From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752560AbdGOB3b (ORCPT ); Fri, 14 Jul 2017 21:29:31 -0400 Received: from omzsmtpe01.verizonbusiness.com ([199.249.25.210]:44101 "EHLO omzsmtpe01.verizonbusiness.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752222AbdGOB2F (ORCPT ); Fri, 14 Jul 2017 21:28:05 -0400 X-IronPort-Anti-Spam-Filtered: false From: "Levin, Alexander (Sasha Levin)" Cc: Ard Biesheuvel , Catalin Marinas , Hanjun Guo , Yisheng Xie , Robert Richter , James Morse , Andrew Morton , "Linus Torvalds" , "Levin, Alexander (Sasha Levin)" X-Host: ranger.odc.vzwcorp.com To: "linux-kernel@vger.kernel.org" , "stable@vger.kernel.org" Subject: [PATCH for v4.9 LTS 85/87] mm: don't dereference struct page fields of invalid pages Thread-Topic: [PATCH for v4.9 LTS 85/87] mm: don't dereference struct page fields of invalid pages Thread-Index: AQHS/QlhW4HcSQaRTUqgy2uhzBt1QQ== Date: Sat, 15 Jul 2017 01:26:27 +0000 Message-ID: <20170715012538.10101-85-alexander.levin@verizon.com> References: <20170715012538.10101-1-alexander.levin@verizon.com> In-Reply-To: <20170715012538.10101-1-alexander.levin@verizon.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-ms-exchange-messagesentrepresentingtype: 1 x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [10.144.60.250] Content-Type: text/plain; charset="iso-8859-1" MIME-Version: 1.0 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Transfer-Encoding: 8bit X-MIME-Autoconverted: from quoted-printable to 8bit by nfs id v6F1TcT2022936 From: Ard Biesheuvel [ Upstream commit f073bdc51771f5a5c7a8d1191bfc3ae371d44de7 ] The VM_BUG_ON() check in move_freepages() checks whether the node id of a page matches the node id of its zone. However, it does this before having checked whether the struct page pointer refers to a valid struct page to begin with. This is guaranteed in most cases, but may not be the case if CONFIG_HOLES_IN_ZONE=y. So reorder the VM_BUG_ON() with the pfn_valid_within() check. Link: http://lkml.kernel.org/r/1481706707-6211-2-git-send-email-ard.biesheuvel@linaro.org Signed-off-by: Ard Biesheuvel Acked-by: Will Deacon Cc: Catalin Marinas Cc: Hanjun Guo Cc: Yisheng Xie Cc: Robert Richter Cc: James Morse Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Signed-off-by: Sasha Levin --- mm/page_alloc.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/mm/page_alloc.c b/mm/page_alloc.c index 56df8c24689d..85881bf01776 100644 --- a/mm/page_alloc.c +++ b/mm/page_alloc.c @@ -1875,14 +1875,14 @@ int move_freepages(struct zone *zone, #endif for (page = start_page; page <= end_page;) { - /* Make sure we are not inadvertently changing nodes */ - VM_BUG_ON_PAGE(page_to_nid(page) != zone_to_nid(zone), page); - if (!pfn_valid_within(page_to_pfn(page))) { page++; continue; } + /* Make sure we are not inadvertently changing nodes */ + VM_BUG_ON_PAGE(page_to_nid(page) != zone_to_nid(zone), page); + if (!PageBuddy(page)) { page++; continue; -- 2.11.0