From: Mike Kravetz <mike.kravetz@oracle.com> To: linux-mm@kvack.org, linux-kernel@vger.kernel.org Cc: Joonsoo Kim <iamjoonsoo.kim@lge.com>, Vlastimil Babka <vbabka@suse.cz>, Michal Nazarewicz <mina86@mina86.com>, Michal Hocko <mhocko@suse.com>, Mel Gorman <mgorman@techsingularity.net>, Johannes Weiner <hannes@cmpxchg.org>, Andrew Morton <akpm@linux-foundation.org>, Mike Kravetz <mike.kravetz@oracle.com>, stable@vger.kernel.org Subject: [PATCH v2] mm/cma: fix alloc_contig_range ret code/potential leak Date: Wed, 22 Nov 2017 10:52:14 -0800 [thread overview] Message-ID: <20171122185214.25285-1-mike.kravetz@oracle.com> (raw) In-Reply-To: <15cf0f39-43f9-8287-fcfe-f2502af59e8a@oracle.com> If the call __alloc_contig_migrate_range() in alloc_contig_range returns -EBUSY, processing continues so that test_pages_isolated() is called where there is a tracepoint to identify the busy pages. However, it is possible for busy pages to become available between the calls to these two routines. In this case, the range of pages may be allocated. Unfortunately, the original return code (ret == -EBUSY) is still set and returned to the caller. Therefore, the caller believes the pages were not allocated and they are leaked. Update comment to indicate that allocation is still possible even if __alloc_contig_migrate_range returns -EBUSY. Also, clear return code in this case so that it is not accidentally used or returned to caller. Fixes: 8ef5849fa8a2 ("mm/cma: always check which page caused allocation failure") Cc: <stable@vger.kernel.org> Signed-off-by: Mike Kravetz <mike.kravetz@oracle.com> --- mm/page_alloc.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/mm/page_alloc.c b/mm/page_alloc.c index 77e4d3c5c57b..25e81844d1aa 100644 --- a/mm/page_alloc.c +++ b/mm/page_alloc.c @@ -7582,11 +7582,18 @@ int alloc_contig_range(unsigned long start, unsigned long end, /* * In case of -EBUSY, we'd like to know which page causes problem. - * So, just fall through. We will check it in test_pages_isolated(). + * So, just fall through. test_pages_isolated() has a tracepoint + * which will report the busy page. + * + * It is possible that busy pages could become available before + * the call to test_pages_isolated, and the range will actually be + * allocated. So, if we fall through be sure to clear ret so that + * -EBUSY is not accidentally used or returned to caller. */ ret = __alloc_contig_migrate_range(&cc, start, end); if (ret && ret != -EBUSY) goto done; + ret =0; /* * Pages from [start, end) are within a MAX_ORDER_NR_PAGES -- 2.13.6
WARNING: multiple messages have this Message-ID (diff)
From: Mike Kravetz <mike.kravetz@oracle.com> To: linux-mm@kvack.org, linux-kernel@vger.kernel.org Cc: Joonsoo Kim <iamjoonsoo.kim@lge.com>, Vlastimil Babka <vbabka@suse.cz>, Michal Nazarewicz <mina86@mina86.com>, Michal Hocko <mhocko@suse.com>, Mel Gorman <mgorman@techsingularity.net>, Johannes Weiner <hannes@cmpxchg.org>, Andrew Morton <akpm@linux-foundation.org>, Mike Kravetz <mike.kravetz@oracle.com>, stable@vger.kernel.org Subject: [PATCH v2] mm/cma: fix alloc_contig_range ret code/potential leak Date: Wed, 22 Nov 2017 10:52:14 -0800 [thread overview] Message-ID: <20171122185214.25285-1-mike.kravetz@oracle.com> (raw) In-Reply-To: <15cf0f39-43f9-8287-fcfe-f2502af59e8a@oracle.com> If the call __alloc_contig_migrate_range() in alloc_contig_range returns -EBUSY, processing continues so that test_pages_isolated() is called where there is a tracepoint to identify the busy pages. However, it is possible for busy pages to become available between the calls to these two routines. In this case, the range of pages may be allocated. Unfortunately, the original return code (ret == -EBUSY) is still set and returned to the caller. Therefore, the caller believes the pages were not allocated and they are leaked. Update comment to indicate that allocation is still possible even if __alloc_contig_migrate_range returns -EBUSY. Also, clear return code in this case so that it is not accidentally used or returned to caller. Fixes: 8ef5849fa8a2 ("mm/cma: always check which page caused allocation failure") Cc: <stable@vger.kernel.org> Signed-off-by: Mike Kravetz <mike.kravetz@oracle.com> --- mm/page_alloc.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/mm/page_alloc.c b/mm/page_alloc.c index 77e4d3c5c57b..25e81844d1aa 100644 --- a/mm/page_alloc.c +++ b/mm/page_alloc.c @@ -7582,11 +7582,18 @@ int alloc_contig_range(unsigned long start, unsigned long end, /* * In case of -EBUSY, we'd like to know which page causes problem. - * So, just fall through. We will check it in test_pages_isolated(). + * So, just fall through. test_pages_isolated() has a tracepoint + * which will report the busy page. + * + * It is possible that busy pages could become available before + * the call to test_pages_isolated, and the range will actually be + * allocated. So, if we fall through be sure to clear ret so that + * -EBUSY is not accidentally used or returned to caller. */ ret = __alloc_contig_migrate_range(&cc, start, end); if (ret && ret != -EBUSY) goto done; + ret =0; /* * Pages from [start, end) are within a MAX_ORDER_NR_PAGES -- 2.13.6 -- To unsubscribe, send a message with 'unsubscribe linux-mm' in the body to majordomo@kvack.org. For more info on Linux MM, see: http://www.linux-mm.org/ . Don't email: <a href=mailto:"dont@kvack.org"> email@kvack.org </a>
next prev parent reply other threads:[~2017-11-22 18:53 UTC|newest] Thread overview: 27+ messages / expand[flat|nested] mbox.gz Atom feed top 2017-11-20 19:39 [PATCH 0/1] mm/cma: fix alloc_contig_range ret code/potential leak Mike Kravetz 2017-11-20 19:39 ` Mike Kravetz 2017-11-20 19:39 ` [PATCH 1/1] " Mike Kravetz 2017-11-20 19:39 ` Mike Kravetz 2017-11-21 7:53 ` Vlastimil Babka 2017-11-21 7:53 ` Vlastimil Babka 2017-11-21 13:06 ` Michal Hocko 2017-11-21 13:06 ` Michal Hocko 2017-11-21 13:04 ` Michal Hocko 2017-11-21 13:04 ` Michal Hocko 2017-11-21 14:20 ` Michal Nazarewicz 2017-11-21 14:20 ` Michal Nazarewicz 2017-11-21 14:20 ` Michal Nazarewicz 2017-11-22 12:00 ` Johannes Weiner 2017-11-22 12:00 ` Johannes Weiner 2017-11-22 17:46 ` Mike Kravetz 2017-11-22 17:46 ` Mike Kravetz 2017-11-22 18:52 ` Mike Kravetz [this message] 2017-11-22 18:52 ` [PATCH v2] " Mike Kravetz 2017-11-23 8:05 ` Vlastimil Babka 2017-11-23 8:05 ` Vlastimil Babka 2017-11-23 9:19 ` Michal Hocko 2017-11-23 9:19 ` Michal Hocko 2017-11-27 16:59 ` Johannes Weiner 2017-11-27 16:59 ` Johannes Weiner 2017-11-29 5:38 ` Joonsoo Kim 2017-11-29 5:38 ` Joonsoo Kim
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=20171122185214.25285-1-mike.kravetz@oracle.com \ --to=mike.kravetz@oracle.com \ --cc=akpm@linux-foundation.org \ --cc=hannes@cmpxchg.org \ --cc=iamjoonsoo.kim@lge.com \ --cc=linux-kernel@vger.kernel.org \ --cc=linux-mm@kvack.org \ --cc=mgorman@techsingularity.net \ --cc=mhocko@suse.com \ --cc=mina86@mina86.com \ --cc=stable@vger.kernel.org \ --cc=vbabka@suse.cz \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: linkBe sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.