linux-kernel - [PATCH] percpu: pcpu_embed_first_chunk() should free unused parts after all allocs are complete

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20120427154253.GL27486@google.com>
Date:	Fri, 27 Apr 2012 08:42:53 -0700
From:	Tejun Heo <tj@...nel.org>
To:	"Pavel V. Panteleev" <pp_84@...l.ru>,
	Christoph Lameter <cl@...ux-foundation.org>
Cc:	linux-mm <linux-mm@...k.org>,
	linux-kernel <linux-kernel@...r.kernel.org>,
	andi <andi@...stfloor.org>
Subject: [PATCH] percpu: pcpu_embed_first_chunk() should free unused parts
 after all allocs are complete

pcpu_embed_first_chunk() allocates memory for each node, copies percpu
data and frees unused portions of it before proceeding to the next
group.  This assumes that allocations for different nodes doesn't
overlap; however, depending on memory topology, the bootmem allocator
may end up allocating memory from a different node than the requested
one which may overlap with the portion freed from one of the previous
percpu areas.  This leads to percpu groups for different nodes
overlapping which is a serious bug.

This patch separates out copy & partial free from the allocation loop
such that all allocations are complete before partial frees happen.

This also fixes overlapping frees which could happen on allocation
failure path - out_free_areas path frees whole groups but the groups
could have portions freed at that point.

Signed-off-by: Tejun Heo <tj@...nel.org>
Cc: stable@...r.kernel.org
Reported-by: "Pavel V. Panteleev" <pp_84@...l.ru>
LKML-Reference: <E1SNhwY-0007ui-V7.pp_84-mail-ru@...0.mail.ru>
---
Can you please verify this patch fixes the problem?

Thanks.

 mm/percpu.c |   10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/mm/percpu.c b/mm/percpu.c
index f47af91..7975693 100644
--- a/mm/percpu.c
+++ b/mm/percpu.c
@@ -1650,6 +1650,16 @@ int __init pcpu_embed_first_chunk(size_t reserved_size, size_t dyn_size,
 		areas[group] = ptr;

 		base = min(ptr, base);
+	}
+
+	/*
+	 * Copy data and free unused parts.  This should happen after all
+	 * allocations are complete; otherwise, we may end up with
+	 * overlapping groups.
+	 */
+	for (group = 0; group < ai->nr_groups; group++) {
+		struct pcpu_group_info *gi = &ai->groups[group];
+		void *ptr = areas[group];

 		for (i = 0; i < gi->nr_units; i++, ptr += ai->unit_size) {
 			if (gi->cpu_map[i] == NR_CPUS) {
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/