LKML Archive on lore.kernel.org
help / color / mirror / Atom feed
From: Chintan Pandya <cpandya@codeaurora.org>
To: vbabka@suse.cz, labbott@redhat.com, catalin.marinas@arm.com,
	hannes@cmpxchg.org, f.fainelli@gmail.com, xieyisheng1@huawei.com,
	ard.biesheuvel@linaro.org, richard.weiyang@gmail.com,
	byungchul.park@lge.com
Cc: linux-mm@kvack.org, linux-kernel@vger.kernel.org,
	khandual@linux.vnet.ibm.com, mhocko@kernel.org,
	Chintan Pandya <cpandya@codeaurora.org>
Subject: [PATCH v2 1/2] mm: vmalloc: Avoid racy handling of debugobjects in vunmap
Date: Tue, 17 Apr 2018 16:13:47 +0530	[thread overview]
Message-ID: <1523961828-9485-2-git-send-email-cpandya@codeaurora.org> (raw)
In-Reply-To: <1523961828-9485-1-git-send-email-cpandya@codeaurora.org>

Currently, __vunmap flow is,
 1) Release the VM area
 2) Free the debug objects corresponding to that vm area.

This leave some race window open.
 1) Release the VM area
 1.5) Some other client gets the same vm area
 1.6) This client allocates new debug objects on the same
      vm area
 2) Free the debug objects corresponding to this vm area.

Here, we actually free 'other' client's debug objects.

Fix this by freeing the debug objects first and then
releasing the VM area.

Signed-off-by: Chintan Pandya <cpandya@codeaurora.org>
---
 mm/vmalloc.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/mm/vmalloc.c b/mm/vmalloc.c
index 6729400..12d675c 100644
--- a/mm/vmalloc.c
+++ b/mm/vmalloc.c
@@ -1500,7 +1500,7 @@ static void __vunmap(const void *addr, int deallocate_pages)
 			addr))
 		return;
 
-	area = remove_vm_area(addr);
+	area = find_vmap_area((unsigned long)addr)->vm;
 	if (unlikely(!area)) {
 		WARN(1, KERN_ERR "Trying to vfree() nonexistent vm area (%p)\n",
 				addr);
@@ -1510,6 +1510,7 @@ static void __vunmap(const void *addr, int deallocate_pages)
 	debug_check_no_locks_freed(addr, get_vm_area_size(area));
 	debug_check_no_obj_freed(addr, get_vm_area_size(area));
 
+	remove_vm_area(addr);
 	if (deallocate_pages) {
 		int i;
 
-- 
Qualcomm India Private Limited, on behalf of Qualcomm Innovation
Center, Inc., is a member of Code Aurora Forum, a Linux Foundation
Collaborative Project

  reply	other threads:[~2018-04-17 10:44 UTC|newest]

Thread overview: 7+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2018-04-17 10:43 [PATCH v2 0/2] vunmap and debug objects Chintan Pandya
2018-04-17 10:43 ` Chintan Pandya [this message]
2018-04-17 10:43 ` [PATCH v2 2/2] mm: vmalloc: Pass proper vm_start into debugobjects Chintan Pandya
2018-04-30 23:04   ` Andrew Morton
2018-05-01  5:24     ` Chintan Pandya
2018-05-03 21:42   ` Andrew Morton
2018-05-04  5:55     ` Chintan Pandya

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=1523961828-9485-2-git-send-email-cpandya@codeaurora.org \
    --to=cpandya@codeaurora.org \
    --cc=ard.biesheuvel@linaro.org \
    --cc=byungchul.park@lge.com \
    --cc=catalin.marinas@arm.com \
    --cc=f.fainelli@gmail.com \
    --cc=hannes@cmpxchg.org \
    --cc=khandual@linux.vnet.ibm.com \
    --cc=labbott@redhat.com \
    --cc=linux-kernel@vger.kernel.org \
    --cc=linux-mm@kvack.org \
    --cc=mhocko@kernel.org \
    --cc=richard.weiyang@gmail.com \
    --cc=vbabka@suse.cz \
    --cc=xieyisheng1@huawei.com \
    --subject='Re: [PATCH v2 1/2] mm: vmalloc: Avoid racy handling of debugobjects in vunmap' \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).