[PATCH 1/2] mm: Open-code PageTail in folio_flags() and const_folio_flags()

[PATCH 1/2] mm: Open-code PageTail in folio_flags() and const_folio_flags()

[Matthew Wilcox (Oracle)]

It is unsafe to call PageTail() in dump_page() as page_is_fake_head()
will almost certainly return true when called on a head page that
is copied to the stack.  That will cause the VM_BUG_ON_PGFLAGS() in
const_folio_flags() to trigger when it shouldn't.  Fortunately, we don't
need to call PageTail() here; it's fine to have a pointer to a virtual
alias of the page's flag word rather than the real page's flag word.

Fixes: fae7d834c43c (mm: add __dump_folio())
Signed-off-by: Matthew Wilcox (Oracle) <willy@infradead.org>
Cc: stable@vger.kernel.org
---
 include/linux/page-flags.h | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/include/linux/page-flags.h b/include/linux/page-flags.h
index 2220bfec278e..cf46ac720802 100644
--- a/include/linux/page-flags.h
+++ b/include/linux/page-flags.h
@@ -306,7 +306,7 @@ static const unsigned long *const_folio_flags(const struct folio *folio,
 {
 	const struct page *page = &folio->page;
 
-	VM_BUG_ON_PGFLAGS(PageTail(page), page);
+	VM_BUG_ON_PGFLAGS(page->compound_head & 1, page);
 	VM_BUG_ON_PGFLAGS(n > 0 && !test_bit(PG_head, &page->flags), page);
 	return &page[n].flags;
 }
@@ -315,7 +315,7 @@ static unsigned long *folio_flags(struct folio *folio, unsigned n)
 {
 	struct page *page = &folio->page;
 
-	VM_BUG_ON_PGFLAGS(PageTail(page), page);
+	VM_BUG_ON_PGFLAGS(page->compound_head & 1, page);
 	VM_BUG_ON_PGFLAGS(n > 0 && !test_bit(PG_head, &page->flags), page);
 	return &page[n].flags;
 }
-- 
2.45.2

[PATCH 2/2] mm: Open-code page_folio() in dump_page()

[Matthew Wilcox (Oracle)]

page_folio() calls page_fixed_fake_head() which will misidentify this
page as being a fake head and load off the end of 'precise'.  We may
have a pointer to a fake head, but that's OK because it contains the
right information for dump_page().

gcc-15 is smart enough to catch this with -Warray-bounds:

In function 'page_fixed_fake_head',
    inlined from '_compound_head' at ../include/linux/page-flags.h:251:24,
    inlined from '__dump_page' at ../mm/debug.c:123:11:
../include/asm-generic/rwonce.h:44:26: warning: array subscript 9 is outside
+array bounds of 'struct page[1]' [-Warray-bounds=]

Reported-by: Kees Cook <kees@kernel.org>
Signed-off-by: Matthew Wilcox (Oracle) <willy@infradead.org>
Fixes: fae7d834c43c (mm: add __dump_folio())
Cc: stable@vger.kernel.org
---
 mm/debug.c | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/mm/debug.c b/mm/debug.c
index aa57d3ffd4ed..95b6ab809c0e 100644
--- a/mm/debug.c
+++ b/mm/debug.c
@@ -124,19 +124,22 @@ static void __dump_page(const struct page *page)
 {
 	struct folio *foliop, folio;
 	struct page precise;
+	unsigned long head;
 	unsigned long pfn = page_to_pfn(page);
 	unsigned long idx, nr_pages = 1;
 	int loops = 5;
 
 again:
 	memcpy(&precise, page, sizeof(*page));
-	foliop = page_folio(&precise);
-	if (foliop == (struct folio *)&precise) {
+	head = precise.compound_head;
+	if ((head & 1) == 0) {
+		foliop = (struct folio *)&precise;
 		idx = 0;
 		if (!folio_test_large(foliop))
 			goto dump;
 		foliop = (struct folio *)page;
 	} else {
+		foliop = (struct folio *)(head - 1);
 		idx = folio_page_idx(foliop, page);
 	}
 
-- 
2.45.2