Commit 6a7de1bf authored by Matthew Wilcox (Oracle)'s avatar Matthew Wilcox (Oracle) Committed by Andrew Morton
Browse files

mm: open-code page_folio() in dump_page() 

page_folio() calls page_fixed_fake_head() which will misidentify this page
as being a fake head and load off the end of 'precise'.  We may have a
pointer to a fake head, but that's OK because it contains the right
information for dump_page().

gcc-15 is smart enough to catch this with -Warray-bounds:

In function 'page_fixed_fake_head',
    inlined from '_compound_head' at ../include/linux/page-flags.h:251:24,
    inlined from '__dump_page' at ../mm/debug.c:123:11:
../include/asm-generic/rwonce.h:44:26: warning: array subscript 9 is outside
+array bounds of 'struct page[1]' [-Warray-bounds=]

Link: https://lkml.kernel.org/r/20241125201721.2963278-2-willy@infradead.org


Fixes: fae7d834 ("mm: add __dump_folio()")
Signed-off-by: default avatarMatthew Wilcox (Oracle) <willy@infradead.org>
Reported-by: default avatarKees Cook <kees@kernel.org>
Cc: <stable@vger.kernel.org>
Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
parent 4de22b2a

mm/debug.c

+5 −2
Original line number Diff line number Diff line
@@ -124,19 +124,22 @@ static void __dump_page(const struct page *page) 
{

	struct folio *foliop, folio;

	struct page precise;

	unsigned long head;

	unsigned long pfn = page_to_pfn(page);

	unsigned long idx, nr_pages = 1;

	int loops = 5;



again:

	memcpy(&precise, page, sizeof(*page));

	foliop = page_folio(&precise);

	if (foliop == (struct folio *)&precise) {

	head = precise.compound_head;

	if ((head & 1) == 0) {

		foliop = (struct folio *)&precise;

		idx = 0;

		if (!folio_test_large(foliop))

			goto dump;

		foliop = (struct folio *)page;

	} else {

		foliop = (struct folio *)(head - 1);

		idx = folio_page_idx(foliop, page);

	}