Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit ef2b4b95 authored by Andrea Arcangeli's avatar Andrea Arcangeli Committed by Linus Torvalds
Browse files

mm: PageBuddy and mapcount robustness 



Change the _mapcount value indicating PageBuddy from -2 to -128 for
more robusteness against page_mapcount() undeflows.

Use reset_page_mapcount instead of __ClearPageBuddy in bad_page to
ignore the previous retval of PageBuddy().

Signed-off-by: default avatarAndrea Arcangeli <aarcange@redhat.com>
Reported-by: default avatarHugh Dickins <hughd@google.com>
Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
parent 7b7adc4a

include/linux/mm.h

+9 −2
Original line number Diff line number Diff line
@@ -402,16 +402,23 @@ static inline void init_page_count(struct page *page) 
/*

 * PageBuddy() indicate that the page is free and in the buddy system

 * (see mm/page_alloc.c).

 *

 * PAGE_BUDDY_MAPCOUNT_VALUE must be <= -2 but better not too close to

 * -2 so that an underflow of the page_mapcount() won't be mistaken

 * for a genuine PAGE_BUDDY_MAPCOUNT_VALUE. -128 can be created very

 * efficiently by most CPU architectures.

 */

#define PAGE_BUDDY_MAPCOUNT_VALUE (-128)



static inline int PageBuddy(struct page *page)

{

	return atomic_read(&page->_mapcount) == -2;

	return atomic_read(&page->_mapcount) == PAGE_BUDDY_MAPCOUNT_VALUE;

}



static inline void __SetPageBuddy(struct page *page)

{

	VM_BUG_ON(atomic_read(&page->_mapcount) != -1);

	atomic_set(&page->_mapcount, -2);

	atomic_set(&page->_mapcount, PAGE_BUDDY_MAPCOUNT_VALUE);

}



static inline void __ClearPageBuddy(struct page *page)

mm/page_alloc.c

+2 −2
Original line number Diff line number Diff line
@@ -286,7 +286,7 @@ static void bad_page(struct page *page) 


	/* Don't complain about poisoned pages */

	if (PageHWPoison(page)) {

		__ClearPageBuddy(page);

		reset_page_mapcount(page); /* remove PageBuddy */

		return;

	}
@@ -317,7 +317,7 @@ static void bad_page(struct page *page) 
	dump_stack();

out:

	/* Leave bad fields for debug, except PageBuddy could make trouble */

	__ClearPageBuddy(page);

	reset_page_mapcount(page); /* remove PageBuddy */

	add_taint(TAINT_BAD_PAGE);

}