linux-kernel - [PATCH 0/1] mm/cma: fix alloc_contig

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-Id: <20171120193930.23428-1-mike.kravetz@oracle.com>
Date:   Mon, 20 Nov 2017 11:39:29 -0800
From:   Mike Kravetz <mike.kravetz@...cle.com>
To:     linux-mm@...ck.org, linux-kernel@...r.kernel.org
Cc:     Joonsoo Kim <iamjoonsoo.kim@....com>,
        Vlastimil Babka <vbabka@...e.cz>,
        Michal Nazarewicz <mina86@...a86.com>,
        Michal Hocko <mhocko@...e.com>,
        Mel Gorman <mgorman@...hsingularity.net>,
        Johannes Weiner <hannes@...xchg.org>,
        Andrew Morton <akpm@...ux-foundation.org>,
        Mike Kravetz <mike.kravetz@...cle.com>
Subject: [PATCH 0/1] mm/cma: fix alloc_contig_range ret code/potential leak

In an attempt to make contiguous allocation routines more available to
drivers, I have been experimenting with code similar to that used by
alloc_gigantic_page().  While stressing this code with many other
allocations and frees in progress, I would sometimes notice large 'leaks'
of page ranges.

I traced this down to the routine alloc_contig_range() itself.  In commit
8ef5849fa8a2 the code was changed so that an -EBUSY returned by
__alloc_contig_migrate_range() would not immediately return to the caller.
Rather, processing continues so that test_pages_isolated() is eventually
called.  This is done because test_pages_isolated() has a tracepoint to
identify the busy pages.

However, it is possible (observed in my testing) that pages which were
busy when __alloc_contig_migrate_range was called may become available
by the time test_pages_isolated is called.  Further, it is possible that
the entire range can actually be allocated.  Unfortunately, in this case
the return code originally set by __alloc_contig_migrate_range (-EBUSY)
is returned to the calller.  Therefore, the caller assumes the range was
not allocated and the pages are essentially leaked.

The following patch simply updates the return code based on the value
returned from test_pages_isolated.

It is unlikely that we will hit this issue today based on the limited
number of callers to alloc_contig_range.  However, I have Cc'ed stable
because if we do hit this issue it has the potential to leak a large
number of pages.

Mike Kravetz (1):
  mm/cma: fix alloc_contig_range ret code/potential leak

 mm/page_alloc.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

-- 
2.13.6