From patchwork Mon Aug 7 20:38:39 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Pavel Tatashin X-Patchwork-Id: 9886191 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id 20CD6603F2 for ; Mon, 7 Aug 2017 20:44:55 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 1126728632 for ; Mon, 7 Aug 2017 20:44:55 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 05C44286F2; Mon, 7 Aug 2017 20:44:55 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-1.9 required=2.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID, RCVD_IN_DNSWL_NONE, UNPARSEABLE_RELAY autolearn=unavailable version=3.3.1 Received: from bombadil.infradead.org (bombadil.infradead.org [65.50.211.133]) (using TLSv1.2 with cipher AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.wl.linuxfoundation.org (Postfix) with ESMTPS id D7A4E28706 for ; Mon, 7 Aug 2017 20:44:52 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20170209; h=Sender: Content-Transfer-Encoding:Content-Type:MIME-Version:List-Subscribe:List-Help: List-Post:List-Archive:List-Unsubscribe:List-Id:References:In-Reply-To: Message-Id:Date:Subject:To:From:Reply-To:Cc:Content-ID:Content-Description: Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID: List-Owner; bh=0J6jozgNUYvNBH7P5oupqqybMErbzLrI9kinvNSrHn8=; b=jednZPgccZ+oR5 QiuVoHHOeWkfoiKpgfszBNkZ07DIOeNu2e8ltVPB7+UevSMkRskry0FJ94Io1pS8nV5CxeZ1ul7W5 NRnMlFKVQ0fVf7OLnFaBvJEdJ/Qy1SJbnwiZsIg4W51xDk446mySZQSkE2Cr/APetEOep5/x0Kf/K WHIFIec88qU4uCVfD/n9T8C89uvee8Y6jbhyLJIa8eSm1K7RZgIjHFII+7g7QI4EU6KNpbZ3bWmyJ nEUAt4PYkon+P0XiO15ITRxoWdeXgb/fT6RdHqs2kMxGFKfmod/aJqOE4cX8l+pK6ESssjGbocDQS 7JmXuEHNOlhzQSxoi5MQ==; Received: from localhost ([127.0.0.1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.87 #1 (Red Hat Linux)) id 1deosR-00006k-D9; Mon, 07 Aug 2017 20:43:51 +0000 Received: from userp1040.oracle.com ([156.151.31.81]) by bombadil.infradead.org with esmtps (Exim 4.87 #1 (Red Hat Linux)) id 1deoor-00044R-Su for linux-arm-kernel@lists.infradead.org; Mon, 07 Aug 2017 20:40:26 +0000 Received: from aserv0022.oracle.com (aserv0022.oracle.com [141.146.126.234]) by userp1040.oracle.com (Sentrion-MTA-4.3.2/Sentrion-MTA-4.3.2) with ESMTP id v77Kcx1G030754 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Mon, 7 Aug 2017 20:38:59 GMT Received: from aserv0121.oracle.com (aserv0121.oracle.com [141.146.126.235]) by aserv0022.oracle.com (8.14.4/8.14.4) with ESMTP id v77Kcxeg022973 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Mon, 7 Aug 2017 20:38:59 GMT Received: from abhmp0007.oracle.com (abhmp0007.oracle.com [141.146.116.13]) by aserv0121.oracle.com (8.14.4/8.13.8) with ESMTP id v77KcxHd020880; Mon, 7 Aug 2017 20:38:59 GMT Received: from ca-ldom-ol-build-1.us.oracle.com (/10.129.68.23) by default (Oracle Beehive Gateway v4.0) with ESMTP ; Mon, 07 Aug 2017 13:38:58 -0700 From: Pavel Tatashin To: linux-kernel@vger.kernel.org, sparclinux@vger.kernel.org, linux-mm@kvack.org, linuxppc-dev@lists.ozlabs.org, linux-s390@vger.kernel.org, linux-arm-kernel@lists.infradead.org, x86@kernel.org, kasan-dev@googlegroups.com, borntraeger@de.ibm.com, heiko.carstens@de.ibm.com, davem@davemloft.net, willy@infradead.org, mhocko@kernel.org, ard.biesheuvel@linaro.org, will.deacon@arm.com, catalin.marinas@arm.com, sam@ravnborg.org Subject: [v6 05/15] mm: don't accessed uninitialized struct pages Date: Mon, 7 Aug 2017 16:38:39 -0400 Message-Id: <1502138329-123460-6-git-send-email-pasha.tatashin@oracle.com> X-Mailer: git-send-email 1.7.1 In-Reply-To: <1502138329-123460-1-git-send-email-pasha.tatashin@oracle.com> References: <1502138329-123460-1-git-send-email-pasha.tatashin@oracle.com> X-Source-IP: aserv0022.oracle.com [141.146.126.234] X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20170807_134010_130932_ED603BDD X-CRM114-Status: GOOD ( 18.86 ) X-BeenThere: linux-arm-kernel@lists.infradead.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , MIME-Version: 1.0 Sender: "linux-arm-kernel" Errors-To: linux-arm-kernel-bounces+patchwork-linux-arm=patchwork.kernel.org@lists.infradead.org X-Virus-Scanned: ClamAV using ClamSMTP In deferred_init_memmap() where all deferred struct pages are initialized we have a check like this: if (page->flags) { VM_BUG_ON(page_zone(page) != zone); goto free_range; } This way we are checking if the current deferred page has already been initialized. It works, because memory for struct pages has been zeroed, and the only way flags are not zero if it went through __init_single_page() before. But, once we change the current behavior and won't zero the memory in memblock allocator, we cannot trust anything inside "struct page"es until they are initialized. This patch fixes this. This patch defines a new accessor memblock_get_reserved_pfn_range() which returns successive ranges of reserved PFNs. deferred_init_memmap() calls it to determine if a PFN and its struct page has already been initialized. Signed-off-by: Pavel Tatashin Reviewed-by: Steven Sistare Reviewed-by: Daniel Jordan Reviewed-by: Bob Picco --- include/linux/memblock.h | 3 +++ mm/memblock.c | 54 ++++++++++++++++++++++++++++++++++++++++++------ mm/page_alloc.c | 11 +++++++++- 3 files changed, 61 insertions(+), 7 deletions(-) diff --git a/include/linux/memblock.h b/include/linux/memblock.h index bae11c7e7bf3..b6a2a610f5e1 100644 --- a/include/linux/memblock.h +++ b/include/linux/memblock.h @@ -320,6 +320,9 @@ int memblock_is_map_memory(phys_addr_t addr); int memblock_is_region_memory(phys_addr_t base, phys_addr_t size); bool memblock_is_reserved(phys_addr_t addr); bool memblock_is_region_reserved(phys_addr_t base, phys_addr_t size); +void memblock_get_reserved_pfn_range(unsigned long pfn, + unsigned long *pfn_start, + unsigned long *pfn_end); extern void __memblock_dump_all(void); diff --git a/mm/memblock.c b/mm/memblock.c index bf14aea6ab70..08f449acfdd1 100644 --- a/mm/memblock.c +++ b/mm/memblock.c @@ -1580,7 +1580,13 @@ void __init memblock_mem_limit_remove_map(phys_addr_t limit) memblock_cap_memory_range(0, max_addr); } -static int __init_memblock memblock_search(struct memblock_type *type, phys_addr_t addr) +/** + * Return index in regions array if addr is within the region. Otherwise + * return -1. If -1 is returned and *next_idx is not %NULL, sets it to the + * next region index or -1 if there is none. + */ +static int __init_memblock memblock_search(struct memblock_type *type, + phys_addr_t addr, int *next_idx) { unsigned int left = 0, right = type->cnt; @@ -1595,22 +1601,26 @@ static int __init_memblock memblock_search(struct memblock_type *type, phys_addr else return mid; } while (left < right); + + if (next_idx) + *next_idx = (right == type->cnt) ? -1 : right; + return -1; } bool __init memblock_is_reserved(phys_addr_t addr) { - return memblock_search(&memblock.reserved, addr) != -1; + return memblock_search(&memblock.reserved, addr, NULL) != -1; } bool __init_memblock memblock_is_memory(phys_addr_t addr) { - return memblock_search(&memblock.memory, addr) != -1; + return memblock_search(&memblock.memory, addr, NULL) != -1; } int __init_memblock memblock_is_map_memory(phys_addr_t addr) { - int i = memblock_search(&memblock.memory, addr); + int i = memblock_search(&memblock.memory, addr, NULL); if (i == -1) return false; @@ -1622,7 +1632,7 @@ int __init_memblock memblock_search_pfn_nid(unsigned long pfn, unsigned long *start_pfn, unsigned long *end_pfn) { struct memblock_type *type = &memblock.memory; - int mid = memblock_search(type, PFN_PHYS(pfn)); + int mid = memblock_search(type, PFN_PHYS(pfn), NULL); if (mid == -1) return -1; @@ -1646,7 +1656,7 @@ int __init_memblock memblock_search_pfn_nid(unsigned long pfn, */ int __init_memblock memblock_is_region_memory(phys_addr_t base, phys_addr_t size) { - int idx = memblock_search(&memblock.memory, base); + int idx = memblock_search(&memblock.memory, base, NULL); phys_addr_t end = base + memblock_cap_size(base, &size); if (idx == -1) @@ -1655,6 +1665,38 @@ int __init_memblock memblock_is_region_memory(phys_addr_t base, phys_addr_t size memblock.memory.regions[idx].size) >= end; } +/** + * memblock_get_reserved_pfn_range - search for the next reserved region + * + * @pfn: start searching from this pfn. + * + * RETURNS: + * [start_pfn, end_pfn), where start_pfn >= pfn. If none is found + * start_pfn, and end_pfn are both set to ULONG_MAX. + */ +void __init_memblock memblock_get_reserved_pfn_range(unsigned long pfn, + unsigned long *start_pfn, + unsigned long *end_pfn) +{ + struct memblock_type *type = &memblock.reserved; + int next_idx, idx; + + idx = memblock_search(type, PFN_PHYS(pfn), &next_idx); + if (idx == -1 && next_idx == -1) { + *start_pfn = ULONG_MAX; + *end_pfn = ULONG_MAX; + return; + } + + if (idx == -1) { + idx = next_idx; + *start_pfn = PFN_DOWN(type->regions[idx].base); + } else { + *start_pfn = pfn; + } + *end_pfn = PFN_DOWN(type->regions[idx].base + type->regions[idx].size); +} + /** * memblock_is_region_reserved - check if a region intersects reserved memory * @base: base of region to check diff --git a/mm/page_alloc.c b/mm/page_alloc.c index 63d16c185736..983de0a8047b 100644 --- a/mm/page_alloc.c +++ b/mm/page_alloc.c @@ -1447,6 +1447,7 @@ static int __init deferred_init_memmap(void *data) pg_data_t *pgdat = data; int nid = pgdat->node_id; struct mminit_pfnnid_cache nid_init_state = { }; + unsigned long resv_start_pfn = 0, resv_end_pfn = 0; unsigned long start = jiffies; unsigned long nr_pages = 0; unsigned long walk_start, walk_end; @@ -1491,6 +1492,10 @@ static int __init deferred_init_memmap(void *data) pfn = zone->zone_start_pfn; for (; pfn < end_pfn; pfn++) { + if (pfn >= resv_end_pfn) + memblock_get_reserved_pfn_range(pfn, + &resv_start_pfn, + &resv_end_pfn); if (!pfn_valid_within(pfn)) goto free_range; @@ -1524,7 +1529,11 @@ static int __init deferred_init_memmap(void *data) cond_resched(); } - if (page->flags) { + /* + * Check if this page has already been initialized due + * to being reserved during boot in memblock. + */ + if (pfn >= resv_start_pfn) { VM_BUG_ON(page_zone(page) != zone); goto free_range; }