linux-kernel - Re: [PATCH] mm: vmalloc: don't remove inexistent guard hole in remove_vm

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <5644BE3E.7010708@redhat.com>
Date:	Thu, 12 Nov 2015 17:28:46 +0100
From:	Jerome Marchand <jmarchan@...hat.com>
To:	Andrey Ryabinin <ryabinin.a.a@...il.com>
Cc:	"linux-mm@...ck.org" <linux-mm@...ck.org>,
	LKML <linux-kernel@...r.kernel.org>,
	Andrew Morton <akpm@...ux-foundation.org>,
	linux-sh@...r.kernel.org
Subject: Re: [PATCH] mm: vmalloc: don't remove inexistent guard hole in
 remove_vm_area()

On 11/12/2015 04:55 PM, Andrey Ryabinin wrote:
> 2015-11-12 18:17 GMT+03:00 Jerome Marchand <jmarchan@...hat.com>:
>> Commit 71394fe50146 ("mm: vmalloc: add flag preventing guard hole
>> allocation") missed a spot. Currently remove_vm_area() decreases
>> vm->size to remove the guard hole page, even when it isn't present.
>> This patch only decreases vm->size when VM_NO_GUARD isn't set.
>>
>> Signed-off-by: Jerome Marchand <jmarchan@...hat.com>
>> ---
>>  mm/vmalloc.c | 3 ++-
>>  1 file changed, 2 insertions(+), 1 deletion(-)
>>
>> diff --git a/mm/vmalloc.c b/mm/vmalloc.c
>> index d045634..1388c3d 100644
>> --- a/mm/vmalloc.c
>> +++ b/mm/vmalloc.c
>> @@ -1443,7 +1443,8 @@ struct vm_struct *remove_vm_area(const void *addr)
>>                 vmap_debug_free_range(va->va_start, va->va_end);
>>                 kasan_free_shadow(vm);
>>                 free_unmap_vmap_area(va);
>> -               vm->size -= PAGE_SIZE;
>> +               if (!(vm->flags & VM_NO_GUARD))
>> +                       vm->size -= PAGE_SIZE;
>>
> 
> I'd fix this in another way. I think that remove_vm_area() shouldn't
> change vm's size, IMO it doesn't make sense.
> The only caller who cares about vm's size after removing is __vunmap():
>          area = remove_vm_area(addr);
>          ....
>          debug_check_no_locks_freed(addr, area->size);
>          debug_check_no_obj_freed(addr, area->size);
> 
> We already have proper get_vm_area_size() helper which takes
> VM_NO_GUARD into account.
> So I think we should use that helper for debug_check_no_*() and just
> remove 'vm->size -= PAGE_SIZE;' line
> from remove_vm_area()

Sure, that would be cleaner.

Btw, there might be a leak in sq_unmap() (arch/sh/kernel/cpu/sh4/sq.c)
as the vm_struct doesn't seem to be freed. CCed the SuperH folks.

Thanks,
Jerome

> 
> 
> 
>>                 return vm;
>>         }
>> --
>> 2.4.3
>>



Download attachment "signature.asc" of type "application/pgp-signature" (474 bytes)