linux-kernel - [tip:core/urgent] memblock: Fix alloc failure due to dumb underflow protection in memblock_find_in_range

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <tip-5d53cb27d849c899136c048ec84c940ac449494b@git.kernel.org>
Date:	Mon, 16 Jan 2012 01:03:50 -0800
From:	tip-bot for Tejun Heo <tj@...nel.org>
To:	linux-tip-commits@...r.kernel.org
Cc:	linux-kernel@...r.kernel.org, hpa@...or.com, mingo@...hat.com,
	konrad.wilk@...cle.com, torvalds@...ux-foundation.org,
	benh@...nel.crashing.org, akpm@...ux-foundation.org, tj@...nel.org,
	tglx@...utronix.de, mingo@...e.hu
Subject: [tip:core/urgent] memblock:
  Fix alloc failure due to dumb underflow protection in memblock_find_in_range_node
 ()

Commit-ID:  5d53cb27d849c899136c048ec84c940ac449494b
Gitweb:     http://git.kernel.org/tip/5d53cb27d849c899136c048ec84c940ac449494b
Author:     Tejun Heo <tj@...nel.org>
AuthorDate: Fri, 13 Jan 2012 10:14:12 -0800
Committer:  Ingo Molnar <mingo@...e.hu>
CommitDate: Mon, 16 Jan 2012 08:38:06 +0100

memblock: Fix alloc failure due to dumb underflow protection in memblock_find_in_range_node()

7bd0b0f0da ("memblock: Reimplement memblock allocation using
reverse free area iterator") implemented a simple top-down
allocator using a reverse memblock iterator.  To avoid underflow
in the allocator loop, it simply raised the lower boundary to
the requested size under the assumption that requested size
would be far smaller than available memblocks.

This causes early page table allocation failure under certain
configurations in Xen.  Fix it by checking for underflow directly
instead of bumping up lower bound.

Signed-off-by: Tejun Heo <tj@...nel.org>
Reported-by: Konrad Rzeszutek Wilk <konrad.wilk@...cle.com>
Cc: rjw@...k.pl
Cc: xen-devel@...ts.xensource.com
Cc: Benjamin Herrenschmidt <benh@...nel.crashing.org>
Cc: Andrew Morton <akpm@...ux-foundation.org>
Cc: Linus Torvalds <torvalds@...ux-foundation.org>
Link: http://lkml.kernel.org/r/20120113181412.GA11112@google.com
Signed-off-by: Ingo Molnar <mingo@...e.hu>
---
 mm/memblock.c |    7 +++++--
 1 files changed, 5 insertions(+), 2 deletions(-)

diff --git a/mm/memblock.c b/mm/memblock.c
index 2f55f19..77b5f22 100644
--- a/mm/memblock.c
+++ b/mm/memblock.c
@@ -106,14 +106,17 @@ phys_addr_t __init_memblock memblock_find_in_range_node(phys_addr_t start,
 	if (end == MEMBLOCK_ALLOC_ACCESSIBLE)
 		end = memblock.current_limit;
 
-	/* adjust @start to avoid underflow and allocating the first page */
-	start = max3(start, size, (phys_addr_t)PAGE_SIZE);
+	/* avoid allocating the first page */
+	start = max_t(phys_addr_t, start, PAGE_SIZE);
 	end = max(start, end);
 
 	for_each_free_mem_range_reverse(i, nid, &this_start, &this_end, NULL) {
 		this_start = clamp(this_start, start, end);
 		this_end = clamp(this_end, start, end);
 
+		if (this_end < size)
+			continue;
+
 		cand = round_down(this_end - size, align);
 		if (cand >= this_start)
 			return cand;
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/