public inbox for linuxppc-dev@ozlabs.org 
 help / color / mirror / Atom feed
From: Nicholas Piggin <npiggin@gmail•com>
To: linuxppc-dev@lists•ozlabs.org
Cc: Nicholas Piggin <npiggin@gmail•com>,
	"Aneesh Kumar K . V" <aneesh.kumar@linux•vnet.ibm.com>,
	Florian Weimer <fweimer@redhat•com>
Subject: [PATCH 1/5] powerpc/64s/hash: Fix 128TB-512TB virtual address boundary case allocation
Date: Mon,  6 Nov 2017 21:03:11 +1100	[thread overview]
Message-ID: <20171106100315.29720-2-npiggin@gmail.com> (raw)
In-Reply-To: <20171106100315.29720-1-npiggin@gmail.com>

When allocating VA space with a hint that crosses 128TB, the SLB addr_limit
variable is not expanded if addr is not > 128TB, but the slice allocation
looks at task_size, which is 512TB. This results in slice_check_fit()
incorrectly succeeding because the slice_count truncates off bit 128 of the
requested mask, so the comparison to the available mask succeeds.

Fix this by using mm->context.addr_limit instead of mm->task_size for
testing allocation limits. This causes such allocations to fail.

Cc: "Aneesh Kumar K.V" <aneesh.kumar@linux•vnet.ibm.com>
Fixes: f4ea6dcb08 ("powerpc/mm: Enable mappings above 128TB")
Reported-by: Florian Weimer <fweimer@redhat•com>
Signed-off-by: Nicholas Piggin <npiggin@gmail•com>
---
 arch/powerpc/mm/slice.c | 11 ++++++-----
 1 file changed, 6 insertions(+), 5 deletions(-)

diff --git a/arch/powerpc/mm/slice.c b/arch/powerpc/mm/slice.c
index 45f6740dd407..567db541c0a1 100644
--- a/arch/powerpc/mm/slice.c
+++ b/arch/powerpc/mm/slice.c
@@ -96,7 +96,7 @@ static int slice_area_is_free(struct mm_struct *mm, unsigned long addr,
 {
 	struct vm_area_struct *vma;
 
-	if ((mm->task_size - len) < addr)
+	if ((mm->context.addr_limit - len) < addr)
 		return 0;
 	vma = find_vma(mm, addr);
 	return (!vma || (addr + len) <= vm_start_gap(vma));
@@ -133,7 +133,7 @@ static void slice_mask_for_free(struct mm_struct *mm, struct slice_mask *ret)
 		if (!slice_low_has_vma(mm, i))
 			ret->low_slices |= 1u << i;
 
-	if (mm->task_size <= SLICE_LOW_TOP)
+	if (mm->context.addr_limit <= SLICE_LOW_TOP)
 		return;
 
 	for (i = 0; i < GET_HIGH_SLICE_INDEX(mm->context.addr_limit); i++)
@@ -446,19 +446,20 @@ unsigned long slice_get_unmapped_area(unsigned long addr, unsigned long len,
 
 	/* Sanity checks */
 	BUG_ON(mm->task_size == 0);
+	BUG_ON(mm->context.addr_limit == 0);
 	VM_BUG_ON(radix_enabled());
 
 	slice_dbg("slice_get_unmapped_area(mm=%p, psize=%d...\n", mm, psize);
 	slice_dbg(" addr=%lx, len=%lx, flags=%lx, topdown=%d\n",
 		  addr, len, flags, topdown);
 
-	if (len > mm->task_size)
+	if (len > mm->context.addr_limit)
 		return -ENOMEM;
 	if (len & ((1ul << pshift) - 1))
 		return -EINVAL;
 	if (fixed && (addr & ((1ul << pshift) - 1)))
 		return -EINVAL;
-	if (fixed && addr > (mm->task_size - len))
+	if (fixed && addr > (mm->context.addr_limit - len))
 		return -ENOMEM;
 
 	/* If hint, make sure it matches our alignment restrictions */
@@ -466,7 +467,7 @@ unsigned long slice_get_unmapped_area(unsigned long addr, unsigned long len,
 		addr = _ALIGN_UP(addr, 1ul << pshift);
 		slice_dbg(" aligned addr=%lx\n", addr);
 		/* Ignore hint if it's too large or overlaps a VMA */
-		if (addr > mm->task_size - len ||
+		if (addr > mm->context.addr_limit - len ||
 		    !slice_area_is_free(mm, addr, len))
 			addr = 0;
 	}
-- 
2.15.0

  reply	other threads:[~2017-11-06 10:03 UTC|newest]

Thread overview: 22+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2017-11-06 10:03 [PATCH 0/5] VA allocator fixes Nicholas Piggin
2017-11-06 10:03 ` Nicholas Piggin [this message]
2017-11-06 10:38   ` [PATCH 1/5] powerpc/64s/hash: Fix 128TB-512TB virtual address boundary case allocation Aneesh Kumar K.V
2017-11-06 10:54     ` Nicholas Piggin
2017-11-06 11:05       ` Aneesh Kumar K.V
2017-11-06 11:21         ` Nicholas Piggin
2017-11-07  2:00         ` Aneesh Kumar K.V
2017-11-07  2:03           ` Nicholas Piggin
2017-11-06 10:03 ` [PATCH 2/5] powerpc/64s/hash: Allow MAP_FIXED allocations to cross 128TB boundary Nicholas Piggin
2017-11-06 10:44   ` Aneesh Kumar K.V
2017-11-06 11:55     ` Nicholas Piggin
2017-11-07  2:28       ` Michael Ellerman
2017-11-07  2:52         ` Nicholas Piggin
2017-11-06 10:03 ` [PATCH 3/5] powerpc/64s/hash: Fix fork() with 512TB process address space Nicholas Piggin
2017-11-06 10:44   ` Aneesh Kumar K.V
2017-11-06 10:03 ` [PATCH 4/5] powerpc/64s/radix: Fix 128TB-512TB virtual address boundary case allocation Nicholas Piggin
2017-11-06 11:14   ` Aneesh Kumar K.V
2017-11-06 11:42     ` Nicholas Piggin
2017-11-06 10:03 ` [PATCH 5/5] powerpc/64s: mm_context.addr_limit is only used on hash Nicholas Piggin
2017-11-06 15:16 ` [PATCH 0/5] VA allocator fixes Florian Weimer
2017-11-07  0:06   ` Nicholas Piggin
2017-11-07  1:59     ` Aneesh Kumar K.V

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20171106100315.29720-2-npiggin@gmail.com \
    --to=npiggin@gmail$(echo .)com \
    --cc=aneesh.kumar@linux$(echo .)vnet.ibm.com \
    --cc=fweimer@redhat$(echo .)com \
    --cc=linuxppc-dev@lists$(echo .)ozlabs.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox