linux-kernel - Re: [PATCH] mm: cma: WARN if freed memory is still in use

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <xa1t8va6zsad.fsf@mina86.com>
Date:	Mon, 12 Nov 2012 17:42:50 +0100
From:	Michal Nazarewicz <mina86@...a86.com>
To:	Marek Szyprowski <m.szyprowski@...sung.com>, linux-mm@...ck.org,
	linaro-mm-sig@...ts.linaro.org, linux-kernel@...r.kernel.org
Cc:	Marek Szyprowski <m.szyprowski@...sung.com>,
	Kyungmin Park <kyungmin.park@...sung.com>,
	Andrew Morton <akpm@...ux-foundation.org>,
	Mel Gorman <mel@....ul.ie>, Minchan Kim <minchan@...nel.org>,
	Bartlomiej Zolnierkiewicz <b.zolnierkie@...sung.com>
Subject: Re: [PATCH] mm: cma: WARN if freed memory is still in use

On Mon, Nov 12 2012, Marek Szyprowski wrote:
> Memory return to free_contig_range() must have no other references. Let
> kernel to complain loudly if page reference count is not equal to 1.

> diff --git a/mm/page_alloc.c b/mm/page_alloc.c
> index 022e4ed..290c2eb 100644
> --- a/mm/page_alloc.c
> +++ b/mm/page_alloc.c
> @@ -5888,8 +5888,13 @@ done:
>  
>  void free_contig_range(unsigned long pfn, unsigned nr_pages)
>  {
> -	for (; nr_pages--; ++pfn)
> -		__free_page(pfn_to_page(pfn));
> +	struct page *page = pfn_to_page(pfn);
> +	int refcount = nr_pages;
> +	for (; nr_pages--; page++) {
> +		refcount -= page_count(page) == 1;
> +		__free_page(page);
> +	}
> +	WARN(refcount != 0, "some pages are still in use!\n");

This decrementing logic seem backward to me.  Why not:

	struct page *page = pfn_to_page(pfn);
	unsigned int refcount = 0;
	for (; nr_pages--; page++) {
		refcount += page_count(page) != 1;
		__free_page(page);
	}
	WARN(refcount != 0, "some pages are still in use!\n");

>  }
>  #endif

-- 
Best regards,                                         _     _
.o. | Liege of Serenely Enlightened Majesty of      o' \,=./ `o
..o | Computer Science,  Michał “mina86” Nazarewicz    (o o)
ooo +----<email/xmpp: mpn@...gle.com>--------------ooO--(_)--Ooo--

Content of type "application/pgp-signature" skipped