| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Date: Thu, 15 Oct 2020 11:28:55 +0200
From: David Hildenbrand <david@...hat.com>
To: Dan Williams <dan.j.williams@...el.com>,
linux-kernel@...r.kernel.org
Cc: Vishal Verma <vishal.l.verma@...el.com>,
Dave Hansen <dave.hansen@...ux.intel.com>,
Pavel Tatashin <pasha.tatashin@...een.com>,
Brice Goglin <Brice.Goglin@...ia.fr>,
Dave Jiang <dave.jiang@...el.com>,
Ira Weiny <ira.weiny@...el.com>, Jia He <justin.he@....com>,
Joao Martins <joao.m.martins@...cle.com>,
Jonathan Cameron <Jonathan.Cameron@...wei.com>,
akpm@...ux-foundation.org, linux-nvdimm@...ts.01.org,
linux-mm@...ck.org
Subject: Re: [PATCH 1/2] device-dax/kmem: Fix resource release
On 15.10.20 02:42, Dan Williams wrote:
> The conversion to request_mem_region() is broken because it assumes that
> the range is marked busy prior to release. However, due to the way that
> the kmem driver manipulates the IORESOURCE_BUSY flag (clears it to
> let {add,remove}_memory() handle busy) it requires a manual
> release_resource() to perform cleanup.
>
> Given that the actual 'struct resource *' needs to be recalled, not just
> the range, add that tracking to the kmem driver-data.
>
> Reported-by: David Hildenbrand <david@...hat.com>
> Fixes: 0513bd5bb114 ("device-dax/kmem: replace release_resource() with release_mem_region()")
> Cc: Vishal Verma <vishal.l.verma@...el.com>
> Cc: Dave Hansen <dave.hansen@...ux.intel.com>
> Cc: Pavel Tatashin <pasha.tatashin@...een.com>
> Cc: Brice Goglin <Brice.Goglin@...ia.fr>
> Cc: Dave Jiang <dave.jiang@...el.com>
> Cc: Ira Weiny <ira.weiny@...el.com>
> Cc: Jia He <justin.he@....com>
> Cc: Joao Martins <joao.m.martins@...cle.com>
> Cc: Jonathan Cameron <Jonathan.Cameron@...wei.com>
> Signed-off-by: Dan Williams <dan.j.williams@...el.com>
> ---
> drivers/dax/kmem.c | 48 ++++++++++++++++++++++++++++++++++--------------
> 1 file changed, 34 insertions(+), 14 deletions(-)
>
> diff --git a/drivers/dax/kmem.c b/drivers/dax/kmem.c
> index 6c933f2b604e..af04b6d1d263 100644
> --- a/drivers/dax/kmem.c
> +++ b/drivers/dax/kmem.c
> @@ -35,11 +35,17 @@ static int dax_kmem_range(struct dev_dax *dev_dax, int i, struct range *r)
> return 0;
> }
>
> +struct dax_kmem_data {
> + const char *res_name;
> + struct resource *res[];
> +};
> +
> static int dev_dax_kmem_probe(struct dev_dax *dev_dax)
> {
> struct device *dev = &dev_dax->dev;
> + struct dax_kmem_data *data;
> + int rc = -ENOMEM;
> int i, mapped = 0;
> - char *res_name;
> int numa_node;
>
> /*
> @@ -55,14 +61,17 @@ static int dev_dax_kmem_probe(struct dev_dax *dev_dax)
> return -EINVAL;
> }
>
> - res_name = kstrdup(dev_name(dev), GFP_KERNEL);
> - if (!res_name)
> + data = kzalloc(sizeof(*data) + sizeof(struct resource *) * dev_dax->nr_range, GFP_KERNEL);
> + if (!data)
> return -ENOMEM;
>
> + data->res_name = kstrdup(dev_name(dev), GFP_KERNEL);
> + if (!data->res_name)
> + goto err_res_name;
> +
> for (i = 0; i < dev_dax->nr_range; i++) {
> struct resource *res;
> struct range range;
> - int rc;
>
> rc = dax_kmem_range(dev_dax, i, &range);
> if (rc) {
> @@ -72,7 +81,7 @@ static int dev_dax_kmem_probe(struct dev_dax *dev_dax)
> }
>
> /* Region is permanently reserved if hotremove fails. */
> - res = request_mem_region(range.start, range_len(&range), res_name);
> + res = request_mem_region(range.start, range_len(&range), data->res_name);
> if (!res) {
> dev_warn(dev, "mapping%d: %#llx-%#llx could not reserve region\n",
> i, range.start, range.end);
> @@ -82,9 +91,10 @@ static int dev_dax_kmem_probe(struct dev_dax *dev_dax)
> */
> if (mapped)
> continue;
> - kfree(res_name);
> - return -EBUSY;
> + rc = -EBUSY;
> + goto err_request_mem;
> }
> + data->res[i] = res;
>
> /*
> * Set flags appropriate for System RAM. Leave ..._BUSY clear
> @@ -104,18 +114,25 @@ static int dev_dax_kmem_probe(struct dev_dax *dev_dax)
> if (rc) {
> dev_warn(dev, "mapping%d: %#llx-%#llx memory add failed\n",
> i, range.start, range.end);
> - release_mem_region(range.start, range_len(&range));
> + release_resource(res);
> + kfree(res);
> + data->res[i] = NULL;
> if (mapped)
> continue;
> - kfree(res_name);
> - return rc;
> + goto err_request_mem;
> }
> mapped++;
> }
>
> - dev_set_drvdata(dev, res_name);
> + dev_set_drvdata(dev, data);
>
> return 0;
> +
> +err_request_mem:
> + kfree(data->res_name);
> +err_res_name:
> + kfree(data);
> + return rc;
> }
>
> #ifdef CONFIG_MEMORY_HOTREMOVE
> @@ -123,7 +140,7 @@ static int dev_dax_kmem_remove(struct dev_dax *dev_dax)
> {
> int i, success = 0;
> struct device *dev = &dev_dax->dev;
> - const char *res_name = dev_get_drvdata(dev);
> + struct dax_kmem_data *data = dev_get_drvdata(dev);
>
> /*
> * We have one shot for removing memory, if some memory blocks were not
> @@ -142,7 +159,9 @@ static int dev_dax_kmem_remove(struct dev_dax *dev_dax)
> rc = remove_memory(dev_dax->target_node, range.start,
> range_len(&range));
> if (rc == 0) {
> - release_mem_region(range.start, range_len(&range));
> + release_resource(data->res[i]);
> + kfree(data->res[i]);
> + data->res[i] = NULL;
> success++;
> continue;
> }
> @@ -153,7 +172,8 @@ static int dev_dax_kmem_remove(struct dev_dax *dev_dax)
> }
>
> if (success >= dev_dax->nr_range) {
> - kfree(res_name);
> + kfree(data->res_name);
> + kfree(data);
> dev_set_drvdata(dev, NULL);
> }
>
>
Looks sane to me
Reviewed-by: David Hildenbrand <david@...hat.com>
--
Thanks,
David / dhildenb
Powered by blists - more mailing lists