linux-kernel - [PATCH V2] x86/mm/pat: Do a small optimization and fix in reserve

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:	Tue, 21 Jul 2015 16:02:00 +0800
From:	Pan Xinhui <xinhuix.pan@...el.com>
To:	"linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>
CC:	tglx@...utronix.de, mingo@...hat.com, hpa@...or.com,
	x86@...nel.org, bp@...e.de, toshi.kani@...com, jgross@...e.com,
	mcgrof@...e.com, "mnipxh@....com" <mnipxh@....com>,
	"yanmin_zhang@...ux.intel.com" <yanmin_zhang@...ux.intel.com>
Subject: [PATCH V2] x86/mm/pat: Do a small optimization and fix in reserve_memtype

From: Pan Xinhui <xinhuix.pan@...el.com>

It's safe and more reasonable to unlock memtype_lock right after
rbt_memtype_check_insert. It's not cool to call kfree, pr_info, etc with
this lock held. So move spin_unlock a little ahead.

memory_lock protects data stored in rb-tree, if *new* succeed to be
stored into the rb-tree, we might hit panic. Because we access *new* in
dprintk "cattr_name(new->type)". data stored in the rb-tree might be
freed at any possbile time. It's abviously wrong to access such data
without lock. So save new->type to actual_type, and use actual_type in
dprintk.

Signed-off-by: Pan Xinhui <xinhuix.pan@...el.com>
---
change from V1:
	fix an access of *new* without memtype_lock held.
---
 arch/x86/mm/pat.c | 10 ++++------
 1 file changed, 4 insertions(+), 6 deletions(-)

diff --git a/arch/x86/mm/pat.c b/arch/x86/mm/pat.c
index 188e3e0..f3c49fa 100644
--- a/arch/x86/mm/pat.c
+++ b/arch/x86/mm/pat.c
@@ -538,22 +538,20 @@ int reserve_memtype(u64 start, u64 end, enum page_cache_mode req_type,
 	new->type	= actual_type;
 
 	spin_lock(&memtype_lock);
-
 	err = rbt_memtype_check_insert(new, new_type);
+	actual_type = new->type;
+	spin_unlock(&memtype_lock);
+
 	if (err) {
 		pr_info("x86/PAT: reserve_memtype failed [mem %#010Lx-%#010Lx], track %s, req %s\n",
 			start, end - 1,
 			cattr_name(new->type), cattr_name(req_type));
 		kfree(new);
-		spin_unlock(&memtype_lock);
-
 		return err;
 	}
 
-	spin_unlock(&memtype_lock);
-
 	dprintk("reserve_memtype added [mem %#010Lx-%#010Lx], track %s, req %s, ret %s\n",
-		start, end - 1, cattr_name(new->type), cattr_name(req_type),
+		start, end - 1, cattr_name(actual_type), cattr_name(req_type),
 		new_type ? cattr_name(*new_type) : "-");
 
 	return err;
-- 
1.9.1
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/