| From liqiong@nfschina.com Thu Mar 17 11:25:02 2022 |
| From: liqiong <liqiong@nfschina.com> |
| Date: Thu, 17 Feb 2022 19:54:16 +0800 |
| Subject: mm: fix dereference a null pointer in migrate[_huge]_page_move_mapping() |
| To: david@redhat.com, gregkh@linuxfoundation.org |
| Cc: linux-mm@kvack.org, linux-kernel@vger.kernel.org, liqiong <liqiong@nfschina.com>, stable@vger.kernel.org |
| Message-ID: <20220217115416.55835-1-liqiong@nfschina.com> |
| |
| From: liqiong <liqiong@nfschina.com> |
| |
| Upstream doesn't use radix tree any more in migrate.c, no need this patch. |
| |
| The two functions look up a slot and dereference the pointer, |
| If the pointer is null, the kernel would crash and dump. |
| |
| The 'numad' service calls 'migrate_pages' periodically. If some slots |
| being replaced (Cache Eviction), the radix_tree_lookup_slot() returns |
| a null pointer that causes kernel crash. |
| |
| "numad": crash> bt |
| [exception RIP: migrate_page_move_mapping+337] |
| |
| Introduce pointer checking to avoid dereference a null pointer. |
| |
| Cc: <stable@vger.kernel.org> # linux-4.19.y |
| Signed-off-by: liqiong <liqiong@nfschina.com> |
| Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| --- |
| mm/migrate.c | 8 ++++++++ |
| 1 file changed, 8 insertions(+) |
| |
| --- a/mm/migrate.c |
| +++ b/mm/migrate.c |
| @@ -472,6 +472,10 @@ int migrate_page_move_mapping(struct add |
| |
| pslot = radix_tree_lookup_slot(&mapping->i_pages, |
| page_index(page)); |
| + if (pslot == NULL) { |
| + xa_unlock_irq(&mapping->i_pages); |
| + return -EAGAIN; |
| + } |
| |
| expected_count += hpage_nr_pages(page) + page_has_private(page); |
| if (page_count(page) != expected_count || |
| @@ -590,6 +594,10 @@ int migrate_huge_page_move_mapping(struc |
| xa_lock_irq(&mapping->i_pages); |
| |
| pslot = radix_tree_lookup_slot(&mapping->i_pages, page_index(page)); |
| + if (pslot == NULL) { |
| + xa_unlock_irq(&mapping->i_pages); |
| + return -EAGAIN; |
| + } |
| |
| expected_count = 2 + page_has_private(page); |
| if (page_count(page) != expected_count || |
