linux-kernel - Re: [PATCH v2] vmalloc: show more detail info in vmallocinfo for clarify

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <20170605151750.46cc4fdb10c4228dee49ac5c@linux-foundation.org>
Date:   Mon, 5 Jun 2017 15:17:50 -0700
From:   Andrew Morton <akpm@...ux-foundation.org>
To:     Yisheng Xie <xieyisheng1@...wei.com>
Cc:     <mhocko@...e.com>, <zijun_hu@....com>, <mingo@...nel.org>,
        <thgarnie@...gle.com>, <kirill.shutemov@...ux.intel.com>,
        <aryabinin@...tuozzo.com>, <chris@...is-wilson.co.uk>,
        <tim.c.chen@...ux.intel.com>, <linux-mm@...ck.org>,
        <linux-kernel@...r.kernel.org>, <guohanjun@...wei.com>
Subject: Re: [PATCH v2] vmalloc: show more detail info in vmallocinfo for
 clarify

On Mon, 5 Jun 2017 16:01:22 +0800 Yisheng Xie <xieyisheng1@...wei.com> wrote:

> When ioremap a 67112960 bytes vm_area with the vmallocinfo:
>  [..]
>  0xec79b000-0xec7fa000  389120 ftl_add_mtd+0x4d0/0x754 pages=94 vmalloc
>  0xec800000-0xecbe1000 4067328 kbox_proc_mem_write+0x104/0x1c4 phys=8b520000 ioremap
> 
> we get the result:
>  0xf1000000-0xf5001000 67112960 devm_ioremap+0x38/0x7c phys=40000000 ioremap
> 
> For the align for ioremap must be less than '1 << IOREMAP_MAX_ORDER':
> 	if (flags & VM_IOREMAP)
> 		align = 1ul << clamp_t(int, get_count_order_long(size),
> 			PAGE_SHIFT, IOREMAP_MAX_ORDER);
> 
> So it makes idiot like me a litter puzzle why jump the vm_area from
> 0xec800000-0xecbe1000 to 0xf1000000-0xf5001000, and leave
> 0xed000000-0xf1000000 as a big hole.
> 
> This is to show all of vm_area, including which is freeing but still in
> vmap_area_list, to make it more clear about why we will get
> 0xf1000000-0xf5001000 int the above case. And we will get the
> vmallocinfo like:
>  [..]
>  0xec79b000-0xec7fa000  389120 ftl_add_mtd+0x4d0/0x754 pages=94 vmalloc
>  0xec800000-0xecbe1000 4067328 kbox_proc_mem_write+0x104/0x1c4 phys=8b520000 ioremap
>  [..]
>  0xece7c000-0xece7e000    8192 unpurged vm_area
>  0xece7e000-0xece83000   20480 vm_map_ram
>  0xf0099000-0xf00aa000   69632 vm_map_ram
> after apply this patch.
> 
> --- a/mm/vmalloc.c
> +++ b/mm/vmalloc.c
> @@ -314,6 +314,7 @@ unsigned long vmalloc_to_pfn(const void *vmalloc_addr)
>  
>  /*** Global kva allocator ***/
>  
> +#define VM_LAZY_FREE	0x02
>  #define VM_VM_AREA	0x04
>  
>  static DEFINE_SPINLOCK(vmap_area_lock);
> @@ -1486,6 +1487,7 @@ struct vm_struct *remove_vm_area(const void *addr)
>  		spin_lock(&vmap_area_lock);
>  		va->vm = NULL;
>  		va->flags &= ~VM_VM_AREA;
> +		va->flags |= VM_LAZY_FREE;
>  		spin_unlock(&vmap_area_lock);
>  
>  		vmap_debug_free_range(va->va_start, va->va_end);
> @@ -2698,8 +2700,14 @@ static int s_show(struct seq_file *m, void *p)
>  	 * s_show can encounter race with remove_vm_area, !VM_VM_AREA on
>  	 * behalf of vmap area is being tear down or vm_map_ram allocation.
>  	 */
> -	if (!(va->flags & VM_VM_AREA))
> +	if (!(va->flags & VM_VM_AREA)) {
> +		seq_printf(m, "0x%pK-0x%pK %7ld %s\n",
> +			(void *)va->va_start, (void *)va->va_end,
> +			va->va_end - va->va_start,
> +			va->flags & VM_LAZY_FREE ? "unpurged vm_area" : "vm_map_ram");
> +
>  		return 0;
> +	}
>  
>  	v = va->vm;

hm, OK, this is safe against use-after-free races because we hold
vmap_area_lock (also taken in __purge_vmap_area_lazy()).  I wonder if
that comment over remove_vm_area() can be improved.