lkml.org 
[lkml]   [2020]   [Dec]   [28]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.10 454/717] mm/vmalloc.c: fix kasan shadow poisoning size
    Date
    From: Vincenzo Frascino <vincenzo.frascino@arm.com>

    [ Upstream commit c041098c690fe53cea5d20c62f128a4f7a5c19fe ]

    The size of vm area can be affected by the presence or not of the guard
    page. In particular when VM_NO_GUARD is present, the actual accessible
    size has to be considered like the real size minus the guard page.

    Currently kasan does not keep into account this information during the
    poison operation and in particular tries to poison the guard page as well.

    This approach, even if incorrect, does not cause an issue because the tags
    for the guard page are written in the shadow memory. With the future
    introduction of the Tag-Based KASAN, being the guard page inaccessible by
    nature, the write tag operation on this page triggers a fault.

    Fix kasan shadow poisoning size invoking get_vm_area_size() instead of
    accessing directly the field in the data structure to detect the correct
    value.

    Link: https://lkml.kernel.org/r/20201027160213.32904-1-vincenzo.frascino@arm.com
    Fixes: d98c9e83b5e7c ("kasan: fix crashes on access to memory mapped by vm_map_ram()")
    Signed-off-by: Vincenzo Frascino <vincenzo.frascino@arm.com>
    Cc: Andrey Konovalov <andreyknvl@google.com>
    Cc: Dmitry Vyukov <dvyukov@google.com>
    Cc: Andrey Ryabinin <aryabinin@virtuozzo.com>
    Cc: Alexander Potapenko <glider@google.com>
    Cc: Marco Elver <elver@google.com>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    mm/vmalloc.c | 2 +-
    1 file changed, 1 insertion(+), 1 deletion(-)

    diff --git a/mm/vmalloc.c b/mm/vmalloc.c
    index 75913f685c71e..279dc0c96568c 100644
    --- a/mm/vmalloc.c
    +++ b/mm/vmalloc.c
    @@ -2256,7 +2256,7 @@ static void __vunmap(const void *addr, int deallocate_pages)
    debug_check_no_locks_freed(area->addr, get_vm_area_size(area));
    debug_check_no_obj_freed(area->addr, get_vm_area_size(area));

    - kasan_poison_vmalloc(area->addr, area->size);
    + kasan_poison_vmalloc(area->addr, get_vm_area_size(area));

    vm_remove_mappings(area, deallocate_pages);

    --
    2.27.0


    \
     
     \ /
      Last update: 2020-12-28 15:51    [W:3.235 / U:0.016 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site