mm: sanitize page->mapping for tail pages

We don't define meaning of page->mapping for tail pages.  Currently it's
always NULL, which can be inconsistent with head page and potentially
lead to problems.

Let's poison the pointer to catch all illigal uses.

page_rmapping(), page_mapping() and page_anon_vma() are changed to look
on head page.

The only illegal use I've caught so far is __GPF_COMP pages from sound
subsystem, mapped with PTEs.  do_shared_fault() is changed to use
page_rmapping() instead of direct access to fault_page->mapping.

Signed-off-by: Kirill A. Shutemov <kirill.shutemov@linux.intel.com>
Reviewed-by: Jérôme Glisse <jglisse@redhat.com>
Cc: Andrea Arcangeli <aarcange@redhat.com>
Cc: Hugh Dickins <hughd@google.com>
Cc: Dave Hansen <dave.hansen@intel.com>
Cc: Mel Gorman <mgorman@suse.de>
Cc: Rik van Riel <riel@redhat.com>
Cc: Vlastimil Babka <vbabka@suse.cz>
Cc: Christoph Lameter <cl@linux.com>
Cc: Naoya Horiguchi <n-horiguchi@ah.jp.nec.com>
Cc: Steve Capper <steve.capper@linaro.org>
Cc: "Aneesh Kumar K.V" <aneesh.kumar@linux.vnet.ibm.com>
Cc: Johannes Weiner <hannes@cmpxchg.org>
Cc: Michal Hocko <mhocko@suse.cz>
Cc: Jerome Marchand <jmarchan@redhat.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

1 files changed, 6 insertions, 0 deletions

diff --git a/mm/page_alloc.c b/mm/page_alloc.c
index ce63d603820f..d02d6436add0 100644
--- a/mm/page_alloc.c
+++ b/mm/page_alloc.c
@@ -466,6 +466,7 @@ void prep_compound_page(struct page *page, unsigned int order)
         for (i = 1; i < nr_pages; i++) {
                 struct page *p = page + i;
                 set_page_count(p, 0);
+                p->mapping = TAIL_MAPPING;
                 set_compound_head(p, page);
         }
 }
@@ -856,6 +857,10 @@ static int free_tail_pages_check(struct page *head_page, struct page *page)
                 ret = 0;
                 goto out;
         }
+        if (page->mapping != TAIL_MAPPING) {
+                bad_page(page, "corrupted mapping in tail page", 0);
+                goto out;
+        }
         if (unlikely(!PageTail(page))) {
                 bad_page(page, "PageTail not set", 0);
                 goto out;
@@ -866,6 +871,7 @@ static int free_tail_pages_check(struct page *head_page, struct page *page)
         }
         ret = 0;
 out:
+        page->mapping = NULL;
         clear_compound_head(page);
         return ret;
 }