mm/debug.c: do not dereference i_ino blindly

__dump_page() checks i_dentry is fetchable and i_ino is earlier in the
struct than i_ino, so it ought to work fine, but it's possible that struct
randomisation has reordered i_ino after i_dentry and the pointer is just
wild enough that i_dentry is fetchable and i_ino isn't.

Also print the inode number if the dentry is invalid.

Reported-by: Vlastimil Babka <vbabka@suse.cz>
Signed-off-by: Matthew Wilcox (Oracle) <willy@infradead.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Reviewed-by: John Hubbard <jhubbard@nvidia.com>
Reviewed-by: Mike Rapoport <rppt@linux.ibm.com>
Link: https://lkml.kernel.org/r/20200819185710.28180-1-willy@infradead.org
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

diff --git a/mm/debug.c b/mm/debug.c
index ca8d1cacdecc83098b8c89ba8da22d59fefb56f3..2a767865145cc6aa240c6b04ccc91aa134bb6130 100644 (file)
--- a/mm/debug.c
+++ b/mm/debug.c
@@ -120,6 +120,7 @@ void __dump_page(struct page *page, const char *reason)
                struct hlist_node *dentry_first;
                struct dentry *dentry_ptr;
                struct dentry dentry;
+               unsigned long ino;
 
                /*
                 * mapping can be invalid pointer and we don't want to crash
@@ -136,21 +137,22 @@ void __dump_page(struct page *page, const char *reason)
                        goto out_mapping;
                }
 
-               if (get_kernel_nofault(dentry_first, &host->i_dentry.first)) {
+               if (get_kernel_nofault(dentry_first, &host->i_dentry.first) ||
+                   get_kernel_nofault(ino, &host->i_ino)) {
                        pr_warn("aops:%ps with invalid host inode %px\n",
                                        a_ops, host);
                        goto out_mapping;
                }
 
                if (!dentry_first) {
-                       pr_warn("aops:%ps ino:%lx\n", a_ops, host->i_ino);
+                       pr_warn("aops:%ps ino:%lx\n", a_ops, ino);
                        goto out_mapping;
                }
 
                dentry_ptr = container_of(dentry_first, struct dentry, d_u.d_alias);
                if (get_kernel_nofault(dentry, dentry_ptr)) {
-                       pr_warn("aops:%ps with invalid dentry %px\n", a_ops,
-                                       dentry_ptr);
+                       pr_warn("aops:%ps ino:%lx with invalid dentry %px\n",
+                                       a_ops, ino, dentry_ptr);
                } else {
                        /*
                         * if dentry is corrupted, the %pd handler may still
@@ -158,7 +160,7 @@ void __dump_page(struct page *page, const char *reason)
                         * corrupted struct page
                         */
                        pr_warn("aops:%ps ino:%lx dentry name:\"%pd\"\n",
-                                       a_ops, host->i_ino, &dentry);
+                                       a_ops, ino, &dentry);
                }
        }
 out_mapping: