On Fri, 27 May 2016 10:25:59 +0200 "guillermo.julian" <guillermo.julian@xxxxxxxxx> wrote:
> El 2016-05-26 23:28, Andrew Morton escribi__:
> > On Wed, 20 Apr 2016 12:53:33 +0200 Guillermo Juli__n Moreno
> > <guillermo.julian@xxxxxxxxx> wrote:
> >
> >>
> >> When remapping pages accounting for 4G or more memory space, the
> >> operation 'count << PAGE_SHIFT' overflows as it is performed on an
> >> integer. Solution: cast before doing the bitshift.
> >
> > Yup.
> >
> > We need to work out which kernel versions to fix. What are the runtime
> > effects of this? Are there real drivers in the tree which actually map
> > more than 4G?
>
> Looking at the references of vm_map_ram, it is only used in three
> drivers (XFS, v4l2-core and android/ion). However, in the vmap() code,
> the same bug is likely to occur (vmalloc.c:1557), and that function is
> more frequently used. But if it has gone unnoticed until now, most
> probably it isn't a critical issue (4G memory allocations are usually
> not needed. In fact this bug surfaced during a performance test in a
> modified driver, not in a regular configuration.
Yup. I'll add this as well:
From: Andrew Morton <akpm@xxxxxxxxxxxxxxxxxxxx>
Subject: mm-fix-overflow-in-vm_map_ram-fix
fix vmap() as well, per Guillermo
Cc: Guillermo Juli_n Moreno <guillermo.julian@xxxxxxxxx>
Signed-off-by: Andrew Morton <akpm@xxxxxxxxxxxxxxxxxxxx>
---
mm/vmalloc.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff -puN mm/vmalloc.c~mm-fix-overflow-in-vm_map_ram-fix mm/vmalloc.c
--- a/mm/vmalloc.c~mm-fix-overflow-in-vm_map_ram-fix
+++ a/mm/vmalloc.c
@@ -1574,14 +1574,15 @@ void *vmap(struct page **pages, unsigned
unsigned long flags, pgprot_t prot)
{
struct vm_struct *area;
+ unsigned long size; /* In bytes */
might_sleep();
if (count > totalram_pages)
return NULL;
- area = get_vm_area_caller((count << PAGE_SHIFT), flags,
- __builtin_return_address(0));
+ size = (unsigned long)count << PAGE_SHIFT;
+ area = get_vm_area_caller(size, flags, __builtin_return_address(0));
if (!area)
return NULL;
_
I checked all other instances of "<< PAGE" in vmalloc.c and we're good.
Thanks.
--
To unsubscribe, send a message with 'unsubscribe linux-mm' in
the body to majordomo@xxxxxxxxx. For more info on Linux MM,
see: http://www.linux-mm.org/ .
Don't email: <a href=mailto:"dont@xxxxxxxxx";> email@xxxxxxxxx </a>