lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date:	Tue, 3 Mar 2009 08:01:41 +0900
From:	Minchan Kim <minchan.kim@...il.com>
To:	Andrew Morton <akpm@...ux-foundation.org>
Cc:	linux-mm@...ck.org, linux-kernel@...r.kernel.org
Subject: Re: [PATCH] mmtom : add VM_BUG_ON in __get_free_pages

On Tue, Mar 3, 2009 at 7:27 AM, Andrew Morton <akpm@...ux-foundation.org> wrote:
> On Mon, 2 Mar 2009 18:31:48 +0900
> MinChan Kim <minchan.kim@...il.com> wrote:
>
>>
>> The __get_free_pages is used in many place.
>> Also, driver developers can use it freely due to export function.
>> Some developers might use it to allocate high pages by mistake.
>>
>> The __get_free_pages can allocate high page using alloc_pages,
>> but it can't return linear address for high page.
>>
>> Even worse, in this csse, caller can't free page which are there in high zone.
>> So, It would be better to add VM_BUG_ON.
>>
>> It's based on mmtom 2009-02-27-13-54.
>>
>> Signed-off-by: MinChan Kim <minchan.kim@...il.com>
>> ---
>>  mm/page_alloc.c |    7 +++++++
>>  1 files changed, 7 insertions(+), 0 deletions(-)
>>
>> diff --git a/mm/page_alloc.c b/mm/page_alloc.c
>> index 8294107..381056b 100644
>> --- a/mm/page_alloc.c
>> +++ b/mm/page_alloc.c
>> @@ -1681,6 +1681,13 @@ EXPORT_SYMBOL(__alloc_pages_internal);
>>  unsigned long __get_free_pages(gfp_t gfp_mask, unsigned int order)
>>  {
>>       struct page * page;
>> +
>> +     /*
>> +      * __get_free_pages() returns a 32-bit address, which cannot represent
>> +      * a highmem page
>> +      */
>> +     VM_BUG_ON((gfp_mask & __GFP_HIGHMEM) != 0);
>> +
>>       page = alloc_pages(gfp_mask, order);
>>       if (!page)
>>               return 0;
>
> If someone calls __get_free_pages(__GFP_HIGHMEM) then page_address()
> will reliably return NULL and the caller's code will oops.

If someone fail to allocate highmem, he might retry to allocate page
in normal or dma. then he will get the page.
but, more important thing is that In first try, page allocator
succeeded to allocate page in highmem and just failed to translate
from page to linear address by page_address(page).

So, the caller don't have any way to free high page.
How do we solve this problem ?


> Yes, there's a decent (and increasing) risk that the developer won't be
> testing the code on a highmem machine, but there are enough highmem
> machines out there that the bug should be discovered pretty quickly.
> So I'm not sure that this test is worth the additional overhead to a
> fairly frequently called function?
>

I agree.

If you have a concern about hotpath,  how about adding annotation to
prevent wrong usage ?
If you agree with my suggestion, I will resend this patch with more
detail changelog.

 Signed-off-by: MinChan Kim <minchan.kim@...il.com>

---
 mm/page_alloc.c |    1 +
 1 files changed, 1 insertions(+), 0 deletions(-)

diff --git a/mm/page_alloc.c b/mm/page_alloc.c
index 381056b..b168c5f 100644
--- a/mm/page_alloc.c
+++ b/mm/page_alloc.c
@@ -1677,6 +1677,7 @@ EXPORT_SYMBOL(__alloc_pages_internal);

 /*
  * Common helper functions.
+ * This function must not be used with __GFP_HIGHMEM.
  */
 unsigned long __get_free_pages(gfp_t gfp_mask, unsigned int order)
 {
-- 
1.5.4.3




-- 
Kinds regards,
MinChan Kim
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

Powered by blists - more mailing lists