diff mbox series

[RFC,4/5] shmem: Avoid segfault in shmem_read_mapping_page_gfp()

Message ID 20211112124411.1948809-5-roberto.sassu@huawei.com (mailing list archive)
State Rejected
Headers show
Series shmem/fsverity: Prepare for mandatory integrity enforcement | expand

Commit Message

Roberto Sassu Nov. 12, 2021, 12:44 p.m. UTC
Check the hwpoison page flag only if the page is valid in
shmem_read_mapping_page_gfp(). The PageHWPoison() macro tries to access
the page flags and cannot work on an error pointer.

Signed-off-by: Roberto Sassu <roberto.sassu@huawei.com>
---
 mm/shmem.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

Comments

Ajay Garg Nov. 12, 2021, 12:53 p.m. UTC | #1
Hi Roberto.

Identical patch has been floated earlier via :
https://lore.kernel.org/linux-mm/CAMZfGtUp6dkT4OWzLhL8whqNnXAbfVw5c6AQogHzY3bbM_k2Qw@mail.gmail.com/T/#m2189d135b9293de9b4a11362f0179c17b254d5ab


Thanks and Regards,
Ajay

On Fri, Nov 12, 2021 at 6:15 PM Roberto Sassu <roberto.sassu@huawei.com> wrote:
>
> Check the hwpoison page flag only if the page is valid in
> shmem_read_mapping_page_gfp(). The PageHWPoison() macro tries to access
> the page flags and cannot work on an error pointer.
>
> Signed-off-by: Roberto Sassu <roberto.sassu@huawei.com>
> ---
>  mm/shmem.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/mm/shmem.c b/mm/shmem.c
> index 23c91a8beb78..427863cbf0dc 100644
> --- a/mm/shmem.c
> +++ b/mm/shmem.c
> @@ -4222,7 +4222,7 @@ struct page *shmem_read_mapping_page_gfp(struct address_space *mapping,
>         else
>                 unlock_page(page);
>
> -       if (PageHWPoison(page))
> +       if (!IS_ERR(page) && PageHWPoison(page))
>                 page = ERR_PTR(-EIO);
>
>         return page;
> --
> 2.32.0
>
Roberto Sassu Nov. 12, 2021, 12:56 p.m. UTC | #2
> From: Ajay Garg [mailto:ajaygargnsit@gmail.com]
> Sent: Friday, November 12, 2021 1:54 PM
> Hi Roberto.
> 
> Identical patch has been floated earlier via :
> https://lore.kernel.org/linux-
> mm/CAMZfGtUp6dkT4OWzLhL8whqNnXAbfVw5c6AQogHzY3bbM_k2Qw@mail.
> gmail.com/T/#m2189d135b9293de9b4a11362f0179c17b254d5ab

Hi Ajay

thanks, I was not aware.

Roberto

HUAWEI TECHNOLOGIES Duesseldorf GmbH, HRB 56063
Managing Director: Li Peng, Zhong Ronghua

> Thanks and Regards,
> Ajay
> 
> On Fri, Nov 12, 2021 at 6:15 PM Roberto Sassu <roberto.sassu@huawei.com>
> wrote:
> >
> > Check the hwpoison page flag only if the page is valid in
> > shmem_read_mapping_page_gfp(). The PageHWPoison() macro tries to
> access
> > the page flags and cannot work on an error pointer.
> >
> > Signed-off-by: Roberto Sassu <roberto.sassu@huawei.com>
> > ---
> >  mm/shmem.c | 2 +-
> >  1 file changed, 1 insertion(+), 1 deletion(-)
> >
> > diff --git a/mm/shmem.c b/mm/shmem.c
> > index 23c91a8beb78..427863cbf0dc 100644
> > --- a/mm/shmem.c
> > +++ b/mm/shmem.c
> > @@ -4222,7 +4222,7 @@ struct page
> *shmem_read_mapping_page_gfp(struct address_space *mapping,
> >         else
> >                 unlock_page(page);
> >
> > -       if (PageHWPoison(page))
> > +       if (!IS_ERR(page) && PageHWPoison(page))
> >                 page = ERR_PTR(-EIO);
> >
> >         return page;
> > --
> > 2.32.0
> >
Eric Biggers Nov. 12, 2021, 6:56 p.m. UTC | #3
On Fri, Nov 12, 2021 at 01:44:10PM +0100, Roberto Sassu wrote:
> Check the hwpoison page flag only if the page is valid in
> shmem_read_mapping_page_gfp(). The PageHWPoison() macro tries to access
> the page flags and cannot work on an error pointer.
> 
> Signed-off-by: Roberto Sassu <roberto.sassu@huawei.com>

This looks like a recent regression from the commit:

	commit b9d02f1bdd98f38e6e5ecacc9786a8f58f3f8b2c
	Author: Yang Shi <shy828301@gmail.com>
	Date:   Fri Nov 5 13:41:10 2021 -0700

	    mm: shmem: don't truncate page if memory failure happens

Can you please send this fix out as a standalone patch, to the right people and
including the appropriate "Fixes" tag?

- Eric
Roberto Sassu Nov. 15, 2021, 8:02 a.m. UTC | #4
> From: Eric Biggers [mailto:ebiggers@kernel.org]
> Sent: Friday, November 12, 2021 7:56 PM
> On Fri, Nov 12, 2021 at 01:44:10PM +0100, Roberto Sassu wrote:
> > Check the hwpoison page flag only if the page is valid in
> > shmem_read_mapping_page_gfp(). The PageHWPoison() macro tries to
> access
> > the page flags and cannot work on an error pointer.
> >
> > Signed-off-by: Roberto Sassu <roberto.sassu@huawei.com>
> 
> This looks like a recent regression from the commit:
> 
> 	commit b9d02f1bdd98f38e6e5ecacc9786a8f58f3f8b2c
> 	Author: Yang Shi <shy828301@gmail.com>
> 	Date:   Fri Nov 5 13:41:10 2021 -0700
> 
> 	    mm: shmem: don't truncate page if memory failure happens
> 
> Can you please send this fix out as a standalone patch, to the right people and
> including the appropriate "Fixes" tag?

Hi Eric

it looks there is another patch. Given that it was proposed before,
I will drop mine. Thanks anyway.

Roberto

HUAWEI TECHNOLOGIES Duesseldorf GmbH, HRB 56063
Managing Director: Li Peng, Zhong Ronghua
diff mbox series

Patch

diff --git a/mm/shmem.c b/mm/shmem.c
index 23c91a8beb78..427863cbf0dc 100644
--- a/mm/shmem.c
+++ b/mm/shmem.c
@@ -4222,7 +4222,7 @@  struct page *shmem_read_mapping_page_gfp(struct address_space *mapping,
 	else
 		unlock_page(page);
 
-	if (PageHWPoison(page))
+	if (!IS_ERR(page) && PageHWPoison(page))
 		page = ERR_PTR(-EIO);
 
 	return page;