[PATCH] mm/debug: Do not dereference i_ino blindly

[PATCH] mm/debug: Do not dereference i_ino blindly

[Matthew Wilcox (Oracle)]

We check i_dentry is fetchable and i_ino is earlier in the struct
than i_ino, so it ought to work fine, but it's possible that struct
randomisation has reordered i_ino after i_dentry and the pointer is
just wild enough that i_dentry is fetchable and i_ino isn't.

Also print the inode number if the dentry is invalid.

Reported-by: Vlastimil Babka <vbabka@suse.cz>
Signed-off-by: Matthew Wilcox (Oracle) <willy@infradead.org>
---
 mm/debug.c | 12 +++++++-----
 1 file changed, 7 insertions(+), 5 deletions(-)

diff --git a/mm/debug.c b/mm/debug.c
index ca8d1cacdecc..2a767865145c 100644
--- a/mm/debug.c
+++ b/mm/debug.c
@@ -120,6 +120,7 @@ void __dump_page(struct page *page, const char *reason)
 		struct hlist_node *dentry_first;
 		struct dentry *dentry_ptr;
 		struct dentry dentry;
+		unsigned long ino;
 
 		/*
 		 * mapping can be invalid pointer and we don't want to crash
@@ -136,21 +137,22 @@ void __dump_page(struct page *page, const char *reason)
 			goto out_mapping;
 		}
 
-		if (get_kernel_nofault(dentry_first, &host->i_dentry.first)) {
+		if (get_kernel_nofault(dentry_first, &host->i_dentry.first) ||
+		    get_kernel_nofault(ino, &host->i_ino)) {
 			pr_warn("aops:%ps with invalid host inode %px\n",
 					a_ops, host);
 			goto out_mapping;
 		}
 
 		if (!dentry_first) {
-			pr_warn("aops:%ps ino:%lx\n", a_ops, host->i_ino);
+			pr_warn("aops:%ps ino:%lx\n", a_ops, ino);
 			goto out_mapping;
 		}
 
 		dentry_ptr = container_of(dentry_first, struct dentry, d_u.d_alias);
 		if (get_kernel_nofault(dentry, dentry_ptr)) {
-			pr_warn("aops:%ps with invalid dentry %px\n", a_ops,
-					dentry_ptr);
+			pr_warn("aops:%ps ino:%lx with invalid dentry %px\n",
+					a_ops, ino, dentry_ptr);
 		} else {
 			/*
 			 * if dentry is corrupted, the %pd handler may still
@@ -158,7 +160,7 @@ void __dump_page(struct page *page, const char *reason)
 			 * corrupted struct page
 			 */
 			pr_warn("aops:%ps ino:%lx dentry name:\"%pd\"\n",
-					a_ops, host->i_ino, &dentry);
+					a_ops, ino, &dentry);
 		}
 	}
 out_mapping:
-- 
2.28.0

Re: [PATCH] mm/debug: Do not dereference i_ino blindly

[John Hubbard]

On 8/19/20 11:57 AM, Matthew Wilcox (Oracle) wrote:
> We check i_dentry is fetchable and i_ino is earlier in the struct
> than i_ino, so it ought to work fine, but it's possible that struct
> randomisation has reordered i_ino after i_dentry and the pointer is
> just wild enough that i_dentry is fetchable and i_ino isn't.
> 
> Also print the inode number if the dentry is invalid.
> 
> Reported-by: Vlastimil Babka <vbabka@suse.cz>
> Signed-off-by: Matthew Wilcox (Oracle) <willy@infradead.org>
> ---
>   mm/debug.c | 12 +++++++-----
>   1 file changed, 7 insertions(+), 5 deletions(-)
> 

It's hard to write software that reports what's wrong with
itself. Let's just keep adding to the pile, then. :)

Reviewed-by: John Hubbard <jhubbard@nvidia.com>


thanks,
-- 
John Hubbard
NVIDIA

> diff --git a/mm/debug.c b/mm/debug.c
> index ca8d1cacdecc..2a767865145c 100644
> --- a/mm/debug.c
> +++ b/mm/debug.c
> @@ -120,6 +120,7 @@ void __dump_page(struct page *page, const char *reason)
>   		struct hlist_node *dentry_first;
>   		struct dentry *dentry_ptr;
>   		struct dentry dentry;
> +		unsigned long ino;
>   
>   		/*
>   		 * mapping can be invalid pointer and we don't want to crash
> @@ -136,21 +137,22 @@ void __dump_page(struct page *page, const char *reason)
>   			goto out_mapping;
>   		}
>   
> -		if (get_kernel_nofault(dentry_first, &host->i_dentry.first)) {
> +		if (get_kernel_nofault(dentry_first, &host->i_dentry.first) ||
> +		    get_kernel_nofault(ino, &host->i_ino)) {
>   			pr_warn("aops:%ps with invalid host inode %px\n",
>   					a_ops, host);
>   			goto out_mapping;
>   		}
>   
>   		if (!dentry_first) {
> -			pr_warn("aops:%ps ino:%lx\n", a_ops, host->i_ino);
> +			pr_warn("aops:%ps ino:%lx\n", a_ops, ino);
>   			goto out_mapping;
>   		}
>   
>   		dentry_ptr = container_of(dentry_first, struct dentry, d_u.d_alias);
>   		if (get_kernel_nofault(dentry, dentry_ptr)) {
> -			pr_warn("aops:%ps with invalid dentry %px\n", a_ops,
> -					dentry_ptr);
> +			pr_warn("aops:%ps ino:%lx with invalid dentry %px\n",
> +					a_ops, ino, dentry_ptr);
>   		} else {
>   			/*
>   			 * if dentry is corrupted, the %pd handler may still
> @@ -158,7 +160,7 @@ void __dump_page(struct page *page, const char *reason)
>   			 * corrupted struct page
>   			 */
>   			pr_warn("aops:%ps ino:%lx dentry name:\"%pd\"\n",
> -					a_ops, host->i_ino, &dentry);
> +					a_ops, ino, &dentry);
>   		}
>   	}
>   out_mapping:
> 

Re: [PATCH] mm/debug: Do not dereference i_ino blindly

[Mike Rapoport]

On Wed, Aug 19, 2020 at 07:57:10PM +0100, Matthew Wilcox (Oracle) wrote:
> We check i_dentry is fetchable and i_ino is earlier in the struct
> than i_ino, so it ought to work fine, but it's possible that struct
> randomisation has reordered i_ino after i_dentry and the pointer is
> just wild enough that i_dentry is fetchable and i_ino isn't.
> 
> Also print the inode number if the dentry is invalid.
> 
> Reported-by: Vlastimil Babka <vbabka@suse.cz>
> Signed-off-by: Matthew Wilcox (Oracle) <willy@infradead.org>

Reviewed-by: Mike Rapoport <rppt@linux.ibm.com>

> ---
>  mm/debug.c | 12 +++++++-----
>  1 file changed, 7 insertions(+), 5 deletions(-)
> 
> diff --git a/mm/debug.c b/mm/debug.c
> index ca8d1cacdecc..2a767865145c 100644
> --- a/mm/debug.c
> +++ b/mm/debug.c
> @@ -120,6 +120,7 @@ void __dump_page(struct page *page, const char *reason)
>  		struct hlist_node *dentry_first;
>  		struct dentry *dentry_ptr;
>  		struct dentry dentry;
> +		unsigned long ino;
>  
>  		/*
>  		 * mapping can be invalid pointer and we don't want to crash
> @@ -136,21 +137,22 @@ void __dump_page(struct page *page, const char *reason)
>  			goto out_mapping;
>  		}
>  
> -		if (get_kernel_nofault(dentry_first, &host->i_dentry.first)) {
> +		if (get_kernel_nofault(dentry_first, &host->i_dentry.first) ||
> +		    get_kernel_nofault(ino, &host->i_ino)) {
>  			pr_warn("aops:%ps with invalid host inode %px\n",
>  					a_ops, host);
>  			goto out_mapping;
>  		}
>  
>  		if (!dentry_first) {
> -			pr_warn("aops:%ps ino:%lx\n", a_ops, host->i_ino);
> +			pr_warn("aops:%ps ino:%lx\n", a_ops, ino);
>  			goto out_mapping;
>  		}
>  
>  		dentry_ptr = container_of(dentry_first, struct dentry, d_u.d_alias);
>  		if (get_kernel_nofault(dentry, dentry_ptr)) {
> -			pr_warn("aops:%ps with invalid dentry %px\n", a_ops,
> -					dentry_ptr);
> +			pr_warn("aops:%ps ino:%lx with invalid dentry %px\n",
> +					a_ops, ino, dentry_ptr);
>  		} else {
>  			/*
>  			 * if dentry is corrupted, the %pd handler may still
> @@ -158,7 +160,7 @@ void __dump_page(struct page *page, const char *reason)
>  			 * corrupted struct page
>  			 */
>  			pr_warn("aops:%ps ino:%lx dentry name:\"%pd\"\n",
> -					a_ops, host->i_ino, &dentry);
> +					a_ops, ino, &dentry);
>  		}
>  	}
>  out_mapping:
> -- 
> 2.28.0
> 

-- 
Sincerely yours,
Mike.