From: Greg KH <gregkh@linuxfoundation•org>
To: Coly Li <colyli@suse•de>
Cc: linux-block@vger•kernel.org, linux-nvme@lists•infradead.org,
netdev@vger•kernel.org, open-iscsi@googlegroups•com,
linux-scsi@vger•kernel.org, ceph-devel@vger•kernel.org,
linux-kernel@vger•kernel.org,
Chaitanya Kulkarni <chaitanya.kulkarni@wdc•com>,
Christoph Hellwig <hch@lst•de>, Hannes Reinecke <hare@suse•de>,
Jan Kara <jack@suse•com>, Jens Axboe <axboe@kernel•dk>,
Mikhail Skorzhinskii <mskorzhinskiy@solarflare•com>,
Philipp Reisner <philipp.reisner@linbit•com>,
Sagi Grimberg <sagi@grimberg•me>,
Vlastimil Babka <vbabka@suse•com>,
stable@vger•kernel.org
Subject: Re: [PATCH v8 1/7] net: introduce helper sendpage_ok() in include/linux/net.h
Date: Fri, 25 Sep 2020 17:18:12 +0200 [thread overview]
Message-ID: <20200925151812.GA3182427@kroah.com> (raw)
In-Reply-To: <20200925150119.112016-2-colyli@suse.de>
On Fri, Sep 25, 2020 at 11:01:13PM +0800, Coly Li wrote:
> The original problem was from nvme-over-tcp code, who mistakenly uses
> kernel_sendpage() to send pages allocated by __get_free_pages() without
> __GFP_COMP flag. Such pages don't have refcount (page_count is 0) on
> tail pages, sending them by kernel_sendpage() may trigger a kernel panic
> from a corrupted kernel heap, because these pages are incorrectly freed
> in network stack as page_count 0 pages.
>
> This patch introduces a helper sendpage_ok(), it returns true if the
> checking page,
> - is not slab page: PageSlab(page) is false.
> - has page refcount: page_count(page) is not zero
>
> All drivers who want to send page to remote end by kernel_sendpage()
> may use this helper to check whether the page is OK. If the helper does
> not return true, the driver should try other non sendpage method (e.g.
> sock_no_sendpage()) to handle the page.
>
> Signed-off-by: Coly Li <colyli@suse•de>
> Cc: Chaitanya Kulkarni <chaitanya.kulkarni@wdc•com>
> Cc: Christoph Hellwig <hch@lst•de>
> Cc: Hannes Reinecke <hare@suse•de>
> Cc: Jan Kara <jack@suse•com>
> Cc: Jens Axboe <axboe@kernel•dk>
> Cc: Mikhail Skorzhinskii <mskorzhinskiy@solarflare•com>
> Cc: Philipp Reisner <philipp.reisner@linbit•com>
> Cc: Sagi Grimberg <sagi@grimberg•me>
> Cc: Vlastimil Babka <vbabka@suse•com>
> Cc: stable@vger•kernel.org
> ---
> include/linux/net.h | 16 ++++++++++++++++
> 1 file changed, 16 insertions(+)
>
> diff --git a/include/linux/net.h b/include/linux/net.h
> index d48ff1180879..05db8690f67e 100644
> --- a/include/linux/net.h
> +++ b/include/linux/net.h
> @@ -21,6 +21,7 @@
> #include <linux/rcupdate.h>
> #include <linux/once.h>
> #include <linux/fs.h>
> +#include <linux/mm.h>
> #include <linux/sockptr.h>
>
> #include <uapi/linux/net.h>
> @@ -286,6 +287,21 @@ do { \
> #define net_get_random_once_wait(buf, nbytes) \
> get_random_once_wait((buf), (nbytes))
>
> +/*
> + * E.g. XFS meta- & log-data is in slab pages, or bcache meta
> + * data pages, or other high order pages allocated by
> + * __get_free_pages() without __GFP_COMP, which have a page_count
> + * of 0 and/or have PageSlab() set. We cannot use send_page for
> + * those, as that does get_page(); put_page(); and would cause
> + * either a VM_BUG directly, or __page_cache_release a page that
> + * would actually still be referenced by someone, leading to some
> + * obscure delayed Oops somewhere else.
> + */
> +static inline bool sendpage_ok(struct page *page)
> +{
> + return !PageSlab(page) && page_count(page) >= 1;
Do you have one extra ' ' after "return" there?
And this feels like a mm thing, why put it in net.h and not mm.h?
thanks,
greg k-h
next prev parent reply other threads:[~2020-09-25 15:18 UTC|newest]
Thread overview: 13+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-09-25 15:01 [PATCH v8 0/7] Introduce sendpage_ok() to detect misused sendpage in network related drivers Coly Li
2020-09-25 15:01 ` [PATCH v8 1/7] net: introduce helper sendpage_ok() in include/linux/net.h Coly Li
2020-09-25 15:18 ` Greg KH [this message]
2020-09-26 13:28 ` Coly Li
2020-09-27 12:21 ` Greg KH
2020-09-25 15:01 ` [PATCH v8 2/7] net: add WARN_ONCE in kernel_sendpage() for improper zero-copy send Coly Li
2020-09-25 15:01 ` [PATCH v8 3/7] nvme-tcp: check page by sendpage_ok() before calling kernel_sendpage() Coly Li
2020-09-25 15:01 ` [PATCH v8 4/7] tcp: use sendpage_ok() to detect misused .sendpage Coly Li
2020-09-25 15:01 ` [PATCH v8 5/7] drbd: code cleanup by using sendpage_ok() to check page for kernel_sendpage() Coly Li
2020-09-25 15:01 ` [PATCH v8 6/7] scsi: libiscsi: use sendpage_ok() in iscsi_tcp_segment_map() Coly Li
2020-09-25 20:54 ` Martin K. Petersen
2020-09-25 15:01 ` [PATCH v8 7/7] libceph: use sendpage_ok() in ceph_tcp_sendpage() Coly Li
2020-09-25 15:13 ` Jeff Layton
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20200925151812.GA3182427@kroah.com \
--to=gregkh@linuxfoundation$(echo .)org \
--cc=axboe@kernel$(echo .)dk \
--cc=ceph-devel@vger$(echo .)kernel.org \
--cc=chaitanya.kulkarni@wdc$(echo .)com \
--cc=colyli@suse$(echo .)de \
--cc=hare@suse$(echo .)de \
--cc=hch@lst$(echo .)de \
--cc=jack@suse$(echo .)com \
--cc=linux-block@vger$(echo .)kernel.org \
--cc=linux-kernel@vger$(echo .)kernel.org \
--cc=linux-nvme@lists$(echo .)infradead.org \
--cc=linux-scsi@vger$(echo .)kernel.org \
--cc=mskorzhinskiy@solarflare$(echo .)com \
--cc=netdev@vger$(echo .)kernel.org \
--cc=open-iscsi@googlegroups$(echo .)com \
--cc=philipp.reisner@linbit$(echo .)com \
--cc=sagi@grimberg$(echo .)me \
--cc=stable@vger$(echo .)kernel.org \
--cc=vbabka@suse$(echo .)com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox