From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id 0A2A6C433FE for ; Thu, 20 Jan 2022 12:22:44 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id 88FCB6B00A0; Thu, 20 Jan 2022 07:22:44 -0500 (EST) Received: by kanga.kvack.org (Postfix, from userid 40) id 83F576B00A1; Thu, 20 Jan 2022 07:22:44 -0500 (EST) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 77C096B00A2; Thu, 20 Jan 2022 07:22:44 -0500 (EST) X-Delivered-To: linux-mm@kvack.org Received: from forelay.hostedemail.com (smtprelay0092.hostedemail.com [216.40.44.92]) by kanga.kvack.org (Postfix) with ESMTP id 6BDF96B00A0 for ; Thu, 20 Jan 2022 07:22:44 -0500 (EST) Received: from smtpin14.hostedemail.com (10.5.19.251.rfc1918.com [10.5.19.251]) by forelay04.hostedemail.com (Postfix) with ESMTP id 2239792EA8 for ; Thu, 20 Jan 2022 12:22:44 +0000 (UTC) X-FDA: 79050579048.14.5ABCCBB Received: from foss.arm.com (foss.arm.com [217.140.110.172]) by imf23.hostedemail.com (Postfix) with ESMTP id A98E714000E for ; Thu, 20 Jan 2022 12:22:43 +0000 (UTC) Received: from usa-sjc-imap-foss1.foss.arm.com (unknown [10.121.207.14]) by usa-sjc-mx-foss1.foss.arm.com (Postfix) with ESMTP id 91B2FED1; Thu, 20 Jan 2022 04:22:42 -0800 (PST) Received: from [10.57.68.26] (unknown [10.57.68.26]) by usa-sjc-imap-foss1.foss.arm.com (Postfix) with ESMTPSA id 97FE53F774; Thu, 20 Jan 2022 04:22:40 -0800 (PST) Message-ID: <319b09bc-56a2-207f-6180-3cc7d8cd43d1@arm.com> Date: Thu, 20 Jan 2022 12:22:35 +0000 MIME-Version: 1.0 User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Thunderbird/91.5.0 Subject: Re: [PATCH] vmap(): don't allow invalid pages Content-Language: en-GB To: "Russell King (Oracle)" Cc: Matthew Wilcox , Yury Norov , Catalin Marinas , Will Deacon , Andrew Morton , Nicholas Piggin , Ding Tianhong , Anshuman Khandual , Alexey Klimov , linux-arm-kernel@lists.infradead.org, linux-kernel@vger.kernel.org, linux-mm@kvack.org References: <20220118235244.540103-1-yury.norov@gmail.com> From: Robin Murphy In-Reply-To: Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 7bit X-Rspamd-Queue-Id: A98E714000E X-Stat-Signature: z1wmu5dopzszhkq1p5wx85e3oifwqep1 Authentication-Results: imf23.hostedemail.com; dkim=none; dmarc=pass (policy=none) header.from=arm.com; spf=pass (imf23.hostedemail.com: domain of robin.murphy@arm.com designates 217.140.110.172 as permitted sender) smtp.mailfrom=robin.murphy@arm.com X-Rspamd-Server: rspam02 X-HE-Tag: 1642681363-732314 X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: On 2022-01-19 19:12, Russell King (Oracle) wrote: > On Wed, Jan 19, 2022 at 06:43:10PM +0000, Robin Murphy wrote: >> Indeed, my impression is that the only legitimate way to get hold of a page >> pointer without assumed provenance is via pfn_to_page(), which is where >> pfn_valid() comes in. Thus pfn_valid(page_to_pfn()) really *should* be a >> tautology. > > That can only be true if pfn == page_to_pfn(pfn_to_page(pfn)) for all > values of pfn. > > Given how pfn_to_page() is defined in the sparsemem case: > > #define __pfn_to_page(pfn) \ > ({ unsigned long __pfn = (pfn); \ > struct mem_section *__sec = __pfn_to_section(__pfn); \ > __section_mem_map_addr(__sec) + __pfn; \ > }) > #define page_to_pfn __page_to_pfn > > that isn't the case, especially when looking at page_to_pfn(): > > #define __page_to_pfn(pg) \ > ({ const struct page *__pg = (pg); \ > int __sec = page_to_section(__pg); \ > (unsigned long)(__pg - __section_mem_map_addr(__nr_to_section(__sec))); \ > }) > > Where: > > static inline unsigned long page_to_section(const struct page *page) > { > return (page->flags >> SECTIONS_PGSHIFT) & SECTIONS_MASK; > } > > So if page_to_section() returns something that is, e.g. zero for an > invalid page in a non-zero section, you're not going to end up with > the right pfn from page_to_pfn(). Right, I emphasised "should" in an attempt to imply "in the absence of serious bugs that have further-reaching consequences anyway". > As I've said now a couple of times, trying to determine of a struct > page pointer is valid is the wrong question to be asking. And doing so in one single place, on the justification of avoiding an incredibly niche symptom, is even more so. Not to mention that an address size fault is one of the best possible outcomes anyway, vs. the untold damage that may stem from accesses actually going through to random parts of the physical memory map. Robin.