lkml.org 
[lkml]   [2011]   [Aug]   [24]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    Date
    From
    SubjectRe: [PATCH -v3] avoid null pointer access in vm_struct
    Hi Andrew,

    (2011/08/23 7:25), Andrew Morton wrote:
    > On Sun, 21 Aug 2011 17:21:32 +0900
    > Mitsuo Hayasaka <mitsuo.hayasaka.hu@hitachi.com> wrote:
    >
    >> The /proc/vmallocinfo shows information about vmalloc allocations in vmlist
    >> that is a linklist of vm_struct. It, however, may access pages field of
    >> vm_struct where a page was not allocated. This results in a null pointer
    >> access and leads to a kernel panic.
    >>
    >> Why this happen:
    >> In __vmalloc_node_range() called from vmalloc(), newly allocated vm_struct
    >> is added to vmlist at __get_vm_area_node() and then, some fields of
    >> vm_struct such as nr_pages and pages are set at __vmalloc_area_node(). In
    >> other words, it is added to vmlist before it is fully initialized. At the
    >> same time, when the /proc/vmallocinfo is read, it accesses the pages field
    >> of vm_struct according to the nr_pages field at show_numa_info(). Thus, a
    >> null pointer access happens.
    >>
    >> Patch:
    >> This patch adds newly allocated vm_struct to the vmlist *after* it is fully
    >> initialized. So, it can avoid accessing the pages field with unallocated
    >> page when show_numa_info() is called.
    >
    > Seems rather ugly, but I guess it's OK. vmalloc() is "special" in that
    > it fills the area with allocated pages, whereas all the
    > get_vm_area()-type callers don't do that.
    >
    >>
    >> ...
    >>
    >> @@ -1381,17 +1403,20 @@ struct vm_struct *remove_vm_area(const void *addr)
    >> va = find_vmap_area((unsigned long)addr);
    >> if (va && va->flags & VM_VM_AREA) {
    >> struct vm_struct *vm = va->private;
    >> - struct vm_struct *tmp, **p;
    >> - /*
    >> - * remove from list and disallow access to this vm_struct
    >> - * before unmap. (address range confliction is maintained by
    >> - * vmap.)
    >> - */
    >> - write_lock(&vmlist_lock);
    >> - for (p = &vmlist; (tmp = *p) != vm; p = &tmp->next)
    >> - ;
    >> - *p = tmp->next;
    >> - write_unlock(&vmlist_lock);
    >> +
    >> + if (!(vm->flags & VM_UNLIST)) {
    >> + struct vm_struct *tmp, **p;
    >> + /*
    >> + * remove from list and disallow access to
    >> + * this vm_struct before unmap. (address range
    >> + * confliction is maintained by vmap.)
    >> + */
    >> + write_lock(&vmlist_lock);
    >> + for (p = &vmlist; (tmp = *p) != vm; p = &tmp->next)
    >> + ;
    >> + *p = tmp->next;
    >> + write_unlock(&vmlist_lock);
    >> + }
    >
    > Is this needed? How can remove_vm_area() actually be called with a
    > VM_UNLIST area?
    >

    Yes, it is needed because this patch does not add the newly allocated vm_struct
    to vmlist at __get_vm_area_node(). So, revove_vm_area() with unlisted vm_struct
    will be called when an error occurs within __vmalloc_area_node().

    >
    > I think I'll let this patch cook in linux-next for a while and shall
    > tag it for backporting into 3.1.x later on.
    >

    I see, thank you.


    \
     
     \ /
      Last update: 2011-08-24 06:33    [W:3.229 / U:0.376 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site