Commit d9024df0 authored by Paul Mackerras's avatar Paul Mackerras
Browse files

[LMB] Restructure allocation loops to avoid unsigned underflow 



There is a potential bug in __lmb_alloc_base where we subtract `size'
from the base address of a reserved region without checking whether
the subtraction could wrap around and produce a very large unsigned
value.  In fact it probably isn't possible to hit the bug in practice
since it would only occur in the situation where we can't satisfy the
allocation request and there is a reserved region starting at 0.

This fixes the potential bug by breaking out of the loop when we get
to the point where the base of the reserved region is less than the
size requested.  This also restructures the loop to be a bit easier to
follow.

The same logic got copied into lmb_alloc_nid_unreserved, so this makes
a similar change there.  Here the bug is more likely to be hit because
the outer loop  (in lmb_alloc_nid) goes through the memory regions in
increasing order rather than decreasing order as __lmb_alloc_base
does, and we are therefore more likely to hit the case where we are
testing against a reserved region with a base address of 0.

Signed-off-by: default avatarPaul Mackerras <paulus@samba.org>
parent 300613e5

lib/lmb.c

+30 −26
Original line number Original line Diff line number Diff line
@@ -230,21 +230,24 @@ static u64 lmb_align_up(u64 addr, u64 size) 
static u64 __init lmb_alloc_nid_unreserved(u64 start, u64 end,

static u64 __init lmb_alloc_nid_unreserved(u64 start, u64 end,

					   u64 size, u64 align)

					   u64 size, u64 align)

{

{

	u64 base;

	u64 base, res_base;

	long j;

	long j;





	base = lmb_align_down((end - size), align);

	base = lmb_align_down((end - size), align);

	while (start <= base &&

	while (start <= base) {

	       ((j = lmb_overlaps_region(&lmb.reserved, base, size)) >= 0))

		j = lmb_overlaps_region(&lmb.reserved, base, size);

		base = lmb_align_down(lmb.reserved.region[j].base - size,

		if (j < 0) {

				      align);

			/* this area isn't reserved, take it */



	if (base != 0 && start <= base) {

			if (lmb_add_region(&lmb.reserved, base,

			if (lmb_add_region(&lmb.reserved, base,

					   lmb_align_up(size, align)) < 0)

					   lmb_align_up(size, align)) < 0)

				base = ~(u64)0;

				base = ~(u64)0;

			return base;

			return base;

		}

		}

		res_base = lmb.reserved.region[j].base;

		if (res_base < size)

			break;

		base = lmb_align_down(res_base - size, align);

	}





	return ~(u64)0;

	return ~(u64)0;

}

}
@@ -315,10 +318,12 @@ u64 __init __lmb_alloc_base(u64 size, u64 align, u64 max_addr) 
{

{

	long i, j;

	long i, j;

	u64 base = 0;

	u64 base = 0;

	u64 res_base;





	BUG_ON(0 == size);

	BUG_ON(0 == size);





	/* On some platforms, make sure we allocate lowmem */

	/* On some platforms, make sure we allocate lowmem */

	/* Note that LMB_REAL_LIMIT may be LMB_ALLOC_ANYWHERE */

	if (max_addr == LMB_ALLOC_ANYWHERE)

	if (max_addr == LMB_ALLOC_ANYWHERE)

		max_addr = LMB_REAL_LIMIT;

		max_addr = LMB_REAL_LIMIT;
@@ -326,6 +331,8 @@ u64 __init __lmb_alloc_base(u64 size, u64 align, u64 max_addr) 
		u64 lmbbase = lmb.memory.region[i].base;

		u64 lmbbase = lmb.memory.region[i].base;

		u64 lmbsize = lmb.memory.region[i].size;

		u64 lmbsize = lmb.memory.region[i].size;





		if (lmbsize < size)

			continue;

		if (max_addr == LMB_ALLOC_ANYWHERE)

		if (max_addr == LMB_ALLOC_ANYWHERE)

			base = lmb_align_down(lmbbase + lmbsize - size, align);

			base = lmb_align_down(lmbbase + lmbsize - size, align);

		else if (lmbbase < max_addr) {

		else if (lmbbase < max_addr) {
@@ -334,25 +341,22 @@ u64 __init __lmb_alloc_base(u64 size, u64 align, u64 max_addr) 
		} else

		} else

			continue;

			continue;





		while (lmbbase <= base) {

		while (base && lmbbase <= base) {

			j = lmb_overlaps_region(&lmb.reserved, base, size);

			j = lmb_overlaps_region(&lmb.reserved, base, size);

			if (j < 0)

			if (j < 0) {

				break;

				/* this area isn't reserved, take it */

			base = lmb_align_down(lmb.reserved.region[j].base - size,

				if (lmb_add_region(&lmb.reserved, base,

					      align);

						   size) < 0)

					return 0;

				return base;

			}

			}



			res_base = lmb.reserved.region[j].base;

		if ((base != 0) && (lmbbase <= base))

			if (res_base < size)

				break;

				break;

			base = lmb_align_down(res_base - size, align);

		}

	}

	}



	if (i < 0)

		return 0;



	if (lmb_add_region(&lmb.reserved, base, lmb_align_up(size, align)) < 0)

	return 0;

	return 0;



	return base;

}

}





/* You must call lmb_analyze() before this. */

/* You must call lmb_analyze() before this. */

CRA Git | Maintained and supported by SUSTech CRA and CCSE