Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
Date:   Tue, 12 Apr 2022 14:22:38 -0700
From:   Andrew Morton <akpm@linux-foundation.org>
To:     lipeifeng@oppo.com
Cc:     michel@lespinasse.org, hughd@google.com, linux-mm@kvack.org,
        linux-kernel@vger.kernel.org, 21cnbao@gmail.com,
        zhangshiming@oppo.com
Subject: Re: [PATCH] mm: fix align-error when get_addr in
 unmapped_area_topdown
Message-Id: <20220412142238.93e36cc4095e4e0b362db348@linux-foundation.org>
In-Reply-To: <20220412081014.399-1-lipeifeng@oppo.com>
References: <20220412081014.399-1-lipeifeng@oppo.com>
Mime-Version: 1.0
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 7bit
Precedence: bulk

On Tue, 12 Apr 2022 16:10:14 +0800 lipeifeng@oppo.com wrote:

> From: lipeifeng <lipeifeng@oppo.com>
> 
> when we found a suitable gap_end(> info->high_limit), gap_end
> must be set to info->high_limit. And we will get the gap_end
> after computing highest gap address at the desired alignment.
> 
> 2096 found:
> 2097         if (gap_end > info->high_limit)
> 2098                 gap_end = info->high_limit;
> 2099
> 2100 found_highest:
> 2101         gap_end -= info->length;
> 2102         gap_end -= (gap_end - info->align_offset) & info->align_mask;
> 2103
> 2104         VM_BUG_ON(gap_end < info->low_limit);
> 2105         VM_BUG_ON(gap_end < gap_start);
> 2106         return gap_end;
> 
> so we must promise: info->high_limit - info->low_limit >=
> info->length + info->align_mask.
> Or in rare cases(info->high_limit - info->low_limit <
> info->length + info->align_mask) we will get the addr in
> align-error if found suitable gap_end(> info->high_limit).
> 

Thanks.

What are the runtime affects of this bug, and how are you able to
trigger it?

> --- a/mm/mmap.c
> +++ b/mm/mmap.c
> @@ -2009,7 +2009,6 @@ static unsigned long unmapped_area_topdown(struct vm_unmapped_area_info *info)
>  	if (length < info->length)
>  		return -ENOMEM;
>  
> -	length = info->length;
>  	/*
>  	 * Adjust search limits by the desired length.
>  	 * See implementation comment at top of unmapped_area().
> @@ -2021,6 +2020,8 @@ static unsigned long unmapped_area_topdown(struct vm_unmapped_area_info *info)
>  
>  	if (info->low_limit > high_limit)
>  		return -ENOMEM;
> +
> +	length = info->length;
>  	low_limit = info->low_limit + length;
>  
>  	/* Check highest gap, which does not precede any rbtree node */
> -- 
> 2.7.4