lkml.org 
[lkml]   [2006]   [Feb]   [6]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: [PATCH, V2] i386: instead of poisoning .init zone, change protection bits to force a fault
Andrew Morton a écrit :
> Eric Dumazet <dada1@cosmosbay.com> wrote:
>>
>> Chasing some invalid accesses to .init zone, I found that free_init_pages()
>> was properly freeing the pages but virtual was still usable.
>>
>> A poisoning (memset(page, 0xcc, PAGE_SIZE)) was done but this is not reliable.
>>
>> A new config option DEBUG_INITDATA is introduced to mark this initdata as not
>> present at all so that buggy code can trigger a fault.
>>
>> This option is not meant for production machines because it may split one or
>> two huge page (2MB or 4MB) into small pages and thus slow down kernel a bit.
>>
>> (After that we could map non possible cpu percpu data to the initial
>> percpudata that is included in .init and discarded in free_initmem())
>>
>> ...
>>
>> --- a/arch/i386/mm/init.c 2006-01-25 10:17:24.000000000 +0100
>> +++ b/arch/i386/mm/init.c 2006-01-29 22:38:53.000000000 +0100
>> @@ -750,11 +750,18 @@
>> for (addr = begin; addr < end; addr += PAGE_SIZE) {
>> ClearPageReserved(virt_to_page(addr));
>> set_page_count(virt_to_page(addr), 1);
>> +#ifdef CONFIG_DEBUG_INITDATA
>> + change_page_attr(virt_to_page(addr), 1, __pgprot(0));
>> +#else
>> memset((void *)addr, 0xcc, PAGE_SIZE);
>> +#endif
>> free_page(addr);
>> totalram_pages++;
>> }
>> printk(KERN_INFO "Freeing %s: %ldk freed\n", what, (end - begin) >> 10);
>> +#ifdef CONFIG_DEBUG_INITDATA
>> + global_flush_tlb();
>> +#endif
>> }
>>
>
> This doesn't seem very pointful.
>
> We unmap the page, then return it to the page allocator. Then someone
> reallocates the page, tries to use it and goes oops.
>
> If CONFIG_DEBUG_PAGEALLOC is also set, the kernel will remap the page when
> it's allocated and everything works OK. So this patch requires
> CONFIG_DEBUG_PAGEALLOC.
>
> But if CONFIG_DEBUG_PAGEALLOC is set, we'll have unmapped that page in
> free_page() _anyway_, so why bother using this patch?
>
> The only enhancement I can think of here is to not free the page, so it's
> permanently leaked and permanently unmapped.
>
> --- devel/arch/i386/mm/init.c~i386-instead-of-poisoning-init-zone-change-protection-fix 2006-02-04 14:33:33.000000000 -0800
> +++ devel-akpm/arch/i386/mm/init.c 2006-02-04 14:34:07.000000000 -0800
> @@ -751,11 +751,15 @@ void free_init_pages(char *what, unsigne
> ClearPageReserved(virt_to_page(addr));
> set_page_count(virt_to_page(addr), 1);
> #ifdef CONFIG_DEBUG_INITDATA
> + /*
> + * Unmap the page, and leak it. So any further accesses will
> + * oops.
> + */
> change_page_attr(virt_to_page(addr), 1, __pgprot(0));
> #else
> memset((void *)addr, 0xcc, PAGE_SIZE);
> -#endif
> free_page(addr);
> +#endif
> totalram_pages++;
> }
> printk(KERN_INFO "Freeing %s: %ldk freed\n", what, (end - begin) >> 10);

I wonder if you dont have to move the 'totalram_pages++;' next to the
free_page(addr) call (ie inside the #else/#endif block)

Eric

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/

\
 
 \ /
  Last update: 2006-02-06 10:04    [W:0.907 / U:0.012 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site