lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Tue, 3 Mar 2009 08:01:41 +0900 From: Minchan Kim <minchan.kim@...il.com> To: Andrew Morton <akpm@...ux-foundation.org> Cc: linux-mm@...ck.org, linux-kernel@...r.kernel.org Subject: Re: [PATCH] mmtom : add VM_BUG_ON in __get_free_pages On Tue, Mar 3, 2009 at 7:27 AM, Andrew Morton <akpm@...ux-foundation.org> wrote: > On Mon, 2 Mar 2009 18:31:48 +0900 > MinChan Kim <minchan.kim@...il.com> wrote: > >> >> The __get_free_pages is used in many place. >> Also, driver developers can use it freely due to export function. >> Some developers might use it to allocate high pages by mistake. >> >> The __get_free_pages can allocate high page using alloc_pages, >> but it can't return linear address for high page. >> >> Even worse, in this csse, caller can't free page which are there in high zone. >> So, It would be better to add VM_BUG_ON. >> >> It's based on mmtom 2009-02-27-13-54. >> >> Signed-off-by: MinChan Kim <minchan.kim@...il.com> >> --- >> mm/page_alloc.c | 7 +++++++ >> 1 files changed, 7 insertions(+), 0 deletions(-) >> >> diff --git a/mm/page_alloc.c b/mm/page_alloc.c >> index 8294107..381056b 100644 >> --- a/mm/page_alloc.c >> +++ b/mm/page_alloc.c >> @@ -1681,6 +1681,13 @@ EXPORT_SYMBOL(__alloc_pages_internal); >> unsigned long __get_free_pages(gfp_t gfp_mask, unsigned int order) >> { >> struct page * page; >> + >> + /* >> + * __get_free_pages() returns a 32-bit address, which cannot represent >> + * a highmem page >> + */ >> + VM_BUG_ON((gfp_mask & __GFP_HIGHMEM) != 0); >> + >> page = alloc_pages(gfp_mask, order); >> if (!page) >> return 0; > > If someone calls __get_free_pages(__GFP_HIGHMEM) then page_address() > will reliably return NULL and the caller's code will oops. If someone fail to allocate highmem, he might retry to allocate page in normal or dma. then he will get the page. but, more important thing is that In first try, page allocator succeeded to allocate page in highmem and just failed to translate from page to linear address by page_address(page). So, the caller don't have any way to free high page. How do we solve this problem ? > Yes, there's a decent (and increasing) risk that the developer won't be > testing the code on a highmem machine, but there are enough highmem > machines out there that the bug should be discovered pretty quickly. > So I'm not sure that this test is worth the additional overhead to a > fairly frequently called function? > I agree. If you have a concern about hotpath, how about adding annotation to prevent wrong usage ? If you agree with my suggestion, I will resend this patch with more detail changelog. Signed-off-by: MinChan Kim <minchan.kim@...il.com> --- mm/page_alloc.c | 1 + 1 files changed, 1 insertions(+), 0 deletions(-) diff --git a/mm/page_alloc.c b/mm/page_alloc.c index 381056b..b168c5f 100644 --- a/mm/page_alloc.c +++ b/mm/page_alloc.c @@ -1677,6 +1677,7 @@ EXPORT_SYMBOL(__alloc_pages_internal); /* * Common helper functions. + * This function must not be used with __GFP_HIGHMEM. */ unsigned long __get_free_pages(gfp_t gfp_mask, unsigned int order) { -- 1.5.4.3 -- Kinds regards, MinChan Kim -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@...r.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
Powered by blists - more mailing lists