Skip to content

Commit bd4d233

Browse files
Matthew Wilcox (Oracle)gregkh
Matthew Wilcox (Oracle)
authored andcommitted
mm: open-code page_folio() in dump_page()
commit 6a7de1b upstream. page_folio() calls page_fixed_fake_head() which will misidentify this page as being a fake head and load off the end of 'precise'. We may have a pointer to a fake head, but that's OK because it contains the right information for dump_page(). gcc-15 is smart enough to catch this with -Warray-bounds: In function 'page_fixed_fake_head', inlined from '_compound_head' at ../include/linux/page-flags.h:251:24, inlined from '__dump_page' at ../mm/debug.c:123:11: ../include/asm-generic/rwonce.h:44:26: warning: array subscript 9 is outside +array bounds of 'struct page[1]' [-Warray-bounds=] Link: https://lkml.kernel.org/r/[email protected] Fixes: fae7d83 ("mm: add __dump_folio()") Signed-off-by: Matthew Wilcox (Oracle) <[email protected]> Reported-by: Kees Cook <[email protected]> Cc: <[email protected]> Signed-off-by: Andrew Morton <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]>
1 parent 1dde3fd commit bd4d233

File tree

1 file changed

+5
-2
lines changed

1 file changed

+5
-2
lines changed

mm/debug.c

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -124,19 +124,22 @@ static void __dump_page(const struct page *page)
124124
{
125125
struct folio *foliop, folio;
126126
struct page precise;
127+
unsigned long head;
127128
unsigned long pfn = page_to_pfn(page);
128129
unsigned long idx, nr_pages = 1;
129130
int loops = 5;
130131

131132
again:
132133
memcpy(&precise, page, sizeof(*page));
133-
foliop = page_folio(&precise);
134-
if (foliop == (struct folio *)&precise) {
134+
head = precise.compound_head;
135+
if ((head & 1) == 0) {
136+
foliop = (struct folio *)&precise;
135137
idx = 0;
136138
if (!folio_test_large(foliop))
137139
goto dump;
138140
foliop = (struct folio *)page;
139141
} else {
142+
foliop = (struct folio *)(head - 1);
140143
idx = folio_page_idx(foliop, page);
141144
}
142145

0 commit comments

Comments
 (0)