linux-kernel - [PATCH v2] zsmalloc: fix obj_to_head use page

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <1444193152-17473-1-git-send-email-zhuhui@xiaomi.com>
Date:	Wed, 7 Oct 2015 12:45:52 +0800
From:	Hui Zhu <zhuhui@...omi.com>
To:	<minchan@...nel.org>, <ngupta@...are.org>, <linux-mm@...ck.org>,
	<linux-kernel@...r.kernel.org>
CC:	<teawater@...il.com>, <akpm@...ux-foundation.org>,
	<sergey.senozhatsky@...il.com>, Hui Zhu <zhuhui@...omi.com>
Subject: [PATCH v2] zsmalloc: fix obj_to_head use page_private(page) as value but not pointer

In function obj_malloc:
	if (!class->huge)
		/* record handle in the header of allocated chunk */
		link->handle = handle;
	else
		/* record handle in first_page->private */
		set_page_private(first_page, handle);
The huge's page save handle to private directly.

But in obj_to_head:
	if (class->huge) {
		VM_BUG_ON(!is_first_page(page));
		return *(unsigned long *)page_private(page);
	} else
		return *(unsigned long *)obj;
It is used as a pointer.

The reason why there is no problem until now is huge-class page is
born with ZS_FULL so it couldn't be migrated.
Therefore, it shouldn't be real bug in practice.
However, we need this patch for future-work "VM-aware zsmalloced
page migration" to reduce external fragmentation.

Signed-off-by: Hui Zhu <zhuhui@...omi.com>
Acked-by: Minchan Kim <minchan@...nel.org>
---
 mm/zsmalloc.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/mm/zsmalloc.c b/mm/zsmalloc.c
index f135b1b..e881d4f 100644
--- a/mm/zsmalloc.c
+++ b/mm/zsmalloc.c
@@ -824,7 +824,7 @@ static unsigned long obj_to_head(struct size_class *class, struct page *page,
 {
 	if (class->huge) {
 		VM_BUG_ON(!is_first_page(page));
-		return *(unsigned long *)page_private(page);
+		return page_private(page);
 	} else
 		return *(unsigned long *)obj;
 }
-- 
1.9.1

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/