linux-kernel - Re: [PATCH] mm/vmalloc: a slight change of compare target in __insert_vmap

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Wed, 24 May 2017 23:07:30 +0800
From:   Wei Yang <richard.weiyang@...il.com>
To:     Michal Hocko <mhocko@...nel.org>
Cc:     Wei Yang <richard.weiyang@...il.com>, akpm@...ux-foundation.org,
        linux-mm@...ck.org, linux-kernel@...r.kernel.org
Subject: Re: [PATCH] mm/vmalloc: a slight change of compare target in
 __insert_vmap_area()

On Wed, May 24, 2017 at 02:11:35PM +0200, Michal Hocko wrote:
>On Wed 24-05-17 18:03:47, Wei Yang wrote:
>> The vmap RB tree store the elements in order and no overlap between any of
>> them. The comparison in __insert_vmap_area() is to decide which direction
>> the search should follow and make sure the new vmap_area is not overlap
>> with any other.
>> 
>> Current implementation fails to do the overlap check.
>> 
>> When first "if" is not true, it means
>> 
>>     va->va_start >= tmp_va->va_end
>> 
>> And with the truth
>> 
>>     xxx->va_end > xxx->va_start
>> 
>> The deduction is
>> 
>>     va->va_end > tmp_va->va_start
>> 
>> which is the condition in second "if".
>> 
>> This patch changes a little of the comparison in __insert_vmap_area() to
>> make sure it forbids the overlapped vmap_area.
>
>Why do we care about overlapping vmap areas at this level. This is an
>internal function and all the sanity checks should have been done by
>that time AFAIR. Could you describe the problem which you are trying to
>fix/address?
>

No problem it tries to fix.

I just follow the original idea, which tries to catch the exception case by
the BUG(). While in the above analysis, the BUG() will never be triggered.

So we have two options:
1. Still tries to catch the exception by change the "if" a little.
2. If we don't care about the overlap case, the "if" clause could be
   simplified.  Only "if ... else ..." is enough.

You prefer the second one?

>> Signed-off-by: Wei Yang <richard.weiyang@...il.com>
>> ---
>>  mm/vmalloc.c | 4 ++--
>>  1 file changed, 2 insertions(+), 2 deletions(-)
>> 
>> diff --git a/mm/vmalloc.c b/mm/vmalloc.c
>> index 0b057628a7ba..8087451cb332 100644
>> --- a/mm/vmalloc.c
>> +++ b/mm/vmalloc.c
>> @@ -360,9 +360,9 @@ static void __insert_vmap_area(struct vmap_area *va)
>>  
>>  		parent = *p;
>>  		tmp_va = rb_entry(parent, struct vmap_area, rb_node);
>> -		if (va->va_start < tmp_va->va_end)
>> +		if (va->va_end <= tmp_va->va_start)
>>  			p = &(*p)->rb_left;
>> -		else if (va->va_end > tmp_va->va_start)
>> +		else if (va->va_start >= tmp_va->va_end)
>>  			p = &(*p)->rb_right;
>>  		else
>>  			BUG();
>> -- 
>> 2.11.0
>> 
>> --
>> To unsubscribe, send a message with 'unsubscribe linux-mm' in
>> the body to majordomo@...ck.org.  For more info on Linux MM,
>> see: http://www.linux-mm.org/ .
>> Don't email: <a href=mailto:"dont@...ck.org"> email@...ck.org </a>
>
>-- 
>Michal Hocko
>SUSE Labs

-- 
Wei Yang
Help you, Help me

Download attachment "signature.asc" of type "application/pgp-signature" (820 bytes)