queue-4.19/mm-page_alloc-fix-ref-bias-in-page_frag_alloc-for-1-.patch

   1 From 4bbeb70b295a097104f7ea1c3c1973d96efdec2a Mon Sep 17 00:00:00 2001
   2 From: Jann Horn <jannh@google.com>
   3 Date: Wed, 13 Feb 2019 22:45:59 +0100
   4 Subject: mm: page_alloc: fix ref bias in page_frag_alloc() for 1-byte allocs
   5
   6 [ Upstream commit 2c2ade81741c66082f8211f0b96cf509cc4c0218 ]
   7
   8 The basic idea behind ->pagecnt_bias is: If we pre-allocate the maximum
   9 number of references that we might need to create in the fastpath later,
  10 the bump-allocation fastpath only has to modify the non-atomic bias value
  11 that tracks the number of extra references we hold instead of the atomic
  12 refcount. The maximum number of allocations we can serve (under the
  13 assumption that no allocation is made with size 0) is nc->size, so that's
  14 the bias used.
  15
  16 However, even when all memory in the allocation has been given away, a
  17 reference to the page is still held; and in the `offset < 0` slowpath, the
  18 page may be reused if everyone else has dropped their references.
  19 This means that the necessary number of references is actually
  20 `nc->size+1`.
  21
  22 Luckily, from a quick grep, it looks like the only path that can call
  23 page_frag_alloc(fragsz=1) is TAP with the IFF_NAPI_FRAGS flag, which
  24 requires CAP_NET_ADMIN in the init namespace and is only intended to be
  25 used for kernel testing and fuzzing.
  26
  27 To test for this issue, put a `WARN_ON(page_ref_count(page) == 0)` in the
  28 `offset < 0` path, below the virt_to_page() call, and then repeatedly call
  29 writev() on a TAP device with IFF_TAP|IFF_NO_PI|IFF_NAPI_FRAGS|IFF_NAPI,
  30 with a vector consisting of 15 elements containing 1 byte each.
  31
  32 Signed-off-by: Jann Horn <jannh@google.com>
  33 Signed-off-by: David S. Miller <davem@davemloft.net>
  34 Signed-off-by: Sasha Levin <sashal@kernel.org>
  35 ---
  36  mm/page_alloc.c | 8 ++++----
  37  1 file changed, 4 insertions(+), 4 deletions(-)
  38
  39 diff --git a/mm/page_alloc.c b/mm/page_alloc.c
  40 index a9de1dbb9a6c..ef99971c13dd 100644
  41 --- a/mm/page_alloc.c
  42 +++ b/mm/page_alloc.c
  43 @@ -4532,11 +4532,11 @@ refill:
  44                 /* Even if we own the page, we do not use atomic_set().
  45                  * This would break get_page_unless_zero() users.
  46                  */
  47 -               page_ref_add(page, size - 1);
  48 +               page_ref_add(page, size);
  49
  50                 /* reset page count bias and offset to start of new frag */
  51                 nc->pfmemalloc = page_is_pfmemalloc(page);
  52 -               nc->pagecnt_bias = size;
  53 +               nc->pagecnt_bias = size + 1;
  54                 nc->offset = size;
  55         }
  56
  57 @@ -4552,10 +4552,10 @@ refill:
  58                 size = nc->size;
  59  #endif
  60                 /* OK, page count is 0, we can safely set it */
  61 -               set_page_count(page, size);
  62 +               set_page_count(page, size + 1);
  63
  64                 /* reset page count bias and offset to start of new frag */
  65 -               nc->pagecnt_bias = size;
  66 +               nc->pagecnt_bias = size + 1;
  67                 offset = size - fragsz;
  68         }
  69
  70 --
  71 2.19.1
  72