linux-kernel - Re: [PATCH V2 2/2] mm/memblock.c: check return value of memblock_reserve() in memblock_virt_alloc

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20161221131332.GB23096@vultr.guest>
Date:   Wed, 21 Dec 2016 13:13:32 +0000
From:   Wei Yang <richard.weiyang@...il.com>
To:     Michal Hocko <mhocko@...nel.org>
Cc:     Wei Yang <richard.weiyang@...il.com>, trivial@...nel.org,
        akpm@...ux-foundation.org, linux-mm@...ck.org,
        linux-kernel@...r.kernel.org
Subject: Re: [PATCH V2 2/2] mm/memblock.c: check return value of
 memblock_reserve() in memblock_virt_alloc_internal()

On Wed, Dec 21, 2016 at 08:51:16AM +0100, Michal Hocko wrote:
>On Tue 20-12-16 16:48:23, Wei Yang wrote:
>> On Mon, Dec 19, 2016 at 04:21:57PM +0100, Michal Hocko wrote:
>> >On Sun 18-12-16 14:47:50, Wei Yang wrote:
>> >> memblock_reserve() may fail in case there is not enough regions.
>> >
>> >Have you seen this happenning in the real setups or this is a by-review
>> >driven change?
>> 
>> This is a by-review driven change.
>> 
>> >[...]
>> >>  again:
>> >>  	alloc = memblock_find_in_range_node(size, align, min_addr, max_addr,
>> >>  					    nid, flags);
>> >> -	if (alloc)
>> >> +	if (alloc && !memblock_reserve(alloc, size))
>> >>  		goto done;
>
>So how exactly does the reserve fail when memblock_find_in_range_node
>found a suitable range for the given size?
>

Even memblock_find_in_range_node() gets a suitable range, memblock_reserve()
still could fail. And the case just happens when memblock can't resize.
memblock_reserve() reserve a range by adding a range to memblock.reserved. In
case the memblock.reserved is full and can't resize, this fails.

Not sure whether I get it clarified.

>> >>  
>> >>  	if (nid != NUMA_NO_NODE) {
>> >>  		alloc = memblock_find_in_range_node(size, align, min_addr,
>> >>  						    max_addr, NUMA_NO_NODE,
>> >>  						    flags);
>> >> -		if (alloc)
>> >> +		if (alloc && !memblock_reserve(alloc, size))
>> >>  			goto done;
>> >>  	}
>> >
>> >This doesn't look right. You can end up leaking the first allocated
>> >range.
>> >
>> 
>> Hmm... why?
>> 
>> If first memblock_reserve() succeed, it will jump to done, so that no 2nd
>> allocation.
>> If the second executes, it means the first allocation failed.
>> memblock_find_in_range_node() doesn't modify the memblock, it just tell you
>> there is a proper memory region available.
>
>yes, my bad. I have missed this. Sorry about the confusion

So do you agree with my patch now?

>-- 
>Michal Hocko
>SUSE Labs

-- 
Wei Yang
Help you, Help me