Skip to contentSkip to conversation

mm/damon/paddr: Fix folio-use-after-put bugs

PATCH Applied SeongJae Park 3 participants 8 messages Mar 4, 2023 – Mar 6, 2023

Subsystems (3)
Stable branch Memory management DAMON
lore
Share & tools
lore

SeongJae Park

author maintainer
#0 lore raw

cover mm/damon/paddr: Fix folio-use-after-put bugs

There are two folio accesses after folio_put() in mm/damon/paddr.c file. Fix those.

SeongJae Park (2):
mm/damon/paddr: fix folio_size() call after folio_put() in
damon_pa_young()
mm/damon/paddr: fix folio_nr_pages() after folio_put() in
damon_pa_mark_accessed_or_deactivate()

 mm/damon/paddr.c | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)
Signature · 1 line
2.25.1
author maintainer
#1 lore raw

PATCH 1/2 mm/damon/paddr: fix folio_size() call after folio_put() in damon_pa_young()

damon_pa_young() is accessing a folio via folio_size() after folio_put() for the folio has invoked. Fix it.

Fixes 397b0c3a584b ("mm/damon/paddr: remove folio_sz field from damon_pa_access_chk_result")
Cc <[email protected]> # 6.3.x
Signed-off-by SeongJae Park <[email protected]>
---
 mm/damon/paddr.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)
mm/damon/paddr.c +1 -2
index 3fda00a0f786..10f159b315ea 100644
@@ -130,7 +130,6 @@ static bool damon_pa_young(unsigned long paddr, unsigned long *folio_sz)
 			accessed = false;
 		else
 			accessed = true;
-		folio_put(folio);
 		goto out;
 	}
 

@@ -144,10 +143,10 @@ static bool damon_pa_young(unsigned long paddr, unsigned long *folio_sz)
 
 	if (need_lock)
 		folio_unlock(folio);
-	folio_put(folio);
 
 out:
 	*folio_sz = folio_size(folio);
+	folio_put(folio);
 	return accessed;
 }
Signature · 1 line
2.25.1
Reviewed-by on v1 1/2
#2 lore raw

Re: [PATCH 1/2] mm/damon/paddr: fix folio_size() call after folio_put() in damon_pa_young()

Quoted 6 lines · SeongJae Park

damon_pa_young() is accessing a folio via folio_size() after folio_put() for the folio has invoked. Fix it.

Fixes 397b0c3a584b ("mm/damon/paddr: remove folio_sz field from damon_pa_access_chk_result")
Cc <[email protected]> # 6.3.x
Signed-off-by SeongJae Park <[email protected]>
Reviewed-by Matthew Wilcox (Oracle) <[email protected]>
Reviewed-by on v1 1/2
#3 lore raw

Re: [PATCH 1/2] mm/damon/paddr: fix folio_size() call after folio_put() in damon_pa_young()

In reply to SeongJae Park
Quoted 3 lines · SeongJae Park

damon_pa_young() is accessing a folio via folio_size() after folio_put() for the folio has invoked. Fix it.

Reviewed-by Kefeng Wang <[email protected]>
Quoted 31 lines
Fixes 397b0c3a584b ("mm/damon/paddr: remove folio_sz field from damon_pa_access_chk_result")
Cc <[email protected]> # 6.3.x
Signed-off-by SeongJae Park <[email protected]>
---
  mm/damon/paddr.c | 3 +--
  1 file changed, 1 insertion(+), 2 deletions(-)
mm/damon/paddr.c +1 -2
index 3fda00a0f786..10f159b315ea 100644
@@ -130,7 +130,6 @@ static bool damon_pa_young(unsigned long paddr, unsigned long *folio_sz)
  			accessed = false;
  		else
  			accessed = true;
-		folio_put(folio);
  		goto out;
  	}
 

@@ -144,10 +143,10 @@ static bool damon_pa_young(unsigned long paddr, unsigned long *folio_sz)
 
  	if (need_lock)
  		folio_unlock(folio);
-	folio_put(folio);
 
  out:
  	*folio_sz = folio_size(folio);
+	folio_put(folio);
  	return accessed;
  }
author maintainer
#4 lore raw

PATCH 2/2 mm/damon/paddr: fix folio_nr_pages() after folio_put() in damon_pa_mark_accessed_or_deactivate()

In reply to SeongJae Park

damon_pa_mark_accessed_or_deactivate() is accessing a folio via folio_nr_pages() after folio_put() for the folio has invoked. Fix it.

Fixes f70da5ee8fe1 ("mm/damon: convert damon_pa_mark_accessed_or_deactivate() to use folios")
Cc <[email protected]> # 6.3.x
Signed-off-by SeongJae Park <[email protected]>
---
 mm/damon/paddr.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
mm/damon/paddr.c +1 -1
index 10f159b315ea..0db724aec5cb 100644
@@ -277,8 +277,8 @@ static inline unsigned long damon_pa_mark_accessed_or_deactivate(
 			folio_mark_accessed(folio);
 		else
 			folio_deactivate(folio);
-		folio_put(folio);
 		applied += folio_nr_pages(folio);
+		folio_put(folio);
 	}
 	return applied * PAGE_SIZE;
 }
Signature · 1 line
2.25.1
Reviewed-by on v1 2/2
#5 lore raw

Re: [PATCH 2/2] mm/damon/paddr: fix folio_nr_pages() after folio_put() in damon_pa_mark_accessed_or_deactivate()

Quoted 6 lines · SeongJae Park

damon_pa_mark_accessed_or_deactivate() is accessing a folio via folio_nr_pages() after folio_put() for the folio has invoked. Fix it.

Fixes f70da5ee8fe1 ("mm/damon: convert damon_pa_mark_accessed_or_deactivate() to use folios")
Cc <[email protected]> # 6.3.x
Signed-off-by SeongJae Park <[email protected]>
Reviewed-by Matthew Wilcox (Oracle) <[email protected]>
Reviewed-by on v1 2/2
#6 lore raw

Re: [PATCH 2/2] mm/damon/paddr: fix folio_nr_pages() after folio_put() in damon_pa_mark_accessed_or_deactivate()

In reply to SeongJae Park
Quoted 3 lines · SeongJae Park

damon_pa_mark_accessed_or_deactivate() is accessing a folio via folio_nr_pages() after folio_put() for the folio has invoked. Fix it.

Reviewed-by Kefeng Wang <[email protected]>
Quoted 21 lines
Fixes f70da5ee8fe1 ("mm/damon: convert damon_pa_mark_accessed_or_deactivate() to use folios")
Cc <[email protected]> # 6.3.x
Signed-off-by SeongJae Park <[email protected]>
---
  mm/damon/paddr.c | 2 +-
  1 file changed, 1 insertion(+), 1 deletion(-)
mm/damon/paddr.c +1 -1
index 10f159b315ea..0db724aec5cb 100644
@@ -277,8 +277,8 @@ static inline unsigned long damon_pa_mark_accessed_or_deactivate(
  			folio_mark_accessed(folio);
  		else
  			folio_deactivate(folio);
-		folio_put(folio);
  		applied += folio_nr_pages(folio);
+		folio_put(folio);
  	}
  	return applied * PAGE_SIZE;
  }
#7 lore raw
In reply to SeongJae Park
Quoted 2 lines · SeongJae Park

There are two folio accesses after folio_put() in mm/damon/paddr.c file. Fix those.

I saw you send the bugfixes separately :)

Quoted 10 lines

SeongJae Park (2):
mm/damon/paddr: fix folio_size() call after folio_put() in
damon_pa_young()
mm/damon/paddr: fix folio_nr_pages() after folio_put() in
damon_pa_mark_accessed_or_deactivate()

  mm/damon/paddr.c | 5 ++---
  1 file changed, 2 insertions(+), 3 deletions(-)