linux-kernel - Re: [PATCH] mm/slub: fix endianness bug for alloc/free

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Mon, 29 Nov 2021 15:26:13 +0100
From:   Vlastimil Babka <vbabka@...e.cz>
To:     Gerald Schaefer <gerald.schaefer@...ux.ibm.com>
Cc:     linux-mm <linux-mm@...ck.org>, LKML <linux-kernel@...r.kernel.org>,
        linux-s390 <linux-s390@...r.kernel.org>,
        Faiyaz Mohammed <faiyazm@...eaurora.org>,
        Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
        Andrew Morton <akpm@...ux-foundation.org>
Subject: Re: [PATCH] mm/slub: fix endianness bug for alloc/free_traces
 attributes

On 11/26/21 18:18, Gerald Schaefer wrote:
> On big-endian s390, the alloc/free_traces attributes produce endless
> output, because of always 0 idx in slab_debugfs_show().
> 
> idx is de-referenced from *v, which points to a loff_t value, with
> 
> unsigned int idx = *(unsigned int *)v;
> 
> This will only give the upper 32 bits on big-endian, which remain 0.
> 
> Instead of only fixing this de-reference, during discussion it seemed
> more appropriate to change the seq_ops so that they use an explicit
> iterator in private loc_track struct.
> 
> This patch adds idx to loc_track, which will also fix the endianness bug.
> 
> Link: https://lore.kernel.org/r/20211117193932.4049412-1-gerald.schaefer@linux.ibm.com
> Fixes: 64dd68497be7 ("mm: slub: move sysfs slab alloc/free interfaces to debugfs")
> Cc: <stable@...r.kernel.org> # v5.14+
> Reported-by: Steffen Maier <maier@...ux.ibm.com>
> Signed-off-by: Gerald Schaefer <gerald.schaefer@...ux.ibm.com>

Acked-by: Vlastimil Babka <vbabka@...e.cz>

With a nit below:

> ---
>  mm/slub.c | 15 +++++++++------
>  1 file changed, 9 insertions(+), 6 deletions(-)
> 
> diff --git a/mm/slub.c b/mm/slub.c
> index a8626825a829..abe7db581d68 100644
> --- a/mm/slub.c
> +++ b/mm/slub.c
> @@ -5081,6 +5081,7 @@ struct loc_track {
>  	unsigned long max;
>  	unsigned long count;
>  	struct location *loc;
> +	loff_t idx;
>  };
>  
>  static struct dentry *slab_debugfs_root;
> @@ -6052,11 +6053,11 @@ __initcall(slab_sysfs_init);
>  #if defined(CONFIG_SLUB_DEBUG) && defined(CONFIG_DEBUG_FS)
>  static int slab_debugfs_show(struct seq_file *seq, void *v)
>  {
> -
> -	struct location *l;
> -	unsigned int idx = *(unsigned int *)v;
>  	struct loc_track *t = seq->private;
> +	struct location *l;
> +	unsigned long idx;
>  
> +	idx = (unsigned long) t->idx;
>  	if (idx < t->count) {
>  		l = &t->loc[idx];
>  
> @@ -6105,16 +6106,18 @@ static void *slab_debugfs_next(struct seq_file *seq, void *v, loff_t *ppos)
>  {
>  	struct loc_track *t = seq->private;
>  
> -	v = ppos;
> -	++*ppos;
> +	t->idx = ++(*ppos);
>  	if (*ppos <= t->count)
> -		return v;
> +		return ppos;

What I had in mind, and to be more in line with the seq_file example, would
be to return &t->idx here. Then it's what gets passed to slab_debugfs_show()
as 'v'. But since we ignore 'v' there, it probably doesn't matter.

>  
>  	return NULL;
>  }
>  
>  static void *slab_debugfs_start(struct seq_file *seq, loff_t *ppos)
>  {
> +	struct loc_track *t = seq->private;
> +
> +	t->idx = *ppos;
>  	return ppos;

And same here.

>  }
>  
>