mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2025-01-01 10:45:49 +00:00
f6c2e2e164
commit eedce141cd
upstream.
The genalloc code uses the bitmap API from include/linux/bitmap.h and
lib/bitmap.c, which is based on long values. Both bitmap_set from
lib/bitmap.c and bitmap_set_ll, which is the lockless version from
genalloc.c, use BITMAP_LAST_WORD_MASK to set the first bits in a long in
the bitmap.
That one uses (1 << bits) - 1, 0b111, if you are setting the first three
bits. This means that the API counts from the least significant bits
(LSB from now on) to the MSB. The LSB in the first long is bit 0, then.
The same works for the lookup functions.
The genalloc code uses longs for the bitmap, as it should. In
include/linux/genalloc.h, struct gen_pool_chunk has unsigned long
bits[0] as its last member. When allocating the struct, genalloc should
reserve enough space for the bitmap. This should be a proper number of
longs that can fit the amount of bits in the bitmap.
However, genalloc allocates an integer number of bytes that fit the
amount of bits, but may not be an integer amount of longs. 9 bytes, for
example, could be allocated for 70 bits.
This is a problem in itself if the Least Significat Bit in a long is in
the byte with the largest address, which happens in Big Endian machines.
This means genalloc is not allocating the byte in which it will try to
set or check for a bit.
This may end up in memory corruption, where genalloc will try to set the
bits it has not allocated. In fact, genalloc may not set these bits
because it may find them already set, because they were not zeroed since
they were not allocated. And that's what causes a BUG when
gen_pool_destroy is called and check for any set bits.
What really happens is that genalloc uses kmalloc_node with __GFP_ZERO
on gen_pool_add_virt. With SLAB and SLUB, this means the whole slab
will be cleared, not only the requested bytes. Since struct
gen_pool_chunk has a size that is a multiple of 8, and slab sizes are
multiples of 8, we get lucky and allocate and clear the right amount of
bytes.
Hower, this is not the case with SLOB or with older code that did memset
after allocating instead of using __GFP_ZERO.
So, a simple module as this (running 3.6.0), will cause a crash when
rmmod'ed.
[root@phantom-lp2 foo]# cat foo.c
#include <linux/kernel.h>
#include <linux/module.h>
#include <linux/init.h>
#include <linux/genalloc.h>
MODULE_LICENSE("GPL");
MODULE_VERSION("0.1");
static struct gen_pool *foo_pool;
static __init int foo_init(void)
{
int ret;
foo_pool = gen_pool_create(10, -1);
if (!foo_pool)
return -ENOMEM;
ret = gen_pool_add(foo_pool, 0xa0000000, 32 << 10, -1);
if (ret) {
gen_pool_destroy(foo_pool);
return ret;
}
return 0;
}
static __exit void foo_exit(void)
{
gen_pool_destroy(foo_pool);
}
module_init(foo_init);
module_exit(foo_exit);
[root@phantom-lp2 foo]# zcat /proc/config.gz | grep SLOB
CONFIG_SLOB=y
[root@phantom-lp2 foo]# insmod ./foo.ko
[root@phantom-lp2 foo]# rmmod foo
------------[ cut here ]------------
kernel BUG at lib/genalloc.c:243!
cpu 0x4: Vector: 700 (Program Check) at [c0000000bb0e7960]
pc: c0000000003cb50c: .gen_pool_destroy+0xac/0x110
lr: c0000000003cb4fc: .gen_pool_destroy+0x9c/0x110
sp: c0000000bb0e7be0
msr: 8000000000029032
current = 0xc0000000bb0e0000
paca = 0xc000000006d30e00 softe: 0 irq_happened: 0x01
pid = 13044, comm = rmmod
kernel BUG at lib/genalloc.c:243!
[c0000000bb0e7ca0] d000000004b00020 .foo_exit+0x20/0x38 [foo]
[c0000000bb0e7d20] c0000000000dff98 .SyS_delete_module+0x1a8/0x290
[c0000000bb0e7e30] c0000000000097d4 syscall_exit+0x0/0x94
--- Exception: c00 (System Call) at 000000800753d1a0
SP (fffd0b0e640) is in userspace
Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo@linux.vnet.ibm.com>
Cc: Paul Gortmaker <paul.gortmaker@windriver.com>
Cc: Benjamin Gaignard <benjamin.gaignard@stericsson.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
189 lines
5.1 KiB
C
189 lines
5.1 KiB
C
/*
|
|
* Basic general purpose allocator for managing special purpose memory
|
|
* not managed by the regular kmalloc/kfree interface.
|
|
* Uses for this includes on-device special memory, uncached memory
|
|
* etc.
|
|
*
|
|
* Copyright 2005 (C) Jes Sorensen <jes@trained-monkey.org>
|
|
*
|
|
* This source code is licensed under the GNU General Public License,
|
|
* Version 2. See the file COPYING for more details.
|
|
*/
|
|
|
|
#include <linux/slab.h>
|
|
#include <linux/module.h>
|
|
#include <linux/bitmap.h>
|
|
#include <linux/genalloc.h>
|
|
|
|
|
|
/**
|
|
* gen_pool_create - create a new special memory pool
|
|
* @min_alloc_order: log base 2 of number of bytes each bitmap bit represents
|
|
* @nid: node id of the node the pool structure should be allocated on, or -1
|
|
*
|
|
* Create a new special memory pool that can be used to manage special purpose
|
|
* memory not managed by the regular kmalloc/kfree interface.
|
|
*/
|
|
struct gen_pool *gen_pool_create(int min_alloc_order, int nid)
|
|
{
|
|
struct gen_pool *pool;
|
|
|
|
pool = kmalloc_node(sizeof(struct gen_pool), GFP_KERNEL, nid);
|
|
if (pool != NULL) {
|
|
rwlock_init(&pool->lock);
|
|
INIT_LIST_HEAD(&pool->chunks);
|
|
pool->min_alloc_order = min_alloc_order;
|
|
}
|
|
return pool;
|
|
}
|
|
EXPORT_SYMBOL(gen_pool_create);
|
|
|
|
/**
|
|
* gen_pool_add - add a new chunk of special memory to the pool
|
|
* @pool: pool to add new memory chunk to
|
|
* @addr: starting address of memory chunk to add to pool
|
|
* @size: size in bytes of the memory chunk to add to pool
|
|
* @nid: node id of the node the chunk structure and bitmap should be
|
|
* allocated on, or -1
|
|
*
|
|
* Add a new chunk of special memory to the specified pool.
|
|
*/
|
|
int gen_pool_add(struct gen_pool *pool, unsigned long addr, size_t size,
|
|
int nid)
|
|
{
|
|
struct gen_pool_chunk *chunk;
|
|
int nbits = size >> pool->min_alloc_order;
|
|
int nbytes = sizeof(struct gen_pool_chunk) +
|
|
BITS_TO_LONGS(nbits) * sizeof(long);
|
|
|
|
chunk = kmalloc_node(nbytes, GFP_KERNEL | __GFP_ZERO, nid);
|
|
if (unlikely(chunk == NULL))
|
|
return -1;
|
|
|
|
spin_lock_init(&chunk->lock);
|
|
chunk->start_addr = addr;
|
|
chunk->end_addr = addr + size;
|
|
|
|
write_lock(&pool->lock);
|
|
list_add(&chunk->next_chunk, &pool->chunks);
|
|
write_unlock(&pool->lock);
|
|
|
|
return 0;
|
|
}
|
|
EXPORT_SYMBOL(gen_pool_add);
|
|
|
|
/**
|
|
* gen_pool_destroy - destroy a special memory pool
|
|
* @pool: pool to destroy
|
|
*
|
|
* Destroy the specified special memory pool. Verifies that there are no
|
|
* outstanding allocations.
|
|
*/
|
|
void gen_pool_destroy(struct gen_pool *pool)
|
|
{
|
|
struct list_head *_chunk, *_next_chunk;
|
|
struct gen_pool_chunk *chunk;
|
|
int order = pool->min_alloc_order;
|
|
int bit, end_bit;
|
|
|
|
|
|
list_for_each_safe(_chunk, _next_chunk, &pool->chunks) {
|
|
chunk = list_entry(_chunk, struct gen_pool_chunk, next_chunk);
|
|
list_del(&chunk->next_chunk);
|
|
|
|
end_bit = (chunk->end_addr - chunk->start_addr) >> order;
|
|
bit = find_next_bit(chunk->bits, end_bit, 0);
|
|
BUG_ON(bit < end_bit);
|
|
|
|
kfree(chunk);
|
|
}
|
|
kfree(pool);
|
|
return;
|
|
}
|
|
EXPORT_SYMBOL(gen_pool_destroy);
|
|
|
|
/**
|
|
* gen_pool_alloc - allocate special memory from the pool
|
|
* @pool: pool to allocate from
|
|
* @size: number of bytes to allocate from the pool
|
|
*
|
|
* Allocate the requested number of bytes from the specified pool.
|
|
* Uses a first-fit algorithm.
|
|
*/
|
|
unsigned long gen_pool_alloc(struct gen_pool *pool, size_t size)
|
|
{
|
|
struct list_head *_chunk;
|
|
struct gen_pool_chunk *chunk;
|
|
unsigned long addr, flags;
|
|
int order = pool->min_alloc_order;
|
|
int nbits, start_bit, end_bit;
|
|
|
|
if (size == 0)
|
|
return 0;
|
|
|
|
nbits = (size + (1UL << order) - 1) >> order;
|
|
|
|
read_lock(&pool->lock);
|
|
list_for_each(_chunk, &pool->chunks) {
|
|
chunk = list_entry(_chunk, struct gen_pool_chunk, next_chunk);
|
|
|
|
end_bit = (chunk->end_addr - chunk->start_addr) >> order;
|
|
end_bit -= nbits + 1;
|
|
|
|
spin_lock_irqsave(&chunk->lock, flags);
|
|
start_bit = bitmap_find_next_zero_area(chunk->bits, end_bit, 0,
|
|
nbits, 0);
|
|
if (start_bit >= end_bit) {
|
|
spin_unlock_irqrestore(&chunk->lock, flags);
|
|
continue;
|
|
}
|
|
|
|
addr = chunk->start_addr + ((unsigned long)start_bit << order);
|
|
|
|
bitmap_set(chunk->bits, start_bit, nbits);
|
|
spin_unlock_irqrestore(&chunk->lock, flags);
|
|
read_unlock(&pool->lock);
|
|
return addr;
|
|
}
|
|
read_unlock(&pool->lock);
|
|
return 0;
|
|
}
|
|
EXPORT_SYMBOL(gen_pool_alloc);
|
|
|
|
/**
|
|
* gen_pool_free - free allocated special memory back to the pool
|
|
* @pool: pool to free to
|
|
* @addr: starting address of memory to free back to pool
|
|
* @size: size in bytes of memory to free
|
|
*
|
|
* Free previously allocated special memory back to the specified pool.
|
|
*/
|
|
void gen_pool_free(struct gen_pool *pool, unsigned long addr, size_t size)
|
|
{
|
|
struct list_head *_chunk;
|
|
struct gen_pool_chunk *chunk;
|
|
unsigned long flags;
|
|
int order = pool->min_alloc_order;
|
|
int bit, nbits;
|
|
|
|
nbits = (size + (1UL << order) - 1) >> order;
|
|
|
|
read_lock(&pool->lock);
|
|
list_for_each(_chunk, &pool->chunks) {
|
|
chunk = list_entry(_chunk, struct gen_pool_chunk, next_chunk);
|
|
|
|
if (addr >= chunk->start_addr && addr < chunk->end_addr) {
|
|
BUG_ON(addr + size > chunk->end_addr);
|
|
spin_lock_irqsave(&chunk->lock, flags);
|
|
bit = (addr - chunk->start_addr) >> order;
|
|
while (nbits--)
|
|
__clear_bit(bit++, chunk->bits);
|
|
spin_unlock_irqrestore(&chunk->lock, flags);
|
|
break;
|
|
}
|
|
}
|
|
BUG_ON(nbits > 0);
|
|
read_unlock(&pool->lock);
|
|
}
|
|
EXPORT_SYMBOL(gen_pool_free);
|