* [patch] mm: vmap fix overflow
@ 2009-02-10 5:51 Nick Piggin
2009-02-10 22:44 ` Andrew Morton
0 siblings, 1 reply; 5+ messages in thread
From: Nick Piggin @ 2009-02-10 5:51 UTC (permalink / raw)
To: Andrew Morton, Christoph Hellwig, Linux Kernel Mailing List, stable
This patch is appropriate for 2.6.28 too.
--
The new vmap allocator can wrap the address and get confused in the case of
large allocations or VMALLOC_END near the end of address space.
Problem reported by Christoph Hellwig on a 32-bit XFS workload.
Signed-off-by: Nick Piggin <npiggin@suse.de>
---
mm/vmalloc.c | 6 ++++++
1 file changed, 6 insertions(+)
Index: linux-2.6/mm/vmalloc.c
===================================================================
--- linux-2.6.orig/mm/vmalloc.c
+++ linux-2.6/mm/vmalloc.c
@@ -334,6 +334,9 @@ retry:
addr = ALIGN(vstart, align);
spin_lock(&vmap_area_lock);
+ if (addr + size < addr)
+ goto overflow;
+
/* XXX: could have a last_hole cache */
n = vmap_area_root.rb_node;
if (n) {
@@ -365,6 +368,8 @@ retry:
while (addr + size > first->va_start && addr + size <= vend) {
addr = ALIGN(first->va_end + PAGE_SIZE, align);
+ if (addr + size < addr)
+ goto overflow;
n = rb_next(&first->rb_node);
if (n)
@@ -375,6 +380,7 @@ retry:
}
found:
if (addr + size > vend) {
+overflow:
spin_unlock(&vmap_area_lock);
if (!purged) {
purge_vmap_area_lazy();
^ permalink raw reply [flat|nested] 5+ messages in thread* Re: [patch] mm: vmap fix overflow
2009-02-10 5:51 [patch] mm: vmap fix overflow Nick Piggin
@ 2009-02-10 22:44 ` Andrew Morton
2009-02-12 1:39 ` Nick Piggin
0 siblings, 1 reply; 5+ messages in thread
From: Andrew Morton @ 2009-02-10 22:44 UTC (permalink / raw)
To: Nick Piggin; +Cc: hch, linux-kernel, stable
On Tue, 10 Feb 2009 06:51:19 +0100
Nick Piggin <npiggin@suse.de> wrote:
> This patch is appropriate for 2.6.28 too.
>
> --
>
> The new vmap allocator can wrap the address and get confused in the case of
> large allocations or VMALLOC_END near the end of address space.
>
> Problem reported by Christoph Hellwig on a 32-bit XFS workload.
>
> Signed-off-by: Nick Piggin <npiggin@suse.de>
> ---
> mm/vmalloc.c | 6 ++++++
> 1 file changed, 6 insertions(+)
>
> Index: linux-2.6/mm/vmalloc.c
> ===================================================================
> --- linux-2.6.orig/mm/vmalloc.c
> +++ linux-2.6/mm/vmalloc.c
> @@ -334,6 +334,9 @@ retry:
> addr = ALIGN(vstart, align);
>
> spin_lock(&vmap_area_lock);
> + if (addr + size < addr)
> + goto overflow;
> +
> /* XXX: could have a last_hole cache */
> n = vmap_area_root.rb_node;
> if (n) {
> @@ -365,6 +368,8 @@ retry:
>
> while (addr + size > first->va_start && addr + size <= vend) {
> addr = ALIGN(first->va_end + PAGE_SIZE, align);
> + if (addr + size < addr)
> + goto overflow;
>
> n = rb_next(&first->rb_node);
> if (n)
> @@ -375,6 +380,7 @@ retry:
> }
> found:
> if (addr + size > vend) {
> +overflow:
> spin_unlock(&vmap_area_lock);
> if (!purged) {
> purge_vmap_area_lazy();
well...
If a caller tries to allocate 0x1000 bytes at address 0xfffff000, this
code will think that it overflowed. But it didn't.
Presumably nobody ever tries to do that, but it seems a bit sloppy?
^ permalink raw reply [flat|nested] 5+ messages in thread* Re: [patch] mm: vmap fix overflow
2009-02-10 22:44 ` Andrew Morton
@ 2009-02-12 1:39 ` Nick Piggin
2009-02-12 2:20 ` Andrew Morton
0 siblings, 1 reply; 5+ messages in thread
From: Nick Piggin @ 2009-02-12 1:39 UTC (permalink / raw)
To: Andrew Morton; +Cc: hch, linux-kernel, stable
On Tue, Feb 10, 2009 at 02:44:20PM -0800, Andrew Morton wrote:
> On Tue, 10 Feb 2009 06:51:19 +0100
> Nick Piggin <npiggin@suse.de> wrote:
>
> > This patch is appropriate for 2.6.28 too.
> >
> > --
> >
> > The new vmap allocator can wrap the address and get confused in the case of
> > large allocations or VMALLOC_END near the end of address space.
> >
> > Problem reported by Christoph Hellwig on a 32-bit XFS workload.
> >
> > Signed-off-by: Nick Piggin <npiggin@suse.de>
> > ---
> > mm/vmalloc.c | 6 ++++++
> > 1 file changed, 6 insertions(+)
> >
> > Index: linux-2.6/mm/vmalloc.c
> > ===================================================================
> > --- linux-2.6.orig/mm/vmalloc.c
> > +++ linux-2.6/mm/vmalloc.c
> > @@ -334,6 +334,9 @@ retry:
> > addr = ALIGN(vstart, align);
> >
> > spin_lock(&vmap_area_lock);
> > + if (addr + size < addr)
> > + goto overflow;
> > +
> > /* XXX: could have a last_hole cache */
> > n = vmap_area_root.rb_node;
> > if (n) {
> > @@ -365,6 +368,8 @@ retry:
> >
> > while (addr + size > first->va_start && addr + size <= vend) {
> > addr = ALIGN(first->va_end + PAGE_SIZE, align);
> > + if (addr + size < addr)
> > + goto overflow;
> >
> > n = rb_next(&first->rb_node);
> > if (n)
> > @@ -375,6 +380,7 @@ retry:
> > }
> > found:
> > if (addr + size > vend) {
> > +overflow:
> > spin_unlock(&vmap_area_lock);
> > if (!purged) {
> > purge_vmap_area_lazy();
>
> well...
>
>
> If a caller tries to allocate 0x1000 bytes at address 0xfffff000, this
> code will think that it overflowed. But it didn't.
>
> Presumably nobody ever tries to do that, but it seems a bit sloppy?
Oh that's true, good catch. I guess that should be (addr + size - 1)?
Because we care about the last byte that was actually allocated to us
(inclusive, rather than exclusive).
^ permalink raw reply [flat|nested] 5+ messages in thread* Re: [patch] mm: vmap fix overflow
2009-02-12 1:39 ` Nick Piggin
@ 2009-02-12 2:20 ` Andrew Morton
2009-02-12 2:30 ` Nick Piggin
0 siblings, 1 reply; 5+ messages in thread
From: Andrew Morton @ 2009-02-12 2:20 UTC (permalink / raw)
To: Nick Piggin; +Cc: hch, linux-kernel, stable
On Thu, 12 Feb 2009 02:39:31 +0100 Nick Piggin <npiggin@suse.de> wrote:
> On Tue, Feb 10, 2009 at 02:44:20PM -0800, Andrew Morton wrote:
> > On Tue, 10 Feb 2009 06:51:19 +0100
> > Nick Piggin <npiggin@suse.de> wrote:
> >
> > > This patch is appropriate for 2.6.28 too.
> > >
> > > --
> > >
> > > The new vmap allocator can wrap the address and get confused in the case of
> > > large allocations or VMALLOC_END near the end of address space.
> > >
> > > Problem reported by Christoph Hellwig on a 32-bit XFS workload.
> > >
> > > Signed-off-by: Nick Piggin <npiggin@suse.de>
> > > ---
> > > mm/vmalloc.c | 6 ++++++
> > > 1 file changed, 6 insertions(+)
> > >
> > > Index: linux-2.6/mm/vmalloc.c
> > > ===================================================================
> > > --- linux-2.6.orig/mm/vmalloc.c
> > > +++ linux-2.6/mm/vmalloc.c
> > > @@ -334,6 +334,9 @@ retry:
> > > addr = ALIGN(vstart, align);
> > >
> > > spin_lock(&vmap_area_lock);
> > > + if (addr + size < addr)
> > > + goto overflow;
> > > +
> > > /* XXX: could have a last_hole cache */
> > > n = vmap_area_root.rb_node;
> > > if (n) {
> > > @@ -365,6 +368,8 @@ retry:
> > >
> > > while (addr + size > first->va_start && addr + size <= vend) {
> > > addr = ALIGN(first->va_end + PAGE_SIZE, align);
> > > + if (addr + size < addr)
> > > + goto overflow;
> > >
> > > n = rb_next(&first->rb_node);
> > > if (n)
> > > @@ -375,6 +380,7 @@ retry:
> > > }
> > > found:
> > > if (addr + size > vend) {
> > > +overflow:
> > > spin_unlock(&vmap_area_lock);
> > > if (!purged) {
> > > purge_vmap_area_lazy();
> >
> > well...
> >
> >
> > If a caller tries to allocate 0x1000 bytes at address 0xfffff000, this
> > code will think that it overflowed. But it didn't.
> >
> > Presumably nobody ever tries to do that, but it seems a bit sloppy?
>
> Oh that's true, good catch. I guess that should be (addr + size - 1)?
> Because we care about the last byte that was actually allocated to us
> (inclusive, rather than exclusive).
That would work. It wouldd give weird results for size==0, but probably
that's already checked for somewhere(?)
^ permalink raw reply [flat|nested] 5+ messages in thread* Re: [patch] mm: vmap fix overflow
2009-02-12 2:20 ` Andrew Morton
@ 2009-02-12 2:30 ` Nick Piggin
0 siblings, 0 replies; 5+ messages in thread
From: Nick Piggin @ 2009-02-12 2:30 UTC (permalink / raw)
To: Andrew Morton; +Cc: hch, linux-kernel, stable
On Wed, Feb 11, 2009 at 06:20:50PM -0800, Andrew Morton wrote:
> On Thu, 12 Feb 2009 02:39:31 +0100 Nick Piggin <npiggin@suse.de> wrote:
> >
> > Oh that's true, good catch. I guess that should be (addr + size - 1)?
> > Because we care about the last byte that was actually allocated to us
> > (inclusive, rather than exclusive).
>
> That would work. It wouldd give weird results for size==0, but probably
> that's already checked for somewhere(?)
It's checked down in __get_vm_area_node.
^ permalink raw reply [flat|nested] 5+ messages in thread
end of thread, other threads:[~2009-02-12 2:30 UTC | newest]
Thread overview: 5+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2009-02-10 5:51 [patch] mm: vmap fix overflow Nick Piggin
2009-02-10 22:44 ` Andrew Morton
2009-02-12 1:39 ` Nick Piggin
2009-02-12 2:20 ` Andrew Morton
2009-02-12 2:30 ` Nick Piggin
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®