linux-kernel - Re: [PATCH] mm/memory_hotplug: fix kfree() of bootmem memory

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Tue, 8 Feb 2022 09:59:18 +0800
From:   Miaohe Lin <linmiaohe@...wei.com>
To:     David Hildenbrand <david@...hat.com>
CC:     <isimatu.yasuaki@...fujitsu.com>, <toshi.kani@...com>,
        <linux-mm@...ck.org>, <linux-kernel@...r.kernel.org>,
        Andrew Morton <akpm@...ux-foundation.org>
Subject: Re: [PATCH] mm/memory_hotplug: fix kfree() of bootmem memory

Hi:
On 2022/2/7 22:33, David Hildenbrand wrote:
> On 07.02.22 14:56, Miaohe Lin wrote:
>> We can't use kfree() to release the resource as it might come from bootmem.
>> Use release_mem_region() instead.
> 
> How can this happen? release_mem_region() is called either from
> __add_memory() or from add_memory_driver_managed(), where we allocated
> the region via register_memory_resource(). Both functions shouldn't ever
> be called before the buddy is up an running.
> 
> Do you have a backtrace of an actual instance of this issue? Or was this
> identified as possibly broken by code inspection?
> 

This is identified as possibly broken by code inspection. IIUC, alloc_resource
is always used to allocate the resource. It has the below logic:

  if (bootmem_resource_free) {
	res = bootmem_resource_free;
	bootmem_resource_free = res->sibling;
  }

where bootmem_resource_free is used to reusing the resource entries allocated by boot
mem after the system is up:

/*
 * For memory hotplug, there is no way to free resource entries allocated
 * by boot mem after the system is up. So for reusing the resource entry
 * we need to remember the resource.
 */
static struct resource *bootmem_resource_free;

So I think register_memory_resource() can reuse the resource allocated by bootmem.
Or am I miss anything?

Thanks.