linux-kernel - Re: [PATCH] mm/vmalloc: Fix return value check for vb

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <fd71a174-e4cf-425c-a619-0d7c15cd91f7@oppo.com>
Date: Wed, 28 Feb 2024 10:02:02 +0000
From: 刘海龙(LaoLiu) <liuhailong@...o.com>
To: Barry Song <21cnbao@...il.com>
CC: "akpm@...ux-foundation.org" <akpm@...ux-foundation.org>,
	"urezki@...il.com" <urezki@...il.com>, "hch@...radead.org"
	<hch@...radead.org>, "lstoakes@...il.com" <lstoakes@...il.com>,
	"linux-mm@...ck.org" <linux-mm@...ck.org>, "linux-kernel@...r.kernel.org"
	<linux-kernel@...r.kernel.org>
Subject: Re: [PATCH] mm/vmalloc: Fix return value check for vb_alloc

On 2024/2/28 17:34, Barry Song wrote:
> On Wed, Feb 28, 2024 at 9:51 PM 刘海龙(LaoLiu) <liuhailong@...o.com> wrote:
>>
>> If vm_map_ram(page, 0, 0) would cause panic by vmap_pages_range_noflush, so
>> change IS_ERR to IS_ERR_OR_NULL to fix this.
>>
>> Signed-off-by: Hailong.Liu <liuhailong@...o.com>
>> ---
>>  mm/vmalloc.c | 2 +-
>>  1 file changed, 1 insertion(+), 1 deletion(-)
>>
>> diff --git a/mm/vmalloc.c b/mm/vmalloc.c
>> index d12a17fc0c17..109732006cf7 100644
>> --- a/mm/vmalloc.c
>> +++ b/mm/vmalloc.c
>> @@ -2387,7 +2387,7 @@ void *vm_map_ram(struct page **pages, unsigned int
>> count, int node)
>>
>>         if (likely(count <= VMAP_MAX_ALLOC)) {
>>                 mem = vb_alloc(size, GFP_KERNEL);
>> -               if (IS_ERR(mem))
>> +               if (IS_ERR_OR_NULL(mem))
> 
> it seems the only case for vb_alloc to return NULL is size = 0, isn't
> it a bug of
> caller?
vb_alloc had already checked the size == 0, so it should be return NULL
to caller or not panic here.

In fact, we encounter z_erofs_lz4_decompress issue.

[54032.383633][T25392]  vmap_pages_range_noflush+0x790/0x8f8
[54032.383637][T25392]  vm_map_ram+0x1c8/0x10b0
[54032.383642][T25392]  z_erofs_lz4_decompress+0x60/0x1e8
[54032.383648][T25392]  z_erofs_decompress_pcluster+0x624/0x9fc
[54032.383653][T25392]  z_erofs_decompress_kickoff+0x18c/0x224
[54032.383658][T25392]  z_erofs_decompressqueue_endio+0x1a8/0x1e0
[54032.383663][T25392]  bio_endio+0x188/0x47c
[54032.383667][T25392]  clone_endio+0x1a0/0x550
[54032.383674][T25392]  bio_endio+0x14c/0x47c
[54032.383678][T25392]  verity_work.60258+0x7c/0x13c
[54032.383682][T25392]  process_one_work+0x1b8/0xa98
[54032.383687][T25392]  worker_thread+0x160/0x6c0
[54032.383691][T25392]  kthread+0x15c/0x1d0
[54032.383696][T25392]  ret_from_fork+0x10/0x20

z_erofs_lz4_decompress has checked the return value, so it's reasonable
to return NULL if size == 0.

Brs,
Hailong.
> 
>>                         return NULL;
>>                 addr = (unsigned long)mem;
>>         } else {
>> --
>> 2.34.1
> 
> Thanks
> Barry