From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id BEF65C433F5 for ; Thu, 7 Apr 2022 13:55:10 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id 1D8976B0072; Thu, 7 Apr 2022 09:55:00 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id 185C16B0073; Thu, 7 Apr 2022 09:55:00 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 04F536B0074; Thu, 7 Apr 2022 09:55:00 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (relay.hostedemail.com [64.99.140.27]) by kanga.kvack.org (Postfix) with ESMTP id E7DFA6B0072 for ; Thu, 7 Apr 2022 09:54:59 -0400 (EDT) Received: from smtpin10.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay10.hostedemail.com (Postfix) with ESMTP id 9D19458CC for ; Thu, 7 Apr 2022 13:54:49 +0000 (UTC) X-FDA: 79330228698.10.D3E2959 Received: from casper.infradead.org (casper.infradead.org [90.155.50.34]) by imf01.hostedemail.com (Postfix) with ESMTP id 880904000A for ; Thu, 7 Apr 2022 13:54:47 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=infradead.org; s=casper.20170209; h=In-Reply-To:Content-Type:MIME-Version: References:Message-ID:Subject:Cc:To:From:Date:Sender:Reply-To: Content-Transfer-Encoding:Content-ID:Content-Description; bh=DXxNPzETJNuKIBTHSCLD6jKCdsUNJU2Z62bqM3GMnPE=; b=AgcmlkO5TLsyW5xOuatXKvxlIh jgZhx7Bl1iJKrafqkTBWYDqb52EOVniCao4Iw8Q9+UHC/WiLmTbnEsKTi08fXNcJU6H8vOn5H6QEB QAnV39A9ZV+h6tTHLu+91KRNFGcj0CEZZ64WpnW6L/RVo+Ur0sWynRNZ96IQ/DUFPMT5WnCsP54yi 5ZxNvpDqGadrw2mUmBS4rTkSeqNT2JD/Nu6YiwERsvXkU1p1tpExcVDIt2psRm0REQLRqmBwmUlAz 2CLFeFwNVZhWHRbap0+xvXmVkEk9XCgA3mMaAf4EDu6u2gs8QuLpiZeqLAH4UB9G20fFsd7Gtl7GO VbM9pk9w==; Received: from willy by casper.infradead.org with local (Exim 4.94.2 #2 (Red Hat Linux)) id 1ncSax-008seI-0m; Thu, 07 Apr 2022 13:54:43 +0000 Date: Thu, 7 Apr 2022 14:54:42 +0100 From: Matthew Wilcox To: zhenwei pi Cc: akpm@linux-foundation.org, linux-mm@kvack.org, linux-kernel@vger.kernel.org Subject: Re: [PATCH] mm: fix kernel NULL pointer dereference in page_vma_mapped_walk Message-ID: References: <20220407064008.71869-1-pizhenwei@bytedance.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20220407064008.71869-1-pizhenwei@bytedance.com> Authentication-Results: imf01.hostedemail.com; dkim=pass header.d=infradead.org header.s=casper.20170209 header.b=AgcmlkO5; spf=none (imf01.hostedemail.com: domain of willy@infradead.org has no SPF policy when checking 90.155.50.34) smtp.mailfrom=willy@infradead.org; dmarc=none X-Rspam-User: X-Rspamd-Server: rspam10 X-Rspamd-Queue-Id: 880904000A X-Stat-Signature: 68jcz3am7h7kfsc95jh3dg748d6zm638 X-HE-Tag: 1649339687-678256 X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: On Thu, Apr 07, 2022 at 02:40:08PM +0800, zhenwei pi wrote: > size_to_hstate(4K) returns NULL pointer, this leads kernel BUG in > function page_vma_mapped_walk. Yes, I think this is the right fix. It's not immediately obvious from the bug and the patch, but what's going on is: page_mapped_in_vma() sets nr_pages to 1. This is correct because we usually only want to know about the precise page, and not about the folio containing it. But hugetlbfs is special (... in so many ways ...) and actually wants to work on the entire folio. We could set nr_pages specially for hugetlb pages, but it's better to ignore it in page_vma_mapped_walk() for the hugetlb case. I'll fix up the changelog and add it to my pile of fixes that I'm sending tomorrow. https://git.infradead.org/users/willy/pagecache.git/shortlog/refs/heads/for-next > diff --git a/mm/page_vma_mapped.c b/mm/page_vma_mapped.c > index 1187f9c1ec5b..a39ec23581c9 100644 > --- a/mm/page_vma_mapped.c > +++ b/mm/page_vma_mapped.c > @@ -163,7 +163,7 @@ bool page_vma_mapped_walk(struct page_vma_mapped_walk *pvmw) > return not_found(pvmw); > > if (unlikely(is_vm_hugetlb_page(vma))) { > - unsigned long size = pvmw->nr_pages * PAGE_SIZE; > + unsigned long size = huge_page_size(hstate_vma(vma)); > /* The only possible mapping was handled on last iteration */ > if (pvmw->pte) > return not_found(pvmw); > -- > 2.25.1 >