Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1657343 > unrolled thread

[PATCH v2] vmalloc: show more detail info in vmallocinfo for clarify

Back to article view | Back to linux.kernel

Contents

  [PATCH v2] vmalloc: show more detail info in vmallocinfo for clarify Yisheng Xie <xieyisheng1@huawei.com> - 2017-06-05 10:20 +0200
    Re: [PATCH v2] vmalloc: show more detail info in vmallocinfo for  clarify Andrew Morton <akpm@linux-foundation.org> - 2017-06-06 00:20 +0200

#1657343 — [PATCH v2] vmalloc: show more detail info in vmallocinfo for clarify

When ioremap a 67112960 bytes vm_area with the vmallocinfo:
 [..]
 0xec79b000-0xec7fa000  389120 ftl_add_mtd+0x4d0/0x754 pages=94 vmalloc
 0xec800000-0xecbe1000 4067328 kbox_proc_mem_write+0x104/0x1c4 phys=8b520000 ioremap

we get the result:
 0xf1000000-0xf5001000 67112960 devm_ioremap+0x38/0x7c phys=40000000 ioremap

For the align for ioremap must be less than '1 << IOREMAP_MAX_ORDER':
	if (flags & VM_IOREMAP)
		align = 1ul << clamp_t(int, get_count_order_long(size),
			PAGE_SHIFT, IOREMAP_MAX_ORDER);

So it makes idiot like me a litter puzzle why jump the vm_area from
0xec800000-0xecbe1000 to 0xf1000000-0xf5001000, and leave
0xed000000-0xf1000000 as a big hole.

This is to show all of vm_area, including which is freeing but still in
vmap_area_list, to make it more clear about why we will get
0xf1000000-0xf5001000 int the above case. And we will get the
vmallocinfo like:
 [..]
 0xec79b000-0xec7fa000  389120 ftl_add_mtd+0x4d0/0x754 pages=94 vmalloc
 0xec800000-0xecbe1000 4067328 kbox_proc_mem_write+0x104/0x1c4 phys=8b520000 ioremap
 [..]
 0xece7c000-0xece7e000    8192 unpurged vm_area
 0xece7e000-0xece83000   20480 vm_map_ram
 0xf0099000-0xf00aa000   69632 vm_map_ram
after apply this patch.

Signed-off-by: Yisheng Xie <xieyisheng1@huawei.com>
---
v2:
 - changed "freeing vm_area" to "unpurged vm_area" to be clearer  - Tim

 mm/vmalloc.c | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/mm/vmalloc.c b/mm/vmalloc.c
index 34a1c3e..6ef021f 100644
--- a/mm/vmalloc.c
+++ b/mm/vmalloc.c
@@ -314,6 +314,7 @@ unsigned long vmalloc_to_pfn(const void *vmalloc_addr)
 
 /*** Global kva allocator ***/
 
+#define VM_LAZY_FREE	0x02
 #define VM_VM_AREA	0x04
 
 static DEFINE_SPINLOCK(vmap_area_lock);
@@ -1486,6 +1487,7 @@ struct vm_struct *remove_vm_area(const void *addr)
 		spin_lock(&vmap_area_lock);
 		va->vm = NULL;
 		va->flags &= ~VM_VM_AREA;
+		va->flags |= VM_LAZY_FREE;
 		spin_unlock(&vmap_area_lock);
 
 		vmap_debug_free_range(va->va_start, va->va_end);
@@ -2698,8 +2700,14 @@ static int s_show(struct seq_file *m, void *p)
 	 * s_show can encounter race with remove_vm_area, !VM_VM_AREA on
 	 * behalf of vmap area is being tear down or vm_map_ram allocation.
 	 */
-	if (!(va->flags & VM_VM_AREA))
+	if (!(va->flags & VM_VM_AREA)) {
+		seq_printf(m, "0x%pK-0x%pK %7ld %s\n",
+			(void *)va->va_start, (void *)va->va_end,
+			va->va_end - va->va_start,
+			va->flags & VM_LAZY_FREE ? "unpurged vm_area" : "vm_map_ram");
+
 		return 0;
+	}
 
 	v = va->vm;
 
-- 
1.7.12.4

[toc] | [next] | [standalone]

#1658182 — Re: [PATCH v2] vmalloc: show more detail info in vmallocinfo for clarify

On Mon, 5 Jun 2017 16:01:22 +0800 Yisheng Xie <xieyisheng1@huawei.com> wrote:

> When ioremap a 67112960 bytes vm_area with the vmallocinfo:
>  [..]
>  0xec79b000-0xec7fa000  389120 ftl_add_mtd+0x4d0/0x754 pages=94 vmalloc
>  0xec800000-0xecbe1000 4067328 kbox_proc_mem_write+0x104/0x1c4 phys=8b520000 ioremap
> 
> we get the result:
>  0xf1000000-0xf5001000 67112960 devm_ioremap+0x38/0x7c phys=40000000 ioremap
> 
> For the align for ioremap must be less than '1 << IOREMAP_MAX_ORDER':
> 	if (flags & VM_IOREMAP)
> 		align = 1ul << clamp_t(int, get_count_order_long(size),
> 			PAGE_SHIFT, IOREMAP_MAX_ORDER);
> 
> So it makes idiot like me a litter puzzle why jump the vm_area from
> 0xec800000-0xecbe1000 to 0xf1000000-0xf5001000, and leave
> 0xed000000-0xf1000000 as a big hole.
> 
> This is to show all of vm_area, including which is freeing but still in
> vmap_area_list, to make it more clear about why we will get
> 0xf1000000-0xf5001000 int the above case. And we will get the
> vmallocinfo like:
>  [..]
>  0xec79b000-0xec7fa000  389120 ftl_add_mtd+0x4d0/0x754 pages=94 vmalloc
>  0xec800000-0xecbe1000 4067328 kbox_proc_mem_write+0x104/0x1c4 phys=8b520000 ioremap
>  [..]
>  0xece7c000-0xece7e000    8192 unpurged vm_area
>  0xece7e000-0xece83000   20480 vm_map_ram
>  0xf0099000-0xf00aa000   69632 vm_map_ram
> after apply this patch.
> 
> --- a/mm/vmalloc.c
> +++ b/mm/vmalloc.c
> @@ -314,6 +314,7 @@ unsigned long vmalloc_to_pfn(const void *vmalloc_addr)
>  
>  /*** Global kva allocator ***/
>  
> +#define VM_LAZY_FREE	0x02
>  #define VM_VM_AREA	0x04
>  
>  static DEFINE_SPINLOCK(vmap_area_lock);
> @@ -1486,6 +1487,7 @@ struct vm_struct *remove_vm_area(const void *addr)
>  		spin_lock(&vmap_area_lock);
>  		va->vm = NULL;
>  		va->flags &= ~VM_VM_AREA;
> +		va->flags |= VM_LAZY_FREE;
>  		spin_unlock(&vmap_area_lock);
>  
>  		vmap_debug_free_range(va->va_start, va->va_end);
> @@ -2698,8 +2700,14 @@ static int s_show(struct seq_file *m, void *p)
>  	 * s_show can encounter race with remove_vm_area, !VM_VM_AREA on
>  	 * behalf of vmap area is being tear down or vm_map_ram allocation.
>  	 */
> -	if (!(va->flags & VM_VM_AREA))
> +	if (!(va->flags & VM_VM_AREA)) {
> +		seq_printf(m, "0x%pK-0x%pK %7ld %s\n",
> +			(void *)va->va_start, (void *)va->va_end,
> +			va->va_end - va->va_start,
> +			va->flags & VM_LAZY_FREE ? "unpurged vm_area" : "vm_map_ram");
> +
>  		return 0;
> +	}
>  
>  	v = va->vm;

hm, OK, this is safe against use-after-free races because we hold
vmap_area_lock (also taken in __purge_vmap_area_lazy()).  I wonder if
that comment over remove_vm_area() can be improved.

[toc] | [prev] | [standalone]

Back to top | Article view | linux.kernel

csiph-web