From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id DC425C282DE for ; Mon, 10 Mar 2025 17:08:26 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id 48CCD28000B; Mon, 10 Mar 2025 13:08:25 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id 43CBE280004; Mon, 10 Mar 2025 13:08:25 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 2DF2928000B; Mon, 10 Mar 2025 13:08:25 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0010.hostedemail.com [216.40.44.10]) by kanga.kvack.org (Postfix) with ESMTP id 106BF280004 for ; Mon, 10 Mar 2025 13:08:25 -0400 (EDT) Received: from smtpin24.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay04.hostedemail.com (Postfix) with ESMTP id CD8DC1A123E for ; Mon, 10 Mar 2025 17:08:25 +0000 (UTC) X-FDA: 83206274970.24.49D7E13 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by imf16.hostedemail.com (Postfix) with ESMTP id 1DF66180011 for ; Mon, 10 Mar 2025 17:08:23 +0000 (UTC) Authentication-Results: imf16.hostedemail.com; dkim=pass header.d=kernel.org header.s=k20201202 header.b=dP64LCSw; spf=pass (imf16.hostedemail.com: domain of rppt@kernel.org designates 139.178.84.217 as permitted sender) smtp.mailfrom=rppt@kernel.org; dmarc=pass (policy=quarantine) header.from=kernel.org ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1741626504; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type:content-transfer-encoding: in-reply-to:in-reply-to:references:references:dkim-signature; bh=t2kgoLFT4qUSZ2F0yqgtgSevpsGwxq4Ha+KacT6rcOc=; b=kX/csWJBE+j5ZRXAA4YYzL0y0WBG5FGafCMCL+GYejfJNDXUpmSbfKwgvpEnARyDxae38Y DpR5S65/u2IM+v9BnE4B6u0vTmyn2PvVGZH3EWmk4DM6WSa1jEPfSGBfCu+VOx7890ao85 7A871JOZ6cxkEwfYwd4TaFIssTmhUSc= ARC-Authentication-Results: i=1; imf16.hostedemail.com; dkim=pass header.d=kernel.org header.s=k20201202 header.b=dP64LCSw; spf=pass (imf16.hostedemail.com: domain of rppt@kernel.org designates 139.178.84.217 as permitted sender) smtp.mailfrom=rppt@kernel.org; dmarc=pass (policy=quarantine) header.from=kernel.org ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1741626504; a=rsa-sha256; cv=none; b=KcZexnxGaGyYqU6rJkSVykcVPHfheb95bfXJQj/vM3BBHWWfl/8/sJDk3u6yYEQDtY/9K9 cZT94uEVeid/vy4IUGnXfIHgqDDT8v0MOpAB/jHg+2nkP0R2xvTi+Q1WNOFochEjZE/4cr lqDXO0KYjKHJ+uZWu4ER+Q8AWqzB7ig= Received: from smtp.kernel.org (transwarp.subspace.kernel.org [100.75.92.58]) by dfw.source.kernel.org (Postfix) with ESMTP id 4CB5E5C3EFD; Mon, 10 Mar 2025 17:06:06 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id BD209C4CEEB; Mon, 10 Mar 2025 17:08:11 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1741626502; bh=BDPwHEQJtDtD2d6bq3wswYDHcfGQePvakq3VHHuiDXk=; h=Date:From:To:Cc:Subject:References:In-Reply-To:From; b=dP64LCSwb0qvMdmxNsq4aBgEkKCWTngBOaUBShh/E456amPJ+27bT3yYrEE5Gbe2Y pF1oiiVL7+YWc6JNBHa7O2WtXGhJjTJsTLGJyLtE+bAmPCfq/3Pc4kAd9bqycwPSz5 Adjk1OWKoidmg9OiT3mJIBc1IgB4uMqcUHbsgzJ+KzsaRTD5TKEwDpPg4x9PsZvD/4 EZ7Q2cZdK8XAVDyjTOEv9MAuloiaC6ai4D/YMIbH2cPTCon/hLkqajOt3wbw54YP15 wU2ay6wa88LQr0FNFLZu5rhY2ee46XOCZ7yoC5WtWWFs0NwciIsHg/fMOPeT7J/JrC 2y2dbOxSiNHfA== Date: Mon, 10 Mar 2025 19:08:01 +0200 From: Mike Rapoport To: Pratyush Yadav Cc: linux-kernel@vger.kernel.org, Alexander Graf , Andrew Morton , Andy Lutomirski , Anthony Yznaga , Arnd Bergmann , Ashish Kalra , Benjamin Herrenschmidt , Borislav Petkov , Catalin Marinas , Dave Hansen , David Woodhouse , Eric Biederman , Ingo Molnar , James Gowans , Jonathan Corbet , Krzysztof Kozlowski , Mark Rutland , Paolo Bonzini , Pasha Tatashin , "H. Peter Anvin" , Peter Zijlstra , Rob Herring , Rob Herring , Saravana Kannan , Stanislav Kinsburskii , Steven Rostedt , Thomas Gleixner , Tom Lendacky , Usama Arif , Will Deacon , devicetree@vger.kernel.org, kexec@lists.infradead.org, linux-arm-kernel@lists.infradead.org, linux-doc@vger.kernel.org, linux-mm@kvack.org, x86@kernel.org Subject: Re: [PATCH v4 06/14] kexec: Add KHO parsing support Message-ID: References: <20250206132754.2596694-1-rppt@kernel.org> <20250206132754.2596694-7-rppt@kernel.org> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: X-Rspam-User: X-Rspamd-Queue-Id: 1DF66180011 X-Rspamd-Server: rspam03 X-Stat-Signature: 5urw5n3rs4h37tcghejs64fm1eghwcun X-HE-Tag: 1741626503-221862 X-HE-Meta: U2FsdGVkX19f6wOp0uYAx33/51nY8nk1EJ51apvLLjhnCptrdUoHnXE5I1vhIzQw6F+L2IyyDNojaWLuUhxVyfAA0lJJT8ob/ncQflyha1s7c3fPyT6z5BoRkeljQvtRqDM2I0RxeEZDtrXcqXBL+PzBNuoACUcmyRQu7l7TKRnV8P5rk7UZvHItAOCRYLt+CseaeskhbRtE8JZFIrJSAgqF8nE1mV5WCS/Fby+ijyYO4G2S8Rp2bmO0aOQjUr3++fXTLmktOzlQ9l6UrWCCWs0MIYSzVMXwtufYIoR4UuuprEulRz0SE0k5G5wkpb0+8qTS6+N0VthXtKJS0f9lTpYn7wkRhGeLggmkttYmpONwTbeLm2NDcbbZRjoUBj81pMQFMoMQsMHcdF6xJxvUQHEv05CWnZ5wm6NuHOJ4ercNB8M6bfgP587KxsRjzC957Dh8y7rXs8teWaZGSD1Wh84g6pXC6W1mzW5uhDiOpSrfSc2Gmaa+HVpJzuWLD6REGDgAmctM6vuECgyGDviFIzR4mi5eZNIVxwWPz1yGlfNCiySyyC/vMu0FG+Im0kz+At8p5J1EUOr4VIGLAMCMcrmcpTGg/hIvs5nhM1HbPtc7YqBNfWDQKMFVSQpkkX+gEZ8Jd0v+jXcbfNZRtUUktJnAfAPq9FfTizy2iWerh9n1WnJCV1+qE/3RQeWNLLBPyE3Fj2t3euryV7YUsbB/LC4eM5sHCxzO6e7BZqC+klaAtFbgKrsdPDrIgBc/3V95R7aCbRy+ese8i9z1tunIy9T9we6ve9WltqXLQnqORiHYHQv+SoNjiCy1mB1MKBFF25qjcQi62N3ai72/U0dOlw4GK06Ki827LasBal2iBUjeaiUL/EYyDDi6Y+E4FoK3gmyMru6KcqHXY+qV4E+nA3N+xPmk9nqnx0fPDgPPYOOAaDAQan+wiapqlmfV2xxyGtI3AAyZJRSU9AEN27p 1sZA+p0i l8f12Q/nr5w6vPVoCqAL61AA9/LfEQmyDhuBxMlP1mTz5hSxbOSmXtCgDAgN4ib9xfU9TUOVVKeDjHlaR387Mbmgj7MbdVcHwUEiyRqlYtqpQWDefHWDFd1/s9jQE//f1Ldp6DUL2MVUKjmthFwXQatKkYVRB5jMO3aBDhSWXTD7qRu8ZmtuqZssv/ZV8RhOEgEIGrVwQNlvFzExA5/N+i84820SnzbIKo8MMYsuDlaS+Pts1MkvvPb/kiJ4i670Z1jwPH/FNIfu0TB5+vtJ5c5Y8BwDBKCABvNtORzKejNc/xZy76LIY6h4PKtDK/ySrt0QaZOmwvPCAPmw= X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: List-Subscribe: List-Unsubscribe: Hi Pratyush, On Mon, Mar 10, 2025 at 04:20:01PM +0000, Pratyush Yadav wrote: > Hi Mike, > > On Thu, Feb 06 2025, Mike Rapoport wrote: > [...] > > @@ -444,7 +576,141 @@ static void kho_reserve_scratch(void) > > kho_enable = false; > > } > > > > +/* > > + * Scan the DT for any memory ranges and make sure they are reserved in > > + * memblock, otherwise they will end up in a weird state on free lists. > > + */ > > +static void kho_init_reserved_pages(void) > > +{ > > + const void *fdt = kho_get_fdt(); > > + int offset = 0, depth = 0, initial_depth = 0, len; > > + > > + if (!fdt) > > + return; > > + > > + /* Go through the mem list and add 1 for each reference */ > > + for (offset = 0; > > + offset >= 0 && depth >= initial_depth; > > + offset = fdt_next_node(fdt, offset, &depth)) { > > + const struct kho_mem *mems; > > + u32 i; > > + > > + mems = fdt_getprop(fdt, offset, "mem", &len); > > + if (!mems || len & (sizeof(*mems) - 1)) > > + continue; > > + > > + for (i = 0; i < len; i += sizeof(*mems)) { > > + const struct kho_mem *mem = &mems[i]; > > i goes from 0 to len in steps of 16, but you use it to dereference an > array of type struct kho_mem. So you end up only looking at only one of > every 16 mems and do an out of bounds access. I found this when testing > the memfd patches and any time the file was more than 1 page, it started > to crash randomly. Thanks! Changyuan already pointed that out privately. But I'm going to adopt the memory reservation scheme Jason proposed so this code is going to go away anyway :) > Below patch should fix that: > > ---- 8< ---- > diff --git a/kernel/kexec_handover.c b/kernel/kexec_handover.c > index c26753d613cbc..40d1d8ac68d44 100644 > --- a/kernel/kexec_handover.c > +++ b/kernel/kexec_handover.c > @@ -685,13 +685,15 @@ static void kho_init_reserved_pages(void) > offset >= 0 && depth >= initial_depth; > offset = fdt_next_node(fdt, offset, &depth)) { > const struct kho_mem *mems; > - u32 i; > + u32 i, nr_mems; > > mems = fdt_getprop(fdt, offset, "mem", &len); > if (!mems || len & (sizeof(*mems) - 1)) > continue; > > - for (i = 0; i < len; i += sizeof(*mems)) { > + nr_mems = len / sizeof(*mems); > + > + for (i = 0; i < nr_mems; i++) { > const struct kho_mem *mem = &mems[i]; > > memblock_reserve(mem->addr, mem->size); > ---- >8 ---- > [...] > > -- > Regards, > Pratyush Yadav -- Sincerely yours, Mike.