Skip to contentSkip to conversation

pstore/ram: Fix crash when setting number of cpus to an odd number

PATCH Applied Weichen Chen 5 participants 5 messages Feb 24, 2023 – Nov 8, 2023 Pstore filesystem

lore
Share & tools
lore

Weichen Chen

author
#0 lore raw

PATCH 1/1 pstore/ram: Fix crash when setting number of cpus to an odd number

When the number of cpu cores is adjusted to 7 or other odd numbers, the zone size will become an odd number.
The address of the zone will become:
addr of zone0 = BASE
addr of zone1 = BASE + zone_size
addr of zone2 = BASE + zone_size*2
...
The address of zone1/3/5/7 will be mapped to non-alignment va. Eventually crashes will occur when accessing these va.

So, use ALIGN_DOWN() to make sure the zone size is even to avoid this bug.

Signed-off-by Weichen Chen <[email protected]>
---
 fs/pstore/ram.c | 1 +
 1 file changed, 1 insertion(+)
fs/pstore/ram.c +1 -0
index ade66dbe5f39..fc57ac97e506 100644
@@ -528,6 +528,7 @@ static int ramoops_init_przs(const char *name,
 	}
 
 	zone_sz = mem_sz / *cnt;
+	zone_sz = ALIGN_DOWN(zone_sz, 2);
 	if (!zone_sz) {
 		dev_err(dev, "%s zone size == 0\n", name);
 		goto fail;
Signature · 1 line
2.18.0
reviewer Tested-by on v1 1/1
#1 lore raw
Quoted 23 lines · Weichen Chen

When the number of cpu cores is adjusted to 7 or other odd numbers, the zone size will become an odd number.
The address of the zone will become:
addr of zone0 = BASE
addr of zone1 = BASE + zone_size
addr of zone2 = BASE + zone_size*2
...
The address of zone1/3/5/7 will be mapped to non-alignment va. Eventually crashes will occur when accessing these va.

So, use ALIGN_DOWN() to make sure the zone size is even to avoid this bug.

Signed-off-by Weichen Chen <[email protected]>
---
 fs/pstore/ram.c | 1 +
 1 file changed, 1 insertion(+)
fs/pstore/ram.c +0 -0
index ade66dbe5f39..fc57ac97e506 100644

fs/pstore/ram.c static int ramoops_init_przs(const char *name, · line 534

Quoted 7 lines
fs/pstore/ram.c +1 -0
@@ -528,6 +528,7 @@ static int ramoops_init_przs(const char *name,
 	}
 
 	zone_sz = mem_sz / *cnt;
+	zone_sz = ALIGN_DOWN(zone_sz, 2);
 	if (!zone_sz) {
 		dev_err(dev, "%s zone size == 0\n", name);
 		goto fail;

Thanks for resending! Feel free to add my:

Tested-by Guilherme G. Piccoli <[email protected]>

Cheers,

Guilherme

Reviewed-by
#2 lore raw
Quoted 34 lines · Guilherme G. Piccoli
Quoted 23 lines · Weichen Chen

When the number of cpu cores is adjusted to 7 or other odd numbers, the zone size will become an odd number.
The address of the zone will become:
addr of zone0 = BASE
addr of zone1 = BASE + zone_size
addr of zone2 = BASE + zone_size*2
...
The address of zone1/3/5/7 will be mapped to non-alignment va. Eventually crashes will occur when accessing these va.

So, use ALIGN_DOWN() to make sure the zone size is even to avoid this bug.

Signed-off-by Weichen Chen <[email protected]>
---
  fs/pstore/ram.c | 1 +
  1 file changed, 1 insertion(+)
fs/pstore/ram.c +0 -0
index ade66dbe5f39..fc57ac97e506 100644

fs/pstore/ram.c static int ramoops_init_przs(const char *name, · line 534

Quoted 7 lines
fs/pstore/ram.c +1 -0
@@ -528,6 +528,7 @@ static int ramoops_init_przs(const char *name,
  	}
 
  	zone_sz = mem_sz / *cnt;
+	zone_sz = ALIGN_DOWN(zone_sz, 2);
  	if (!zone_sz) {
  		dev_err(dev, "%s zone size == 0\n", name);
  		goto fail;

Thanks for resending! Feel free to add my:

Quoted 2 lines
Tested-by Guilherme G. Piccoli <[email protected]>
Reviewed-by Matthias Brugger <[email protected]>

I gave that yesterday, but Weichen Chen seems to have forgotten about it.

Regards,
Matthias

#3 lore raw
In reply to Weichen Chen
Quoted 24 lines · Weichen Chen

When the number of cpu cores is adjusted to 7 or other odd numbers, the zone size will become an odd number.
The address of the zone will become:
    addr of zone0 = BASE
    addr of zone1 = BASE + zone_size
    addr of zone2 = BASE + zone_size*2
    ...
The address of zone1/3/5/7 will be mapped to non-alignment va. Eventually crashes will occur when accessing these va.

So, use ALIGN_DOWN() to make sure the zone size is even to avoid this bug.

Signed-off-by Weichen Chen <[email protected]>

---
 fs/pstore/ram.c | 1 +

 1 file changed, 1 insertion(+)
fs/pstore/ram.c +0 -0
index ade66dbe5f39..fc57ac97e506 100644
@@ -528,6 +528,7 @@ static int ramoops_init_przs(const char *name,
         }
Quoted 6 lines


        zone_sz = mem_sz / *cnt;
+       zone_sz = ALIGN_DOWN(zone_sz, 2);
        if (!zone_sz) {
                dev_err(dev, "%s zone size == 0\n", name); goto fail;

Might want to Cc this to the stable mailing list.

Signature · 1 line
~miko
Applied
#4 lore raw
In reply to Weichen Chen
Quoted 11 lines · Weichen Chen

When the number of cpu cores is adjusted to 7 or other odd numbers, the zone size will become an odd number.
The address of the zone will become:
addr of zone0 = BASE
addr of zone1 = BASE + zone_size
addr of zone2 = BASE + zone_size*2
...
The address of zone1/3/5/7 will be mapped to non-alignment va. Eventually crashes will occur when accessing these va.

[...]

Applied to for-next/pstore, thanks!

[1/1] pstore/ram: Fix crash when setting number of cpus to an odd number

      https://git.kernel.org/kees/c/1d49dee6b691

Take care,

Signature · 1 line
Kees Cook