linux-kernel - Re: [RFC PATCH 1/1] mm/percpu.c: fix memory leakage issue when allocate a odd alignment area

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20161013233139.GE32534@mtj.duckdns.org>
Date:   Thu, 13 Oct 2016 19:31:39 -0400
From:   Tejun Heo <tj@...nel.org>
To:     zijun_hu <zijun_hu@...o.com>
Cc:     akpm@...ux-foundation.org, zijun_hu@....com, linux-mm@...ck.org,
        linux-kernel@...r.kernel.org, cl@...ux.com
Subject: Re: [RFC PATCH 1/1] mm/percpu.c: fix memory leakage issue when
 allocate a odd alignment area

On Tue, Oct 11, 2016 at 09:24:50PM +0800, zijun_hu wrote:
> From: zijun_hu <zijun_hu@....com>
> 
> the LSB of a chunk->map element is used for free/in-use flag of a area
> and the other bits for offset, the sufficient and necessary condition of
> this usage is that both size and alignment of a area must be even numbers
> however, pcpu_alloc() doesn't force its @align parameter a even number
> explicitly, so a odd @align maybe causes a series of errors, see below
> example for concrete descriptions.
> 
> lets assume area [16, 36) is free but its previous one is in-use, we want
> to allocate a @size == 8 and @align == 7 area. the larger area [16, 36) is
> split to three areas [16, 21), [21, 29), [29, 36) eventually. however, due
> to the usage for a chunk->map element, the actual offset of the aim area
> [21, 29) is 21 but is recorded in relevant element as 20; moreover the
> residual tail free area [29, 36) is mistook as in-use and is lost silently
> 
> as explained above, inaccurate either offset or free/in-use state of
> a area is recorded into relevant chunk->map element if request a odd
> alignment area, and so causes memory leakage issue
> 
> fix it by forcing the @align of a area to allocate a even number
> as do for @size.
> 
> BTW, macro ALIGN() within pcpu_fit_in_area() is replaced by roundup() too
> due to back reason. in order to align a value @v up to @a boundary, macro
> roundup(v, a) is more generic than ALIGN(x, a); the latter doesn't work
> well when @a isn't a power of 2 value. for example, roundup(10, 6) == 12
> but ALIGN(10, 6) == 10, the former result is desired obviously
> 
> Signed-off-by: zijun_hu <zijun_hu@....com>

Nacked-by: Tejun Heo <tj@...nel.org>

This is a fix for an imaginary problem.  The most we should do about
odd alignment is triggering a WARN_ON.

Thanks.

-- 
tejun