Re: [PATCH v4] mm/memblock: fix overlapping allocation when doubling reserved array

[Andrew Morton <akpm@linux-foundation.org>]

On Mon, 18 Jun 2012 17:47:58 -0600
Greg Pearson <greg.pearson@hp.com> wrote:

> The __alloc_memory_core_early() routine will ask memblock for a range
> of memory then try to reserve it. If the reserved region array lacks
> space for the new range, memblock_double_array() is called to allocate
> more space for the array. If memblock is used to allocate memory for
> the new array it can end up using a range that overlaps with the range
> originally allocated in __alloc_memory_core_early(), leading to possible
> data corruption.

OK, but we have no information about whether it *does* lead to data
corruption.  Are there workloads which trigger this?  End users who are
experiencing problems?

See, I (and others) need to work out whether this patch should be
included in 3.5 or even earlier kernels.  To do that we often need the
developer to tell us what the impact of the bug is upon users.  Please
always include this info when fixing bugs.

> --- a/mm/memblock.c
> +++ b/mm/memblock.c
> @@ -399,7 +427,7 @@ repeat:
>  	 */
>  	if (!insert) {
>  		while (type->cnt + nr_new > type->max)
> -			if (memblock_double_array(type) < 0)
> +			if (memblock_double_array(type, obase, size) < 0)
>  				return -ENOMEM;
>  		insert = true;
>  		goto repeat;

Minor nit: it would be nicer to make memblock_double_array() return 0
on success or a -ve errno, and then propagate that errno back.  This is
more flexible than having the caller *assume* that the callee failed for a
particular reason.

--
To unsubscribe, send a message with 'unsubscribe linux-mm' in
the body to majordomo@kvack.org.  For more info on Linux MM,
see: http://www.linux-mm.org/ .
Don't email: <a href=mailto:"dont@kvack.org"> email@kvack.org </a>