linux-kernel - Re: [PATCH] mm/memory_hotplug: fix wrong casting for __remove

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20170912124952.uraxdt5bgl25zhf7@dhcp22.suse.cz>
Date:   Tue, 12 Sep 2017 14:49:52 +0200
From:   Michal Hocko <mhocko@...nel.org>
To:     YASUAKI ISHIMATSU <yasu.isimatu@...il.com>
Cc:     linux-mm@...ck.org, LKML <linux-kernel@...r.kernel.org>,
        qiuxishi@...wei.com, arbab@...ux.vnet.ibm.com,
        Vlastimil Babka <vbabka@...e.cz>
Subject: Re: [PATCH] mm/memory_hotplug: fix wrong casting for
 __remove_section()

On Fri 08-09-17 16:43:04, YASUAKI ISHIMATSU wrote:
> __remove_section() calls __remove_zone() to shrink zone and pgdat.
> But due to wrong castings, __remvoe_zone() cannot shrink zone
> and pgdat correctly if pfn is over 0xffffffff.
> 
> So the patch fixes the following 3 wrong castings.
> 
>   1. find_smallest_section_pfn() returns 0 or start_pfn which defined
>      as unsigned long. But the function always returns 32bit value
>      since the function is defined as int.
> 
>   2. find_biggest_section_pfn() returns 0 or pfn which defined as
>      unsigned long. the function always returns 32bit value
>      since the function is defined as int.

this is indeed wrong. Pfns over would be really broken 15TB. Not that
unrealistic these days

> 
>   3. __remove_section() calculates start_pfn using section_nr_to_pfn()
>      and scn_nr. section_nr_to_pfn() just shifts scn_nr by
>      PFN_SECTION_SHIFT bit. But since scn_nr is defined as int,
>      section_nr_to_pfn() always return 32 bit value.

Dohh, those nasty macros. This is hidden quite well. It seems other
callers are using unsigned long properly. But I would rather make sure
we won't repeat that error again. Can we instead make section_nr_to_pfn
resp. pfn_to_section_nr static inline and enfore proper types?

I would also split this into two patches. 

Thanks!

> The patch fixes the wrong castings.
> 
> Signed-off-by: Yasuaki Ishimatsu <isimatu.yasuaki@...fujitsu.com>
> ---
>  mm/memory_hotplug.c | 6 +++---
>  1 file changed, 3 insertions(+), 3 deletions(-)
> 
> diff --git a/mm/memory_hotplug.c b/mm/memory_hotplug.c
> index 73bf17d..3514ef2 100644
> --- a/mm/memory_hotplug.c
> +++ b/mm/memory_hotplug.c
> @@ -331,7 +331,7 @@ int __ref __add_pages(int nid, unsigned long phys_start_pfn,
> 
>  #ifdef CONFIG_MEMORY_HOTREMOVE
>  /* find the smallest valid pfn in the range [start_pfn, end_pfn) */
> -static int find_smallest_section_pfn(int nid, struct zone *zone,
> +static unsigned long find_smallest_section_pfn(int nid, struct zone *zone,
>  				     unsigned long start_pfn,
>  				     unsigned long end_pfn)
>  {
> @@ -356,7 +356,7 @@ static int find_smallest_section_pfn(int nid, struct zone *zone,
>  }
> 
>  /* find the biggest valid pfn in the range [start_pfn, end_pfn). */
> -static int find_biggest_section_pfn(int nid, struct zone *zone,
> +static unsigned long find_biggest_section_pfn(int nid, struct zone *zone,
>  				    unsigned long start_pfn,
>  				    unsigned long end_pfn)
>  {
> @@ -544,7 +544,7 @@ static int __remove_section(struct zone *zone, struct mem_section *ms,
>  		return ret;
> 
>  	scn_nr = __section_nr(ms);
> -	start_pfn = section_nr_to_pfn(scn_nr);
> +	start_pfn = section_nr_to_pfn((unsigned long)scn_nr);
>  	__remove_zone(zone, start_pfn);
> 
>  	sparse_remove_one_section(zone, ms, map_offset);
> -- 
> 1.8.3.1
> 

-- 
Michal Hocko
SUSE Labs