linux-kernel - Re: [PATCH] zsmalloc: correct fragile [kmap|kunmap]

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date:	Sun, 16 Nov 2014 19:41:37 +0800
From:	Ganesh Mahendran <opensource.ganesh@...il.com>
To:	Minchan Kim <minchan@...nel.org>
Cc:	Andrew Morton <akpm@...ux-foundation.org>,
	linux-kernel@...r.kernel.org, linux-mm@...ck.org,
	Nitin Gupta <ngupta@...are.org>,
	Sergey Senozhatsky <sergey.senozhatsky@...il.com>,
	Dan Streetman <ddstreet@...e.org>,
	Seth Jennings <sjennings@...iantweb.net>,
	Jerome Marchand <jmarchan@...hat.com>
Subject: Re: [PATCH] zsmalloc: correct fragile [kmap|kunmap]_atomic use

Hello

2014-11-14 9:11 GMT+08:00 Minchan Kim <minchan@...nel.org>:
> The kunmap_atomic should use virtual address getting by kmap_atomic.
> However, some pieces of code in zsmalloc uses modified address,
> not the one got by kmap_atomic for kunmap_atomic.
>
> It's okay for working because zsmalloc modifies the address
> inner PAGE_SIZE bounday so it works with current kmap_atomic's
> implementation. But it's still fragile with potential changing
> of kmap_atomic so let's correct it.
>
> Signed-off-by: Minchan Kim <minchan@...nel.org>
> ---
>  mm/zsmalloc.c | 21 ++++++++++++---------
>  1 file changed, 12 insertions(+), 9 deletions(-)
>
> diff --git a/mm/zsmalloc.c b/mm/zsmalloc.c
> index b3b57ef85830..85e14f584048 100644
> --- a/mm/zsmalloc.c
> +++ b/mm/zsmalloc.c
> @@ -629,6 +629,7 @@ static void init_zspage(struct page *first_page, struct size_class *class)
>                 struct page *next_page;
>                 struct link_free *link;
>                 unsigned int i = 1;
> +               void *vaddr;
>
>                 /*
>                  * page->index stores offset of first object starting
> @@ -639,8 +640,8 @@ static void init_zspage(struct page *first_page, struct size_class *class)
>                 if (page != first_page)
>                         page->index = off;
>
> -               link = (struct link_free *)kmap_atomic(page) +
> -                                               off / sizeof(*link);
> +               vaddr = kmap_atomic(page);
> +               link = (struct link_free *)vaddr + off / sizeof(*link);
Just a nitpick:
I think
                    link = (struct link_free *)(vaddr + off);
is better.
To use the same method as in zs_free()
                   link = (struct link_free *)(vaddr + f_offset);

>
>                 while ((off += class->size) < PAGE_SIZE) {
>                         link->next = obj_location_to_handle(page, i++);
> @@ -654,7 +655,7 @@ static void init_zspage(struct page *first_page, struct size_class *class)
>                  */
>                 next_page = get_next_page(page);
>                 link->next = obj_location_to_handle(next_page, 0);
> -               kunmap_atomic(link);
> +               kunmap_atomic(vaddr);
>                 page = next_page;
>                 off %= PAGE_SIZE;
>         }
> @@ -1055,6 +1056,7 @@ unsigned long zs_malloc(struct zs_pool *pool, size_t size)
>         unsigned long obj;
>         struct link_free *link;
>         struct size_class *class;
> +       void *vaddr;
>
>         struct page *first_page, *m_page;
>         unsigned long m_objidx, m_offset;
> @@ -1083,11 +1085,11 @@ unsigned long zs_malloc(struct zs_pool *pool, size_t size)
>         obj_handle_to_location(obj, &m_page, &m_objidx);
>         m_offset = obj_idx_to_offset(m_page, m_objidx, class->size);
>
> -       link = (struct link_free *)kmap_atomic(m_page) +
> -                                       m_offset / sizeof(*link);
> +       vaddr = kmap_atomic(m_page);
> +       link = (struct link_free *)vaddr + m_offset / sizeof(*link);
            link = (struct link_free *)(vaddr + m_offset)

>         first_page->freelist = link->next;
>         memset(link, POISON_INUSE, sizeof(*link));
> -       kunmap_atomic(link);
> +       kunmap_atomic(vaddr);
>
>         first_page->inuse++;
>         /* Now move the zspage to another fullness group, if required */
> @@ -1103,6 +1105,7 @@ void zs_free(struct zs_pool *pool, unsigned long obj)
>         struct link_free *link;
>         struct page *first_page, *f_page;
>         unsigned long f_objidx, f_offset;
> +       void *vaddr;
>
>         int class_idx;
>         struct size_class *class;
> @@ -1121,10 +1124,10 @@ void zs_free(struct zs_pool *pool, unsigned long obj)
>         spin_lock(&class->lock);
>
>         /* Insert this object in containing zspage's freelist */
> -       link = (struct link_free *)((unsigned char *)kmap_atomic(f_page)
> -                                                       + f_offset);
> +       vaddr = kmap_atomic(f_page);
> +       link = (struct link_free *)(vaddr + f_offset);
Yes, I think this method to calc *link* is better. (:

Thanks

>         link->next = first_page->freelist;
> -       kunmap_atomic(link);
> +       kunmap_atomic(vaddr);
>         first_page->freelist = (void *)obj;
>
>         first_page->inuse--;
> --
> 2.0.0
>
> --
> To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
> the body of a message to majordomo@...r.kernel.org
> More majordomo info at  http://vger.kernel.org/majordomo-info.html
> Please read the FAQ at  http://www.tux.org/lkml/
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/