Commit 853322a6 authored by Matthew Wilcox (Oracle)'s avatar Matthew Wilcox (Oracle) Committed by Linus Torvalds

mm/debug.c: do not dereference i_ino blindly

__dump_page() checks i_dentry is fetchable and i_ino is earlier in the
struct than i_ino, so it ought to work fine, but it's possible that struct
randomisation has reordered i_ino after i_dentry and the pointer is just
wild enough that i_dentry is fetchable and i_ino isn't.

Also print the inode number if the dentry is invalid.
Reported-by: default avatarVlastimil Babka <vbabka@suse.cz>
Signed-off-by: default avatarMatthew Wilcox (Oracle) <willy@infradead.org>
Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
Reviewed-by: default avatarJohn Hubbard <jhubbard@nvidia.com>
Reviewed-by: default avatarMike Rapoport <rppt@linux.ibm.com>
Link: https://lkml.kernel.org/r/20200819185710.28180-1-willy@infradead.orgSigned-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
parent 8490e2e2
...@@ -120,6 +120,7 @@ void __dump_page(struct page *page, const char *reason) ...@@ -120,6 +120,7 @@ void __dump_page(struct page *page, const char *reason)
struct hlist_node *dentry_first; struct hlist_node *dentry_first;
struct dentry *dentry_ptr; struct dentry *dentry_ptr;
struct dentry dentry; struct dentry dentry;
unsigned long ino;
/* /*
* mapping can be invalid pointer and we don't want to crash * mapping can be invalid pointer and we don't want to crash
...@@ -136,21 +137,22 @@ void __dump_page(struct page *page, const char *reason) ...@@ -136,21 +137,22 @@ void __dump_page(struct page *page, const char *reason)
goto out_mapping; goto out_mapping;
} }
if (get_kernel_nofault(dentry_first, &host->i_dentry.first)) { if (get_kernel_nofault(dentry_first, &host->i_dentry.first) ||
get_kernel_nofault(ino, &host->i_ino)) {
pr_warn("aops:%ps with invalid host inode %px\n", pr_warn("aops:%ps with invalid host inode %px\n",
a_ops, host); a_ops, host);
goto out_mapping; goto out_mapping;
} }
if (!dentry_first) { if (!dentry_first) {
pr_warn("aops:%ps ino:%lx\n", a_ops, host->i_ino); pr_warn("aops:%ps ino:%lx\n", a_ops, ino);
goto out_mapping; goto out_mapping;
} }
dentry_ptr = container_of(dentry_first, struct dentry, d_u.d_alias); dentry_ptr = container_of(dentry_first, struct dentry, d_u.d_alias);
if (get_kernel_nofault(dentry, dentry_ptr)) { if (get_kernel_nofault(dentry, dentry_ptr)) {
pr_warn("aops:%ps with invalid dentry %px\n", a_ops, pr_warn("aops:%ps ino:%lx with invalid dentry %px\n",
dentry_ptr); a_ops, ino, dentry_ptr);
} else { } else {
/* /*
* if dentry is corrupted, the %pd handler may still * if dentry is corrupted, the %pd handler may still
...@@ -158,7 +160,7 @@ void __dump_page(struct page *page, const char *reason) ...@@ -158,7 +160,7 @@ void __dump_page(struct page *page, const char *reason)
* corrupted struct page * corrupted struct page
*/ */
pr_warn("aops:%ps ino:%lx dentry name:\"%pd\"\n", pr_warn("aops:%ps ino:%lx dentry name:\"%pd\"\n",
a_ops, host->i_ino, &dentry); a_ops, ino, &dentry);
} }
} }
out_mapping: out_mapping:
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment