linux-kernel - Re: [powerpc] Fix bogus BUG_ON() in in hugetlb_get_unmapped

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20061222011706.GA27396@localhost.localdomain>
Date:	Fri, 22 Dec 2006 12:17:06 +1100
From:	David Gibson <david@...son.dropbear.id.au>
To:	Segher Boessenkool <segher@...nel.crashing.org>
Cc:	Andrew Morton <akpm@...l.org>,
	libhugetlbfs-devel@...ts.sourceforge.net,
	linux-kernel@...r.kernel.org,
	William Lee Irwin <wli@...omorphy.com>,
	linuxppc-dev@...abs.org, Paul Mackerras <paulus@...ba.org>
Subject: Re: [powerpc] Fix bogus BUG_ON() in in hugetlb_get_unmapped_area()

On Fri, Dec 22, 2006 at 01:31:26AM +0100, Segher Boessenkool wrote:
> > +	if (len > TASK_SIZE)
> > +		return -ENOMEM;
> 
> Shouldn't that be addr+len instead?  The check looks incomplete
> otherwise.  And you meant ">=" I guess?

No.  Have a look at the other hugetlb_get_unmapped_area()
implementations.  Because this is in the get_unmapped_area() path,
'addr' is just a hint, so checking addr+len would give bogus
failures.  This test is, I believe, essentially an optimization - if
it fails, we're never going to find a suitable addr, so we might as
well give up now.

> > -		/* Paranoia, caller should have dealt with this */
> > -		BUG_ON((addr + len) > 0x100000000UL);
> > -
> 
> Any real reason to remove the paranoia check?  If it's trivially
> always satisfied, the compiler will get rid of it for you :-)

Yes - this is the very bug on which was causing crashes - the "caller
should have dealt with this" comment is wrong.  The test has been
moved into htlb_check_hinted_area() and now simply fails (and so falls
back to searching for a suitable address), rather than BUG()ing.

-- 
David Gibson			| I'll have my music baroque, and my code
david AT gibson.dropbear.id.au	| minimalist, thank you.  NOT _the_ _other_
				| _way_ _around_!
http://www.ozlabs.org/~dgibson
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/