linux-kernel - Re: [PATCH V2 2/2] mm/memblock.c: check return value of memblock_reserve() in memblock_virt_alloc

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20161221075115.GE16502@dhcp22.suse.cz>
Date:   Wed, 21 Dec 2016 08:51:16 +0100
From:   Michal Hocko <mhocko@...nel.org>
To:     Wei Yang <richard.weiyang@...il.com>
Cc:     trivial@...nel.org, akpm@...ux-foundation.org, linux-mm@...ck.org,
        linux-kernel@...r.kernel.org
Subject: Re: [PATCH V2 2/2] mm/memblock.c: check return value of
 memblock_reserve() in memblock_virt_alloc_internal()

On Tue 20-12-16 16:48:23, Wei Yang wrote:
> On Mon, Dec 19, 2016 at 04:21:57PM +0100, Michal Hocko wrote:
> >On Sun 18-12-16 14:47:50, Wei Yang wrote:
> >> memblock_reserve() may fail in case there is not enough regions.
> >
> >Have you seen this happenning in the real setups or this is a by-review
> >driven change?
> 
> This is a by-review driven change.
> 
> >[...]
> >>  again:
> >>  	alloc = memblock_find_in_range_node(size, align, min_addr, max_addr,
> >>  					    nid, flags);
> >> -	if (alloc)
> >> +	if (alloc && !memblock_reserve(alloc, size))
> >>  		goto done;

So how exactly does the reserve fail when memblock_find_in_range_node
found a suitable range for the given size?

> >>  
> >>  	if (nid != NUMA_NO_NODE) {
> >>  		alloc = memblock_find_in_range_node(size, align, min_addr,
> >>  						    max_addr, NUMA_NO_NODE,
> >>  						    flags);
> >> -		if (alloc)
> >> +		if (alloc && !memblock_reserve(alloc, size))
> >>  			goto done;
> >>  	}
> >
> >This doesn't look right. You can end up leaking the first allocated
> >range.
> >
> 
> Hmm... why?
> 
> If first memblock_reserve() succeed, it will jump to done, so that no 2nd
> allocation.
> If the second executes, it means the first allocation failed.
> memblock_find_in_range_node() doesn't modify the memblock, it just tell you
> there is a proper memory region available.

yes, my bad. I have missed this. Sorry about the confusion.

-- 
Michal Hocko
SUSE Labs