %px\n",
> a_ops, host);
> goto out_mapping;
> }
>
> if (!dentry_first) {
> - pr_warn("aops:%ps ino:%lx\n", a_ops, host->i_ino);
> + pr_warn("aops:%ps ino:%lx\n", a_ops, ino);
> goto out_mapping;
> }
>
> dentry_ptr = container_of(dentry_first, struct dentry, d_u.d_alias);
> if (get_kernel_nofault(dentry, dentry_ptr)) {
> - pr_warn("aops:%ps with invalid dentry %px\n", a_ops,
> - dentry_ptr);
> + pr_warn("aops:%ps ino:%lx with invalid dentry %px\n",
> + a_ops, ino, dentry_ptr);
> } else {
> /*
> * if dentry is corrupted, the %pd handler may still
> @@ -158,7 +160,7 @@ void __dump_page(struct page *page, const char *reason)
> * corrupted struct page
> */
> pr_warn("aops:%ps ino:%lx dentry name:\"%pd\"\n",
> - a_ops, host->i_ino, &dentry);
> + a_ops, ino, &dentry);
> }
> }
> out_mapping:
>
^ permalink raw reply [flat|nested] 3+ messages in thread* Re: [PATCH] mm/debug: Do not dereference i_ino blindly
2020-08-19 18:57 [PATCH] mm/debug: Do not dereference i_ino blindly Matthew Wilcox (Oracle)
2020-08-19 19:10 ` John Hubbard
@ 2020-08-19 21:00 ` Mike Rapoport
1 sibling, 0 replies; 3+ messages in thread
From: Mike Rapoport @ 2020-08-19 21:00 UTC (permalink / raw)
To: Matthew Wilcox (Oracle)
Cc: linux-mm, Andrew Morton, John Hubbard, Vlastimil Babka
On Wed, Aug 19, 2020 at 07:57:10PM +0100, Matthew Wilcox (Oracle) wrote:
> We check i_dentry is fetchable and i_ino is earlier in the struct
> than i_ino, so it ought to work fine, but it's possible that struct
> randomisation has reordered i_ino after i_dentry and the pointer is
> just wild enough that i_dentry is fetchable and i_ino isn't.
>
> Also print the inode number if the dentry is invalid.
>
> Reported-by: Vlastimil Babka <vbabka@suse.cz>
> Signed-off-by: Matthew Wilcox (Oracle) <willy@infradead.org>
Reviewed-by: Mike Rapoport <rppt@linux.ibm.com>
> ---
> mm/debug.c | 12 +++++++-----
> 1 file changed, 7 insertions(+), 5 deletions(-)
>
> diff --git a/mm/debug.c b/mm/debug.c
> index ca8d1cacdecc..2a767865145c 100644
> --- a/mm/debug.c
> +++ b/mm/debug.c
> @@ -120,6 +120,7 @@ void __dump_page(struct page *page, const char *reason)
> struct hlist_node *dentry_first;
> struct dentry *dentry_ptr;
> struct dentry dentry;
> + unsigned long ino;
>
> /*
> * mapping can be invalid pointer and we don't want to crash
> @@ -136,21 +137,22 @@ void __dump_page(struct page *page, const char *reason)
> goto out_mapping;
> }
>
> - if (get_kernel_nofault(dentry_first, &host->i_dentry.first)) {
> + if (get_kernel_nofault(dentry_first, &host->i_dentry.first) ||
> + get_kernel_nofault(ino, &host->i_ino)) {
> pr_warn("aops:%ps with invalid host inode %px\n",
> a_ops, host);
> goto out_mapping;
> }
>
> if (!dentry_first) {
> - pr_warn("aops:%ps ino:%lx\n", a_ops, host->i_ino);
> + pr_warn("aops:%ps ino:%lx\n", a_ops, ino);
> goto out_mapping;
> }
>
> dentry_ptr = container_of(dentry_first, struct dentry, d_u.d_alias);
> if (get_kernel_nofault(dentry, dentry_ptr)) {
> - pr_warn("aops:%ps with invalid dentry %px\n", a_ops,
> - dentry_ptr);
> + pr_warn("aops:%ps ino:%lx with invalid dentry %px\n",
> + a_ops, ino, dentry_ptr);
> } else {
> /*
> * if dentry is corrupted, the %pd handler may still
> @@ -158,7 +160,7 @@ void __dump_page(struct page *page, const char *reason)
> * corrupted struct page
> */
> pr_warn("aops:%ps ino:%lx dentry name:\"%pd\"\n",
> - a_ops, host->i_ino, &dentry);
> + a_ops, ino, &dentry);
> }
> }
> out_mapping:
> --
> 2.28.0
>
--
Sincerely yours,
Mike.
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2020-08-19 21:00 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2020-08-19 18:57 [PATCH] mm/debug: Do not dereference i_ino blindly Matthew Wilcox (Oracle)
2020-08-19 19:10 ` John Hubbard
2020-08-19 21:00 ` Mike Rapoport
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox