* [PATCH v2] lib/iov_iter: fix to increase non slab folio refcount
@ 2025-04-01 14:47 Sheng Yong
2025-04-01 15:12 ` Matthew Wilcox
2025-04-01 15:22 ` Vlastimil Babka
0 siblings, 2 replies; 5+ messages in thread
From: Sheng Yong @ 2025-04-01 14:47 UTC (permalink / raw)
To: akpm, willy, vbabka; +Cc: linux-kernel, linux-mm, Sheng Yong
From: Sheng Yong <shengyong1@xiaomi.com>
When testing EROFS file-backed mount over v9fs on qemu, I encountered
a folio UAF issue. The page sanity check reports the following call
trace. The root cause is that pages in bvec are coalesced across a folio
bounary. The refcount of all non-slab folios should be increased to
ensure p9_releas_pages can put them correctly.
BUG: Bad page state in process md5sum pfn:18300
page: refcount:0 mapcount:0 mapping:00000000d5ad8e4e index:0x60 pfn:0x18300
head: order:0 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
aops:z_erofs_aops ino:30b0f dentry name(?):"GoogleExtServicesCn.apk"
flags: 0x100000000000041(locked|head|node=0|zone=1)
raw: 0100000000000041 dead000000000100 dead000000000122 ffff888014b13bd0
raw: 0000000000000060 0000000000000020 00000000ffffffff 0000000000000000
head: 0100000000000041 dead000000000100 dead000000000122 ffff888014b13bd0
head: 0000000000000060 0000000000000020 00000000ffffffff 0000000000000000
head: 0100000000000000 0000000000000000 ffffffffffffffff 0000000000000000
head: 0000000000000010 0000000000000000 00000000ffffffff 0000000000000000
page dumped because: PAGE_FLAGS_CHECK_AT_FREE flag(s) set
Call Trace:
dump_stack_lvl+0x53/0x70
bad_page+0xd4/0x220
__free_pages_ok+0x76d/0xf30
__folio_put+0x230/0x320
p9_release_pages+0x179/0x1f0
p9_virtio_zc_request+0xa2a/0x1230
p9_client_zc_rpc.constprop.0+0x247/0x700
p9_client_read_once+0x34d/0x810
p9_client_read+0xf3/0x150
v9fs_issue_read+0x111/0x360
netfs_unbuffered_read_iter_locked+0x927/0x1390
netfs_unbuffered_read_iter+0xa2/0xe0
vfs_iocb_iter_read+0x2c7/0x460
erofs_fileio_rq_submit+0x46b/0x5b0
z_erofs_runqueue+0x1203/0x21e0
z_erofs_readahead+0x579/0x8b0
read_pages+0x19f/0xa70
page_cache_ra_order+0x4ad/0xb80
filemap_readahead.isra.0+0xe7/0x150
filemap_get_pages+0x7aa/0x1890
filemap_read+0x320/0xc80
vfs_read+0x6c6/0xa30
ksys_read+0xf9/0x1c0
do_syscall_64+0x9e/0x1a0
entry_SYSCALL_64_after_hwframe+0x71/0x79
Fixes: b9c0e49abfca ("mm: decline to manipulate the refcount on a slab page")
Signed-off-by: Sheng Yong <shengyong1@xiaomi.com>
---
lib/iov_iter.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
---
v2:
* update commit message
* update coding style
diff --git a/lib/iov_iter.c b/lib/iov_iter.c
index 8c7fdb7d8c8f..bc9391e55d57 100644
--- a/lib/iov_iter.c
+++ b/lib/iov_iter.c
@@ -1191,7 +1191,7 @@ static ssize_t __iov_iter_get_pages_alloc(struct iov_iter *i,
return -ENOMEM;
p = *pages;
for (int k = 0; k < n; k++) {
- struct folio *folio = page_folio(page);
+ struct folio *folio = page_folio(page + k);
p[k] = page + k;
if (!folio_test_slab(folio))
folio_get(folio);
--
2.43.0
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [PATCH v2] lib/iov_iter: fix to increase non slab folio refcount
2025-04-01 14:47 [PATCH v2] lib/iov_iter: fix to increase non slab folio refcount Sheng Yong
@ 2025-04-01 15:12 ` Matthew Wilcox
2025-04-01 15:22 ` Vlastimil Babka
1 sibling, 0 replies; 5+ messages in thread
From: Matthew Wilcox @ 2025-04-01 15:12 UTC (permalink / raw)
To: Sheng Yong; +Cc: akpm, vbabka, linux-kernel, linux-mm, Sheng Yong
On Tue, Apr 01, 2025 at 10:47:12PM +0800, Sheng Yong wrote:
> Fixes: b9c0e49abfca ("mm: decline to manipulate the refcount on a slab page")
> Signed-off-by: Sheng Yong <shengyong1@xiaomi.com>
Reviewed-by: Matthew Wilcox (Oracle) <willy@infradead.org>
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [PATCH v2] lib/iov_iter: fix to increase non slab folio refcount
2025-04-01 14:47 [PATCH v2] lib/iov_iter: fix to increase non slab folio refcount Sheng Yong
2025-04-01 15:12 ` Matthew Wilcox
@ 2025-04-01 15:22 ` Vlastimil Babka
2025-04-02 13:36 ` Sheng Yong
1 sibling, 1 reply; 5+ messages in thread
From: Vlastimil Babka @ 2025-04-01 15:22 UTC (permalink / raw)
To: Sheng Yong, akpm, willy; +Cc: linux-kernel, linux-mm, Sheng Yong
On 4/1/25 16:47, Sheng Yong wrote:
> From: Sheng Yong <shengyong1@xiaomi.com>
>
> When testing EROFS file-backed mount over v9fs on qemu, I encountered
> a folio UAF issue. The page sanity check reports the following call
> trace. The root cause is that pages in bvec are coalesced across a folio
> bounary. The refcount of all non-slab folios should be increased to
> ensure p9_releas_pages can put them correctly.
>
> BUG: Bad page state in process md5sum pfn:18300
> page: refcount:0 mapcount:0 mapping:00000000d5ad8e4e index:0x60 pfn:0x18300
> head: order:0 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
> aops:z_erofs_aops ino:30b0f dentry name(?):"GoogleExtServicesCn.apk"
> flags: 0x100000000000041(locked|head|node=0|zone=1)
> raw: 0100000000000041 dead000000000100 dead000000000122 ffff888014b13bd0
> raw: 0000000000000060 0000000000000020 00000000ffffffff 0000000000000000
> head: 0100000000000041 dead000000000100 dead000000000122 ffff888014b13bd0
> head: 0000000000000060 0000000000000020 00000000ffffffff 0000000000000000
> head: 0100000000000000 0000000000000000 ffffffffffffffff 0000000000000000
> head: 0000000000000010 0000000000000000 00000000ffffffff 0000000000000000
> page dumped because: PAGE_FLAGS_CHECK_AT_FREE flag(s) set
> Call Trace:
> dump_stack_lvl+0x53/0x70
> bad_page+0xd4/0x220
> __free_pages_ok+0x76d/0xf30
> __folio_put+0x230/0x320
> p9_release_pages+0x179/0x1f0
> p9_virtio_zc_request+0xa2a/0x1230
> p9_client_zc_rpc.constprop.0+0x247/0x700
> p9_client_read_once+0x34d/0x810
> p9_client_read+0xf3/0x150
> v9fs_issue_read+0x111/0x360
> netfs_unbuffered_read_iter_locked+0x927/0x1390
> netfs_unbuffered_read_iter+0xa2/0xe0
> vfs_iocb_iter_read+0x2c7/0x460
> erofs_fileio_rq_submit+0x46b/0x5b0
> z_erofs_runqueue+0x1203/0x21e0
> z_erofs_readahead+0x579/0x8b0
> read_pages+0x19f/0xa70
> page_cache_ra_order+0x4ad/0xb80
> filemap_readahead.isra.0+0xe7/0x150
> filemap_get_pages+0x7aa/0x1890
> filemap_read+0x320/0xc80
> vfs_read+0x6c6/0xa30
> ksys_read+0xf9/0x1c0
> do_syscall_64+0x9e/0x1a0
> entry_SYSCALL_64_after_hwframe+0x71/0x79
>
> Fixes: b9c0e49abfca ("mm: decline to manipulate the refcount on a slab page")
Sigh. That went to v6.14
mm-hotfixes and Cc: stable then?
> Signed-off-by: Sheng Yong <shengyong1@xiaomi.com>
Acked-by: Vlastimil Babka <vbabka@suse.cz>
Thanks.
> ---
> lib/iov_iter.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
> ---
> v2:
> * update commit message
> * update coding style
>
> diff --git a/lib/iov_iter.c b/lib/iov_iter.c
> index 8c7fdb7d8c8f..bc9391e55d57 100644
> --- a/lib/iov_iter.c
> +++ b/lib/iov_iter.c
> @@ -1191,7 +1191,7 @@ static ssize_t __iov_iter_get_pages_alloc(struct iov_iter *i,
> return -ENOMEM;
> p = *pages;
> for (int k = 0; k < n; k++) {
> - struct folio *folio = page_folio(page);
> + struct folio *folio = page_folio(page + k);
> p[k] = page + k;
> if (!folio_test_slab(folio))
> folio_get(folio);
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [PATCH v2] lib/iov_iter: fix to increase non slab folio refcount
2025-04-01 15:22 ` Vlastimil Babka
@ 2025-04-02 13:36 ` Sheng Yong
2025-04-02 13:45 ` Vlastimil Babka
0 siblings, 1 reply; 5+ messages in thread
From: Sheng Yong @ 2025-04-02 13:36 UTC (permalink / raw)
To: Vlastimil Babka, akpm, willy; +Cc: linux-kernel, linux-mm, Sheng Yong
On 4/1/25 23:22, Vlastimil Babka wrote:
> On 4/1/25 16:47, Sheng Yong wrote:
>> From: Sheng Yong <shengyong1@xiaomi.com>
[...]
>>
>> Fixes: b9c0e49abfca ("mm: decline to manipulate the refcount on a slab page")
>
> Sigh. That went to v6.14
>
> mm-hotfixes and Cc: stable then?
Hi, Vlastimil,
Shall I resend this patch with Cc: tag to the stable list?
thanks,
sheng
>
>> Signed-off-by: Sheng Yong <shengyong1@xiaomi.com>
>
> Acked-by: Vlastimil Babka <vbabka@suse.cz>
>
> Thanks.
>
>> ---
>> lib/iov_iter.c | 2 +-
>> 1 file changed, 1 insertion(+), 1 deletion(-)
>> ---
>> v2:
>> * update commit message
>> * update coding style
>>
>> diff --git a/lib/iov_iter.c b/lib/iov_iter.c
>> index 8c7fdb7d8c8f..bc9391e55d57 100644
>> --- a/lib/iov_iter.c
>> +++ b/lib/iov_iter.c
>> @@ -1191,7 +1191,7 @@ static ssize_t __iov_iter_get_pages_alloc(struct iov_iter *i,
>> return -ENOMEM;
>> p = *pages;
>> for (int k = 0; k < n; k++) {
>> - struct folio *folio = page_folio(page);
>> + struct folio *folio = page_folio(page + k);
>> p[k] = page + k;
>> if (!folio_test_slab(folio))
>> folio_get(folio);
>
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [PATCH v2] lib/iov_iter: fix to increase non slab folio refcount
2025-04-02 13:36 ` Sheng Yong
@ 2025-04-02 13:45 ` Vlastimil Babka
0 siblings, 0 replies; 5+ messages in thread
From: Vlastimil Babka @ 2025-04-02 13:45 UTC (permalink / raw)
To: Sheng Yong, akpm, willy; +Cc: linux-kernel, linux-mm, Sheng Yong
On 4/2/25 15:36, Sheng Yong wrote:
> On 4/1/25 23:22, Vlastimil Babka wrote:
>> On 4/1/25 16:47, Sheng Yong wrote:
>>> From: Sheng Yong <shengyong1@xiaomi.com>
> [...]
>>>
>>> Fixes: b9c0e49abfca ("mm: decline to manipulate the refcount on a slab page")
>>
>> Sigh. That went to v6.14
>>
>> mm-hotfixes and Cc: stable then?
>
> Hi, Vlastimil,
Hi,
> Shall I resend this patch with Cc: tag to the stable list?
Andrew can do it when picking up the patch so no need to. Thanks.
> thanks,
> sheng
>
>>
>>> Signed-off-by: Sheng Yong <shengyong1@xiaomi.com>
>>
>> Acked-by: Vlastimil Babka <vbabka@suse.cz>
>>
>> Thanks.
>>
>>> ---
>>> lib/iov_iter.c | 2 +-
>>> 1 file changed, 1 insertion(+), 1 deletion(-)
>>> ---
>>> v2:
>>> * update commit message
>>> * update coding style
>>>
>>> diff --git a/lib/iov_iter.c b/lib/iov_iter.c
>>> index 8c7fdb7d8c8f..bc9391e55d57 100644
>>> --- a/lib/iov_iter.c
>>> +++ b/lib/iov_iter.c
>>> @@ -1191,7 +1191,7 @@ static ssize_t __iov_iter_get_pages_alloc(struct iov_iter *i,
>>> return -ENOMEM;
>>> p = *pages;
>>> for (int k = 0; k < n; k++) {
>>> - struct folio *folio = page_folio(page);
>>> + struct folio *folio = page_folio(page + k);
>>> p[k] = page + k;
>>> if (!folio_test_slab(folio))
>>> folio_get(folio);
>>
>
^ permalink raw reply [flat|nested] 5+ messages in thread
end of thread, other threads:[~2025-04-02 13:45 UTC | newest]
Thread overview: 5+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2025-04-01 14:47 [PATCH v2] lib/iov_iter: fix to increase non slab folio refcount Sheng Yong
2025-04-01 15:12 ` Matthew Wilcox
2025-04-01 15:22 ` Vlastimil Babka
2025-04-02 13:36 ` Sheng Yong
2025-04-02 13:45 ` Vlastimil Babka
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®