git.ipfire.org Git - thirdparty/kernel/stable-queue.git/blob

   1 From 61ebe5a747da649057c37be1c37eb934b4af79ca Mon Sep 17 00:00:00 2001
   2 From: Hailong Liu <hailong.liu@oppo.com>
   3 Date: Thu, 8 Aug 2024 20:19:56 +0800
   4 Subject: mm/vmalloc: fix page mapping if vm_area_alloc_pages() with high order fallback to order 0
   5
   6 From: Hailong Liu <hailong.liu@oppo.com>
   7
   8 commit 61ebe5a747da649057c37be1c37eb934b4af79ca upstream.
   9
  10 The __vmap_pages_range_noflush() assumes its argument pages** contains
  11 pages with the same page shift.  However, since commit e9c3cda4d86e ("mm,
  12 vmalloc: fix high order __GFP_NOFAIL allocations"), if gfp_flags includes
  13 __GFP_NOFAIL with high order in vm_area_alloc_pages() and page allocation
  14 failed for high order, the pages** may contain two different page shifts
  15 (high order and order-0).  This could lead __vmap_pages_range_noflush() to
  16 perform incorrect mappings, potentially resulting in memory corruption.
  17
  18 Users might encounter this as follows (vmap_allow_huge = true, 2M is for
  19 PMD_SIZE):
  20
  21 kvmalloc(2M, __GFP_NOFAIL|GFP_X)
  22     __vmalloc_node_range_noprof(vm_flags=VM_ALLOW_HUGE_VMAP)
  23         vm_area_alloc_pages(order=9) ---> order-9 allocation failed and fallback to order-0
  24             vmap_pages_range()
  25                 vmap_pages_range_noflush()
  26                     __vmap_pages_range_noflush(page_shift = 21) ----> wrong mapping happens
  27
  28 We can remove the fallback code because if a high-order allocation fails,
  29 __vmalloc_node_range_noprof() will retry with order-0.  Therefore, it is
  30 unnecessary to fallback to order-0 here.  Therefore, fix this by removing
  31 the fallback code.
  32
  33 Link: https://lkml.kernel.org/r/20240808122019.3361-1-hailong.liu@oppo.com
  34 Fixes: e9c3cda4d86e ("mm, vmalloc: fix high order __GFP_NOFAIL allocations")
  35 Signed-off-by: Hailong Liu <hailong.liu@oppo.com>
  36 Reported-by: Tangquan Zheng <zhengtangquan@oppo.com>
  37 Reviewed-by: Baoquan He <bhe@redhat.com>
  38 Reviewed-by: Uladzislau Rezki (Sony) <urezki@gmail.com>
  39 Acked-by: Barry Song <baohua@kernel.org>
  40 Acked-by: Michal Hocko <mhocko@suse.com>
  41 Cc: Matthew Wilcox <willy@infradead.org>
  42 Cc: <stable@vger.kernel.org>
  43 Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
  44 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  45 ---
  46  mm/vmalloc.c |   11 ++---------
  47  1 file changed, 2 insertions(+), 9 deletions(-)
  48
  49 --- a/mm/vmalloc.c
  50 +++ b/mm/vmalloc.c
  51 @@ -3583,15 +3583,8 @@ vm_area_alloc_pages(gfp_t gfp, int nid,
  52                         page = alloc_pages_noprof(alloc_gfp, order);
  53                 else
  54                         page = alloc_pages_node_noprof(nid, alloc_gfp, order);
  55 -               if (unlikely(!page)) {
  56 -                       if (!nofail)
  57 -                               break;
  58 -
  59 -                       /* fall back to the zero order allocations */
  60 -                       alloc_gfp |= __GFP_NOFAIL;
  61 -                       order = 0;
  62 -                       continue;
  63 -               }
  64 +               if (unlikely(!page))
  65 +                       break;
  66
  67                 /*
  68                  * Higher order allocations must be able to be treated as