• Jann Horn's avatar
    mm: page_alloc: fix ref bias in page_frag_alloc() for 1-byte allocs · 2c2ade81
    Jann Horn authored
    The basic idea behind ->pagecnt_bias is: If we pre-allocate the maximum
    number of references that we might need to create in the fastpath later,
    the bump-allocation fastpath only has to modify the non-atomic bias value
    that tracks the number of extra references we hold instead of the atomic
    refcount. The maximum number of allocations we can serve (under the
    assumption that no allocation is made with size 0) is nc->size, so that's
    the bias used.
    
    However, even when all memory in the allocation has been given away, a
    reference to the page is still held; and in the `offset < 0` slowpath, the
    page may be reused if everyone else has dropped their references.
    This means that the necessary number of references is actually
    `nc->size+1`.
    
    Luckily, from a quick grep, it looks like the only path that can call
    page_frag_alloc(fragsz=1) is TAP with the IFF_NAPI_FRAGS flag, which
    requires CAP_NET_ADMIN in the init namespace and is only intended to be
    used for kernel testing and fuzzing.
    
    To test for this issue, put a `WARN_ON(page_ref_count(page) == 0)` in the
    `offset < 0` path, below the virt_to_page() call, and then repeatedly call
    writev() on a TAP device with IFF_TAP|IFF_NO_PI|IFF_NAPI_FRAGS|IFF_NAPI,
    with a vector consisting of 15 elements containing 1 byte each.
    Signed-off-by: default avatarJann Horn <jannh@google.com>
    Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
    2c2ade81
page_alloc.c 230 KB