Commit c2af060d authored by Duoming Zhou's avatar Duoming Zhou Committed by Andrew Morton
Browse files

lib/test_hmm.c: handle src_pfns and dst_pfns allocation failure 

The kcalloc() in dmirror_device_evict_chunk() will return null if the
physical memory has run out.  As a result, if src_pfns or dst_pfns is
dereferenced, the null pointer dereference bug will happen.

Moreover, the device is going away.  If the kcalloc() fails, the pages
mapping a chunk could not be evicted.  So add a __GFP_NOFAIL flag in
kcalloc().

Finally, as there is no need to have physically contiguous memory, Switch
kcalloc() to kvcalloc() in order to avoid failing allocations.

Link: https://lkml.kernel.org/r/20240312005905.9939-1-duoming@zju.edu.cn


Fixes: b2ef9f5a ("mm/hmm/test: add selftest driver for HMM")
Signed-off-by: default avatarDuoming Zhou <duoming@zju.edu.cn>
Cc: Jérôme Glisse <jglisse@redhat.com>
Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
parent 4196b48d

lib/test_hmm.c

+4 −4
Original line number Diff line number Diff line
@@ -1226,8 +1226,8 @@ static void dmirror_device_evict_chunk(struct dmirror_chunk *chunk) 
	unsigned long *src_pfns;

	unsigned long *dst_pfns;



	src_pfns = kcalloc(npages, sizeof(*src_pfns), GFP_KERNEL);

	dst_pfns = kcalloc(npages, sizeof(*dst_pfns), GFP_KERNEL);

	src_pfns = kvcalloc(npages, sizeof(*src_pfns), GFP_KERNEL | __GFP_NOFAIL);

	dst_pfns = kvcalloc(npages, sizeof(*dst_pfns), GFP_KERNEL | __GFP_NOFAIL);



	migrate_device_range(src_pfns, start_pfn, npages);

	for (i = 0; i < npages; i++) {
@@ -1250,8 +1250,8 @@ static void dmirror_device_evict_chunk(struct dmirror_chunk *chunk) 
	}

	migrate_device_pages(src_pfns, dst_pfns, npages);

	migrate_device_finalize(src_pfns, dst_pfns, npages);

	kfree(src_pfns);

	kfree(dst_pfns);

	kvfree(src_pfns);

	kvfree(dst_pfns);

}



/* Removes free pages from the free list so they can't be re-allocated */