Commit 074f027d authored by Lance Yang's avatar Lance Yang Committed by Andrew Morton
Browse files

mm/khugepaged: guard is_zero_pfn() calls with pte_present() 

A non-present entry, like a swap PTE, contains completely different data
(swap type and offset).  pte_pfn() doesn't know this, so if we feed it a
non-present entry, it will spit out a junk PFN.

What if that junk PFN happens to match the zeropage's PFN by sheer chance?
While really unlikely, this would be really bad if it did.

So, let's fix this potential bug by ensuring all calls to is_zero_pfn() in
khugepaged.c are properly guarded by a pte_present() check.

Link: https://lkml.kernel.org/r/20251020151111.53561-1-lance.yang@linux.dev


Signed-off-by: default avatarLance Yang <lance.yang@linux.dev>
Suggested-by: default avatarLorenzo Stoakes <lorenzo.stoakes@oracle.com>
Reviewed-by: default avatarNico Pache <npache@redhat.com>
Reviewed-by: default avatarDev Jain <dev.jain@arm.com>
Reviewed-by: default avatarBaolin Wang <baolin.wang@linux.alibaba.com>
Reviewed-by: default avatarWei Yang <richard.weiyang@gmail.com>
Acked-by: default avatarDavid Hildenbrand <david@redhat.com>
Reviewed-by: default avatarLorenzo Stoakes <lorenzo.stoakes@oracle.com>
Cc: Liam Howlett <liam.howlett@oracle.com>
Cc: Ryan Roberts <ryan.roberts@arm.com>
Cc: Wei Yang <richard.weiyang@gmail.com>
Cc: Zi Yan <ziy@nvidia.com>
Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
parent 40d923ac

mm/khugepaged.c

+21 −14
Original line number Diff line number Diff line
@@ -337,6 +337,13 @@ struct attribute_group khugepaged_attr_group = { 
};

#endif /* CONFIG_SYSFS */



static bool pte_none_or_zero(pte_t pte)

{

	if (pte_none(pte))

		return true;

	return pte_present(pte) && is_zero_pfn(pte_pfn(pte));

}



int hugepage_madvise(struct vm_area_struct *vma,

		     vm_flags_t *vm_flags, int advice)

{
@@ -518,6 +525,7 @@ static void release_pte_pages(pte_t *pte, pte_t *_pte, 


		if (pte_none(pteval))

			continue;

		VM_WARN_ON_ONCE(!pte_present(pteval));

		pfn = pte_pfn(pteval);

		if (is_zero_pfn(pfn))

			continue;
@@ -548,8 +556,7 @@ static int __collapse_huge_page_isolate(struct vm_area_struct *vma, 
	for (_pte = pte; _pte < pte + HPAGE_PMD_NR;

	     _pte++, addr += PAGE_SIZE) {

		pte_t pteval = ptep_get(_pte);

		if (pte_none(pteval) || (pte_present(pteval) &&

				is_zero_pfn(pte_pfn(pteval)))) {

		if (pte_none_or_zero(pteval)) {

			++none_or_zero;

			if (!userfaultfd_armed(vma) &&

			    (!cc->is_khugepaged ||
@@ -690,9 +697,10 @@ static void __collapse_huge_page_copy_succeeded(pte_t *pte, 
	     address += nr_ptes * PAGE_SIZE) {

		nr_ptes = 1;

		pteval = ptep_get(_pte);

		if (pte_none(pteval) || is_zero_pfn(pte_pfn(pteval))) {

		if (pte_none_or_zero(pteval)) {

			add_mm_counter(vma->vm_mm, MM_ANONPAGES, 1);

			if (is_zero_pfn(pte_pfn(pteval))) {

			if (pte_none(pteval))

				continue;

			/*

			 * ptl mostly unnecessary.

			 */
@@ -700,7 +708,6 @@ static void __collapse_huge_page_copy_succeeded(pte_t *pte, 
			ptep_clear(vma->vm_mm, address, _pte);

			spin_unlock(ptl);

			ksm_might_unmap_zero_page(vma->vm_mm, pteval);

			}

		} else {

			struct page *src_page = pte_page(pteval);
@@ -794,7 +801,7 @@ static int __collapse_huge_page_copy(pte_t *pte, struct folio *folio, 
		unsigned long src_addr = address + i * PAGE_SIZE;

		struct page *src_page;



		if (pte_none(pteval) || is_zero_pfn(pte_pfn(pteval))) {

		if (pte_none_or_zero(pteval)) {

			clear_user_highpage(page, src_addr);

			continue;

		}
@@ -1301,7 +1308,7 @@ static int hpage_collapse_scan_pmd(struct mm_struct *mm, 
				goto out_unmap;

			}

		}

		if (pte_none(pteval) || is_zero_pfn(pte_pfn(pteval))) {

		if (pte_none_or_zero(pteval)) {

			++none_or_zero;

			if (!userfaultfd_armed(vma) &&

			    (!cc->is_khugepaged ||