linux-kernel - Re: [RFC v2 PATCH] mm/percpu.c: fix panic triggered by BUG

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Thu, 13 Oct 2016 19:29:02 -0400
From:   Tejun Heo <tj@...nel.org>
To:     zijun_hu <zijun_hu@...o.com>
Cc:     Andrew Morton <akpm@...ux-foundation.org>, linux-mm@...ck.org,
        linux-kernel@...r.kernel.org, zijun_hu@....com, cl@...ux.com
Subject: Re: [RFC v2 PATCH] mm/percpu.c: fix panic triggered by BUG_ON()
 falsely

On Tue, Oct 11, 2016 at 10:00:28PM +0800, zijun_hu wrote:
> From: zijun_hu <zijun_hu@....com>
> 
> as shown by pcpu_build_alloc_info(), the number of units within a percpu
> group is educed by rounding up the number of CPUs within the group to
> @upa boundary, therefore, the number of CPUs isn't equal to the units's
> if it isn't aligned to @upa normally. however, pcpu_page_first_chunk()
> uses BUG_ON() to assert one number is equal the other roughly, so a panic
> is maybe triggered by the BUG_ON() falsely.
> 
> in order to fix this issue, the number of CPUs is rounded up then compared
> with units's, the BUG_ON() is replaced by warning and returning error code
> as well to keep system alive as much as possible.

I really can't decode what the actual issue is here.  Can you please
give an example of a concrete case?

> @@ -2113,21 +2120,22 @@ int __init pcpu_page_first_chunk(size_t reserved_size,
>  
>  	/* allocate pages */
>  	j = 0;
> -	for (unit = 0; unit < num_possible_cpus(); unit++)
> +	for (unit = 0; unit < num_possible_cpus(); unit++) {
> +		unsigned int cpu = ai->groups[0].cpu_map[unit];
>  		for (i = 0; i < unit_pages; i++) {
> -			unsigned int cpu = ai->groups[0].cpu_map[unit];
>  			void *ptr;
>  
>  			ptr = alloc_fn(cpu, PAGE_SIZE, PAGE_SIZE);
>  			if (!ptr) {
>  				pr_warn("failed to allocate %s page for cpu%u\n",
> -					psize_str, cpu);
> +						psize_str, cpu);

And stop making gratuitous changes?

Thanks.

-- 
tejun