2023-05-27 12:38:27

by Zhen Lei

[permalink] [raw]
Subject: [PATCH 1/6] kexec: fix a memory leak in crash_shrink_memory()

If the value of parameter 'new_size' is in the semi-open and semi-closed
interval (crashk_res.end - KEXEC_CRASH_MEM_ALIGN + 1, crashk_res.end], the
calculation result of ram_res is:
ram_res->start = crashk_res.end + 1
ram_res->end = crashk_res.end
The operation of function insert_resource() fails, and ram_res is not
added to iomem_resource. As a result, the memory of the control block
ram_res is leaked.

In fact, on all architectures, the start address and size of crashk_res
are already aligned by KEXEC_CRASH_MEM_ALIGN. Therefore, we do not need to
round up crashk_res.start again. Instead, we should round up 'new_size'
in advance.

Fixes: 6480e5a09237 ("kdump: add missing RAM resource in crash_shrink_memory()")
Fixes: 06a7f711246b ("kexec: premit reduction of the reserved memory size")
Signed-off-by: Zhen Lei <[email protected]>
---
kernel/kexec_core.c | 5 ++---
1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/kernel/kexec_core.c b/kernel/kexec_core.c
index 3d578c6fefee385..22acee18195a591 100644
--- a/kernel/kexec_core.c
+++ b/kernel/kexec_core.c
@@ -1122,6 +1122,7 @@ int crash_shrink_memory(unsigned long new_size)
start = crashk_res.start;
end = crashk_res.end;
old_size = (end == 0) ? 0 : end - start + 1;
+ new_size = roundup(new_size, KEXEC_CRASH_MEM_ALIGN);
if (new_size >= old_size) {
ret = (new_size == old_size) ? 0 : -EINVAL;
goto unlock;
@@ -1133,9 +1134,7 @@ int crash_shrink_memory(unsigned long new_size)
goto unlock;
}

- start = roundup(start, KEXEC_CRASH_MEM_ALIGN);
- end = roundup(start + new_size, KEXEC_CRASH_MEM_ALIGN);
-
+ end = start + new_size;
crash_free_reserved_phys_range(end, crashk_res.end);

if ((start == end) && (crashk_res.parent != NULL))
--
2.25.1



2023-05-31 00:34:44

by Baoquan He

[permalink] [raw]
Subject: Re: [PATCH 1/6] kexec: fix a memory leak in crash_shrink_memory()

On 05/27/23 at 08:34pm, Zhen Lei wrote:
> If the value of parameter 'new_size' is in the semi-open and semi-closed
> interval (crashk_res.end - KEXEC_CRASH_MEM_ALIGN + 1, crashk_res.end], the
> calculation result of ram_res is:
> ram_res->start = crashk_res.end + 1
> ram_res->end = crashk_res.end

If the new_size is smaller than KEXEC_CRASH_MEM_ALIGN, does it make
any sense except of testing purpose? Do we need to fail this kind of
shrinking, or just shrink all the left crash memory?

> The operation of function insert_resource() fails, and ram_res is not
> added to iomem_resource. As a result, the memory of the control block
> ram_res is leaked.
>
> In fact, on all architectures, the start address and size of crashk_res
> are already aligned by KEXEC_CRASH_MEM_ALIGN. Therefore, we do not need to
> round up crashk_res.start again. Instead, we should round up 'new_size'
> in advance.
>
> Fixes: 6480e5a09237 ("kdump: add missing RAM resource in crash_shrink_memory()")
> Fixes: 06a7f711246b ("kexec: premit reduction of the reserved memory size")
> Signed-off-by: Zhen Lei <[email protected]>
> ---
> kernel/kexec_core.c | 5 ++---
> 1 file changed, 2 insertions(+), 3 deletions(-)
>
> diff --git a/kernel/kexec_core.c b/kernel/kexec_core.c
> index 3d578c6fefee385..22acee18195a591 100644
> --- a/kernel/kexec_core.c
> +++ b/kernel/kexec_core.c
> @@ -1122,6 +1122,7 @@ int crash_shrink_memory(unsigned long new_size)
> start = crashk_res.start;
> end = crashk_res.end;
> old_size = (end == 0) ? 0 : end - start + 1;
> + new_size = roundup(new_size, KEXEC_CRASH_MEM_ALIGN);
> if (new_size >= old_size) {
> ret = (new_size == old_size) ? 0 : -EINVAL;
> goto unlock;
> @@ -1133,9 +1134,7 @@ int crash_shrink_memory(unsigned long new_size)
> goto unlock;
> }
>
> - start = roundup(start, KEXEC_CRASH_MEM_ALIGN);
> - end = roundup(start + new_size, KEXEC_CRASH_MEM_ALIGN);
> -
> + end = start + new_size;
> crash_free_reserved_phys_range(end, crashk_res.end);
>
> if ((start == end) && (crashk_res.parent != NULL))
> --
> 2.25.1
>


2023-05-31 01:20:20

by Zhen Lei

[permalink] [raw]
Subject: Re: [PATCH 1/6] kexec: fix a memory leak in crash_shrink_memory()



On 2023/5/31 8:13, Baoquan He wrote:
> On 05/27/23 at 08:34pm, Zhen Lei wrote:
>> If the value of parameter 'new_size' is in the semi-open and semi-closed
>> interval (crashk_res.end - KEXEC_CRASH_MEM_ALIGN + 1, crashk_res.end], the
>> calculation result of ram_res is:
>> ram_res->start = crashk_res.end + 1
>> ram_res->end = crashk_res.end
>
> If the new_size is smaller than KEXEC_CRASH_MEM_ALIGN, does it make
> any sense except of testing purpose? Do we need to fail this kind of
> shrinking, or just shrink all the left crash memory?

We can't give a fixed value, that is, how much crash memory is reserved to
ensure that the capture kernel runs. The size of KEXEC_CRASH_MEM_ALIGN is
only one page on non-s390 platforms. So, it's better to keep the code simple,
and let the user(administrator) shrink the crash memory reasonably.

include/linux/kexec.h
#define KEXEC_CRASH_MEM_ALIGN PAGE_SIZE

>
>> The operation of function insert_resource() fails, and ram_res is not
>> added to iomem_resource. As a result, the memory of the control block
>> ram_res is leaked.
>>
>> In fact, on all architectures, the start address and size of crashk_res
>> are already aligned by KEXEC_CRASH_MEM_ALIGN. Therefore, we do not need to
>> round up crashk_res.start again. Instead, we should round up 'new_size'
>> in advance.
>>
>> Fixes: 6480e5a09237 ("kdump: add missing RAM resource in crash_shrink_memory()")
>> Fixes: 06a7f711246b ("kexec: premit reduction of the reserved memory size")
>> Signed-off-by: Zhen Lei <[email protected]>
>> ---
>> kernel/kexec_core.c | 5 ++---
>> 1 file changed, 2 insertions(+), 3 deletions(-)
>>
>> diff --git a/kernel/kexec_core.c b/kernel/kexec_core.c
>> index 3d578c6fefee385..22acee18195a591 100644
>> --- a/kernel/kexec_core.c
>> +++ b/kernel/kexec_core.c
>> @@ -1122,6 +1122,7 @@ int crash_shrink_memory(unsigned long new_size)
>> start = crashk_res.start;
>> end = crashk_res.end;
>> old_size = (end == 0) ? 0 : end - start + 1;
>> + new_size = roundup(new_size, KEXEC_CRASH_MEM_ALIGN);
>> if (new_size >= old_size) {
>> ret = (new_size == old_size) ? 0 : -EINVAL;
>> goto unlock;
>> @@ -1133,9 +1134,7 @@ int crash_shrink_memory(unsigned long new_size)
>> goto unlock;
>> }
>>
>> - start = roundup(start, KEXEC_CRASH_MEM_ALIGN);
>> - end = roundup(start + new_size, KEXEC_CRASH_MEM_ALIGN);
>> -
>> + end = start + new_size;
>> crash_free_reserved_phys_range(end, crashk_res.end);
>>
>> if ((start == end) && (crashk_res.parent != NULL))
>> --
>> 2.25.1
>>
>
> .
>

--
Regards,
Zhen Lei

2023-05-31 07:50:21

by Baoquan He

[permalink] [raw]
Subject: Re: [PATCH 1/6] kexec: fix a memory leak in crash_shrink_memory()

On 05/31/23 at 09:16am, Leizhen (ThunderTown) wrote:
>
>
> On 2023/5/31 8:13, Baoquan He wrote:
> > On 05/27/23 at 08:34pm, Zhen Lei wrote:
> >> If the value of parameter 'new_size' is in the semi-open and semi-closed
> >> interval (crashk_res.end - KEXEC_CRASH_MEM_ALIGN + 1, crashk_res.end], the
> >> calculation result of ram_res is:
> >> ram_res->start = crashk_res.end + 1
> >> ram_res->end = crashk_res.end
> >
> > If the new_size is smaller than KEXEC_CRASH_MEM_ALIGN, does it make
> > any sense except of testing purpose? Do we need to fail this kind of
> > shrinking, or just shrink all the left crash memory?

OK, I misread your log. You are saying the new_size is close to
crashk_res.end but has a tiny difference in your example, I
thought the new_size is smaller than KEXEC_CRASH_MEM_ALIGN which is just
in the opposite direction.

Yea, it does have the possibility to waste a ram_res but does nothing
even though the chance is very small.

Acked-by: Baoquan He <[email protected]>

>
> We can't give a fixed value, that is, how much crash memory is reserved to
> ensure that the capture kernel runs. The size of KEXEC_CRASH_MEM_ALIGN is
> only one page on non-s390 platforms. So, it's better to keep the code simple,
> and let the user(administrator) shrink the crash memory reasonably.
>
> include/linux/kexec.h
> #define KEXEC_CRASH_MEM_ALIGN PAGE_SIZE

>
> >
> >> The operation of function insert_resource() fails, and ram_res is not
> >> added to iomem_resource. As a result, the memory of the control block
> >> ram_res is leaked.
> >>
> >> In fact, on all architectures, the start address and size of crashk_res
> >> are already aligned by KEXEC_CRASH_MEM_ALIGN. Therefore, we do not need to
> >> round up crashk_res.start again. Instead, we should round up 'new_size'
> >> in advance.
> >>
> >> Fixes: 6480e5a09237 ("kdump: add missing RAM resource in crash_shrink_memory()")
> >> Fixes: 06a7f711246b ("kexec: premit reduction of the reserved memory size")
> >> Signed-off-by: Zhen Lei <[email protected]>
> >> ---
> >> kernel/kexec_core.c | 5 ++---
> >> 1 file changed, 2 insertions(+), 3 deletions(-)
> >>
> >> diff --git a/kernel/kexec_core.c b/kernel/kexec_core.c
> >> index 3d578c6fefee385..22acee18195a591 100644
> >> --- a/kernel/kexec_core.c
> >> +++ b/kernel/kexec_core.c
> >> @@ -1122,6 +1122,7 @@ int crash_shrink_memory(unsigned long new_size)
> >> start = crashk_res.start;
> >> end = crashk_res.end;
> >> old_size = (end == 0) ? 0 : end - start + 1;
> >> + new_size = roundup(new_size, KEXEC_CRASH_MEM_ALIGN);
> >> if (new_size >= old_size) {
> >> ret = (new_size == old_size) ? 0 : -EINVAL;
> >> goto unlock;
> >> @@ -1133,9 +1134,7 @@ int crash_shrink_memory(unsigned long new_size)
> >> goto unlock;
> >> }
> >>
> >> - start = roundup(start, KEXEC_CRASH_MEM_ALIGN);
> >> - end = roundup(start + new_size, KEXEC_CRASH_MEM_ALIGN);
> >> -
> >> + end = start + new_size;
> >> crash_free_reserved_phys_range(end, crashk_res.end);
> >>
> >> if ((start == end) && (crashk_res.parent != NULL))
> >> --
> >> 2.25.1
> >>
> >
> > .
> >
>
> --
> Regards,
> Zhen Lei
>