diff mbox series

[RFC,4/5] shmem: Avoid segfault in shmem_read_mapping_page_gfp()

Message ID 20211112124411.1948809-5-roberto.sassu@huawei.com (mailing list archive)
State New
Headers show
Series shmem/fsverity: Prepare for mandatory integrity enforcement | expand

Commit Message

Roberto Sassu Nov. 12, 2021, 12:44 p.m. UTC
Check the hwpoison page flag only if the page is valid in
shmem_read_mapping_page_gfp(). The PageHWPoison() macro tries to access
the page flags and cannot work on an error pointer.

Signed-off-by: Roberto Sassu <roberto.sassu@huawei.com>
---
 mm/shmem.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

Comments

Eric Biggers Nov. 12, 2021, 6:56 p.m. UTC | #1
On Fri, Nov 12, 2021 at 01:44:10PM +0100, Roberto Sassu wrote:
> Check the hwpoison page flag only if the page is valid in
> shmem_read_mapping_page_gfp(). The PageHWPoison() macro tries to access
> the page flags and cannot work on an error pointer.
> 
> Signed-off-by: Roberto Sassu <roberto.sassu@huawei.com>

This looks like a recent regression from the commit:

	commit b9d02f1bdd98f38e6e5ecacc9786a8f58f3f8b2c
	Author: Yang Shi <shy828301@gmail.com>
	Date:   Fri Nov 5 13:41:10 2021 -0700

	    mm: shmem: don't truncate page if memory failure happens

Can you please send this fix out as a standalone patch, to the right people and
including the appropriate "Fixes" tag?

- Eric
Roberto Sassu Nov. 15, 2021, 8:02 a.m. UTC | #2
> From: Eric Biggers [mailto:ebiggers@kernel.org]
> Sent: Friday, November 12, 2021 7:56 PM
> On Fri, Nov 12, 2021 at 01:44:10PM +0100, Roberto Sassu wrote:
> > Check the hwpoison page flag only if the page is valid in
> > shmem_read_mapping_page_gfp(). The PageHWPoison() macro tries to
> access
> > the page flags and cannot work on an error pointer.
> >
> > Signed-off-by: Roberto Sassu <roberto.sassu@huawei.com>
> 
> This looks like a recent regression from the commit:
> 
> 	commit b9d02f1bdd98f38e6e5ecacc9786a8f58f3f8b2c
> 	Author: Yang Shi <shy828301@gmail.com>
> 	Date:   Fri Nov 5 13:41:10 2021 -0700
> 
> 	    mm: shmem: don't truncate page if memory failure happens
> 
> Can you please send this fix out as a standalone patch, to the right people and
> including the appropriate "Fixes" tag?

Hi Eric

it looks there is another patch. Given that it was proposed before,
I will drop mine. Thanks anyway.

Roberto

HUAWEI TECHNOLOGIES Duesseldorf GmbH, HRB 56063
Managing Director: Li Peng, Zhong Ronghua
diff mbox series

Patch

diff --git a/mm/shmem.c b/mm/shmem.c
index 23c91a8beb78..427863cbf0dc 100644
--- a/mm/shmem.c
+++ b/mm/shmem.c
@@ -4222,7 +4222,7 @@  struct page *shmem_read_mapping_page_gfp(struct address_space *mapping,
 	else
 		unlock_page(page);
 
-	if (PageHWPoison(page))
+	if (!IS_ERR(page) && PageHWPoison(page))
 		page = ERR_PTR(-EIO);
 
 	return page;