linux-kernel - Re: [PATCH 1/5] mm: Trigger bug on if a section is not found in __section

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Mon, 17 Jun 2019 09:46:54 +0300
From:   Mike Rapoport <rppt@...ux.ibm.com>
To:     "Alastair D'Silva" <alastair@....ibm.com>
Cc:     alastair@...ilva.org, Andrew Morton <akpm@...ux-foundation.org>,
        David Hildenbrand <david@...hat.com>,
        Oscar Salvador <osalvador@...e.com>,
        Michal Hocko <mhocko@...e.com>,
        Pavel Tatashin <pasha.tatashin@...een.com>,
        Wei Yang <richard.weiyang@...il.com>, Qian Cai <cai@....pw>,
        Thomas Gleixner <tglx@...utronix.de>,
        Ingo Molnar <mingo@...nel.org>,
        Josh Poimboeuf <jpoimboe@...hat.com>,
        Peter Zijlstra <peterz@...radead.org>,
        Konrad Rzeszutek Wilk <konrad.wilk@...cle.com>,
        Jiri Kosina <jkosina@...e.cz>,
        Mukesh Ojha <mojha@...eaurora.org>,
        Arun KS <arunks@...eaurora.org>,
        Mike Rapoport <rppt@...ux.vnet.ibm.com>,
        Baoquan He <bhe@...hat.com>,
        Logan Gunthorpe <logang@...tatee.com>, linux-mm@...ck.org,
        linux-kernel@...r.kernel.org
Subject: Re: [PATCH 1/5] mm: Trigger bug on if a section is not found in
 __section_nr

On Mon, Jun 17, 2019 at 02:36:27PM +1000, Alastair D'Silva wrote:
> From: Alastair D'Silva <alastair@...ilva.org>
> 
> If a memory section comes in where the physical address is greater than
> that which is managed by the kernel, this function would not trigger the
> bug and instead return a bogus section number.
> 
> This patch tracks whether the section was actually found, and triggers the
> bug if not.
> 
> Signed-off-by: Alastair D'Silva <alastair@...ilva.org>
> ---
>  mm/sparse.c | 13 ++++++++-----
>  1 file changed, 8 insertions(+), 5 deletions(-)
> 
> diff --git a/mm/sparse.c b/mm/sparse.c
> index fd13166949b5..104a79fedd00 100644
> --- a/mm/sparse.c
> +++ b/mm/sparse.c
> @@ -105,20 +105,23 @@ static inline int sparse_index_init(unsigned long section_nr, int nid)
>  int __section_nr(struct mem_section* ms)
>  {
>  	unsigned long root_nr;
> -	struct mem_section *root = NULL;
> +	struct mem_section *found = NULL;
> +	struct mem_section *root;
> 
>  	for (root_nr = 0; root_nr < NR_SECTION_ROOTS; root_nr++) {
>  		root = __nr_to_section(root_nr * SECTIONS_PER_ROOT);
>  		if (!root)
>  			continue;
> 
> -		if ((ms >= root) && (ms < (root + SECTIONS_PER_ROOT)))
> -		     break;
> +		if ((ms >= root) && (ms < (root + SECTIONS_PER_ROOT))) {
> +			found = root;
> +			break;
> +		}
>  	}
> 
> -	VM_BUG_ON(!root);
> +	VM_BUG_ON(!found);

Isn't it enough to check for root_nr == NR_SECTION_ROOTS?

> 
> -	return (root_nr * SECTIONS_PER_ROOT) + (ms - root);
> +	return (root_nr * SECTIONS_PER_ROOT) + (ms - found);

It'll still return a bogus section number with CONFIG_DEBUG_VM=n

>  }
>  #else
>  int __section_nr(struct mem_section* ms)
> -- 
> 2.21.0
> 

-- 
Sincerely yours,
Mike.