Received-SPF: pass (google.com: domain of linux-kernel+bounces-174138-linux.lists.archive=gmail.com@vger.kernel.org designates 2604:1380:45d1:ec00::1 as permitted sender) client-ip=2604:1380:45d1:ec00::1;
Date: Wed, 8 May 2024 21:51:15 -0700
From: Christoph Hellwig <hch@infradead.org>
To: Hailong Liu <hailong.liu@oppo.com>
Cc: Gao Xiang <hsiangkao@linux.alibaba.com>, akpm@linux-foundation.org,
	Michal Hocko <mhocko@suse.com>, urezki@gmail.com, hch@infradead.org,
	lstoakes@gmail.com, 21cnbao@gmail.com, linux-mm@kvack.org,
	linux-kernel@vger.kernel.org, xiang@kernel.org, chao@kernel.org,
	Oven <liyangouwen1@oppo.com>
Subject: Re: [RFC PATCH] mm/vmalloc: fix vmalloc which may return null if
 called with __GFP_NOFAIL
Message-ID: <ZjxWQ1Cyx8fhMdKS@infradead.org>
References: <20240508125808.28882-1-hailong.liu@oppo.com>
 <404add29-2d3f-45db-9103-0c5b66fb254e@linux.alibaba.com>
 <20240508144321.ymnhn54daaabalhe@oppo.com>
 <90a127e5-d884-44b5-bb76-773a7485c2f1@linux.alibaba.com>
 <20240508153136.x4rxildsgza234uv@oppo.com>
 <52f9e300-4ab9-43c1-abae-cbe3da27e5b0@linux.alibaba.com>
 <20240509013059.vegko7dlty7vppy5@oppo.com>
Precedence: bulk
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Disposition: inline
Content-Transfer-Encoding: 8bit
In-Reply-To: <20240509013059.vegko7dlty7vppy5@oppo.com>

On Thu, May 09, 2024 at 09:30:59AM +0800, Hailong Liu wrote:
> I’m not suggesting that erofs would cause a memleak. What I mean is
> that if kvmalloc is invoked with __GFP_NOFAIL, it must ensure a non-NULL
> return, even in scenarios where memory leaks caused by other processes
> result in the inability to allocate a page. In such a situation, it
> should result in “Kernel panic - not syncing: System is deadlocked
> on memory”.

Yes.  __GFP_NOFAIL is a contract that says never ever return NULL.
The callers will generally not handle a NULL return and blindly
dereference it, leading to all kinds of nasty security issues.

Note that deadlocking would be nice, but at least it is just a
denial of service and not a possible privilege escalation.