Commit 39a22a4c authored Jul 15, 2022 by Maurizio Lombardi Committed by Greg Kroah-Hartman Oct 05, 2022

mm: prevent page_frag_alloc() from corrupting the memory

commit dac22531bbd4af2426c4e29e05594415ccfa365d upstream.

A number of drivers call page_frag_alloc() with a fragment's size >
PAGE_SIZE.

In low memory conditions, __page_frag_cache_refill() may fail the order
3 cache allocation and fall back to order 0; In this case, the cache
will be smaller than the fragment, causing memory corruptions.

Prevent this from happening by checking if the newly allocated cache is
large enough for the fragment; if not, the allocation will fail and
page_frag_alloc() will return NULL.

Link: https://lkml.kernel.org/r/20220715125013.247085-1-mlombard@redhat.com


Fixes: b63ae8ca ("mm/net: Rename and move page fragment handling from net/ to mm/")
Signed-off-by: Maurizio Lombardi <mlombard@redhat.com>
Reviewed-by: Alexander Duyck <alexanderduyck@fb.com>
Cc: Chen Lin <chen45464546@163.com>
Cc: Jakub Kicinski <kuba@kernel.org>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

parent 26e871af

mm/page_alloc.c

+12 −0

Original line number	Diff line number	Diff line
		@@ -4603,6 +4603,18 @@ void page_frag_alloc(struct page_frag_cache nc,
		/* reset page count bias and offset to start of new frag */
		nc->pagecnt_bias = PAGE_FRAG_CACHE_MAX_SIZE + 1;
		offset = size - fragsz;
		if (unlikely(offset < 0)) {
		/*
		* The caller is trying to allocate a fragment
		* with fragsz > PAGE_SIZE but the cache isn't big
		* enough to satisfy the request, this may
		* happen in low memory conditions.
		* We don't release the cache page because
		* it could make memory pressure worse
		* so we simply return NULL here.
		*/
		return NULL;
		}
		}

		nc->pagecnt_bias--;