Re: [PATCH] slub: Potential stack overflow

[Eric Dumazet]

Le mercredi 24 mars 2010 Ã 14:49 -0500, Christoph Lameter a Ãcrit :
> On Wed, 24 Mar 2010, Eric Dumazet wrote:
> 
> > Are we allowed to nest in these two functions ?
> 
> This is kmem_cache_close() no danger of nesting.
> 
> > These are debugging functions, what happens if kmalloc() returns NULL ?
> 
> Then you return ENOMEM and the user gets an error. We already do that in
> validate_slab_cache().
> 
> Hmmm... In this case we called from list_slab_objects() which gets called
> from free_partial() (which took a spinlock!) which gets called from
> kmem_cache_close().
> 
> Its just a debugging aid so no problem if it fails. GFP_ATOMIC?

OK, here is second version of the patch, thanks !


[PATCH] slub: Potential stack overflow

I discovered that we can overflow stack if CONFIG_SLUB_DEBUG=y and use
slabs with many objects, since list_slab_objects() and process_slab()
use DECLARE_BITMAP(map, page->objects);

With 65535 bits, we use 8192 bytes of stack ...

A possible solution is to allocate memory, using GFP_ATOMIC, and do
nothing if allocation fails.

Signed-off-by: Eric Dumazet <eric.dumazet@xxxxxxxxx>
---
diff --git a/mm/slub.c b/mm/slub.c
index b364844..5ee857a 100644
--- a/mm/slub.c
+++ b/mm/slub.c
@@ -2426,9 +2426,11 @@ static void list_slab_objects(struct kmem_cache *s, struct page *page,
 #ifdef CONFIG_SLUB_DEBUG
 	void *addr = page_address(page);
 	void *p;
-	DECLARE_BITMAP(map, page->objects);
+	long *map = kzalloc(BITS_TO_LONGS(page->objects) * sizeof(long),
+			    GFP_ATOMIC);
 
-	bitmap_zero(map, page->objects);
+	if (!map)
+		return;
 	slab_err(s, page, "%s", text);
 	slab_lock(page);
 	for_each_free_object(p, s, page->freelist)
@@ -2443,6 +2445,7 @@ static void list_slab_objects(struct kmem_cache *s, struct page *page,
 		}
 	}
 	slab_unlock(page);
+	kfree(map);
 #endif
 }
 
@@ -3651,16 +3654,19 @@ static void process_slab(struct loc_track *t, struct kmem_cache *s,
 		struct page *page, enum track_item alloc)
 {
 	void *addr = page_address(page);
-	DECLARE_BITMAP(map, page->objects);
+	long *map = kzalloc(BITS_TO_LONGS(page->objects) * sizeof(long),
+			    GFP_ATOMIC);
 	void *p;
 
-	bitmap_zero(map, page->objects);
+	if (!map)
+		return;
 	for_each_free_object(p, s, page->freelist)
 		set_bit(slab_index(p, s, addr), map);
 
 	for_each_object(p, s, addr, page->objects)
 		if (!test_bit(slab_index(p, s, addr), map))
 			add_location(t, s, get_track(s, p, alloc));
+	kfree(map);
 }
 
 static int list_locations(struct kmem_cache *s, char *buf,


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/