lkml.org 
[lkml]   [2022]   [Apr]   [18]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.14 279/284] mm: kmemleak: take a full lowmem check in kmemleak_*_phys()
    Date
    From: Patrick Wang <patrick.wang.shcn@gmail.com>

    commit 23c2d497de21f25898fbea70aeb292ab8acc8c94 upstream.

    The kmemleak_*_phys() apis do not check the address for lowmem's min
    boundary, while the caller may pass an address below lowmem, which will
    trigger an oops:

    # echo scan > /sys/kernel/debug/kmemleak
    Unable to handle kernel paging request at virtual address ff5fffffffe00000
    Oops [#1]
    Modules linked in:
    CPU: 2 PID: 134 Comm: bash Not tainted 5.18.0-rc1-next-20220407 #33
    Hardware name: riscv-virtio,qemu (DT)
    epc : scan_block+0x74/0x15c
    ra : scan_block+0x72/0x15c
    epc : ffffffff801e5806 ra : ffffffff801e5804 sp : ff200000104abc30
    gp : ffffffff815cd4e8 tp : ff60000004cfa340 t0 : 0000000000000200
    t1 : 00aaaaaac23954cc t2 : 00000000000003ff s0 : ff200000104abc90
    s1 : ffffffff81b0ff28 a0 : 0000000000000000 a1 : ff5fffffffe01000
    a2 : ffffffff81b0ff28 a3 : 0000000000000002 a4 : 0000000000000001
    a5 : 0000000000000000 a6 : ff200000104abd7c a7 : 0000000000000005
    s2 : ff5fffffffe00ff9 s3 : ffffffff815cd998 s4 : ffffffff815d0e90
    s5 : ffffffff81b0ff28 s6 : 0000000000000020 s7 : ffffffff815d0eb0
    s8 : ffffffffffffffff s9 : ff5fffffffe00000 s10: ff5fffffffe01000
    s11: 0000000000000022 t3 : 00ffffffaa17db4c t4 : 000000000000000f
    t5 : 0000000000000001 t6 : 0000000000000000
    status: 0000000000000100 badaddr: ff5fffffffe00000 cause: 000000000000000d
    scan_gray_list+0x12e/0x1a6
    kmemleak_scan+0x2aa/0x57e
    kmemleak_write+0x32a/0x40c
    full_proxy_write+0x56/0x82
    vfs_write+0xa6/0x2a6
    ksys_write+0x6c/0xe2
    sys_write+0x22/0x2a
    ret_from_syscall+0x0/0x2

    The callers may not quite know the actual address they pass(e.g. from
    devicetree). So the kmemleak_*_phys() apis should guarantee the address
    they finally use is in lowmem range, so check the address for lowmem's
    min boundary.

    Link: https://lkml.kernel.org/r/20220413122925.33856-1-patrick.wang.shcn@gmail.com
    Signed-off-by: Patrick Wang <patrick.wang.shcn@gmail.com>
    Acked-by: Catalin Marinas <catalin.marinas@arm.com>
    Cc: <stable@vger.kernel.org>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    ---
    mm/kmemleak.c | 8 ++++----
    1 file changed, 4 insertions(+), 4 deletions(-)

    --- a/mm/kmemleak.c
    +++ b/mm/kmemleak.c
    @@ -1192,7 +1192,7 @@ EXPORT_SYMBOL(kmemleak_no_scan);
    void __ref kmemleak_alloc_phys(phys_addr_t phys, size_t size, int min_count,
    gfp_t gfp)
    {
    - if (!IS_ENABLED(CONFIG_HIGHMEM) || PHYS_PFN(phys) < max_low_pfn)
    + if (PHYS_PFN(phys) >= min_low_pfn && PHYS_PFN(phys) < max_low_pfn)
    kmemleak_alloc(__va(phys), size, min_count, gfp);
    }
    EXPORT_SYMBOL(kmemleak_alloc_phys);
    @@ -1203,7 +1203,7 @@ EXPORT_SYMBOL(kmemleak_alloc_phys);
    */
    void __ref kmemleak_free_part_phys(phys_addr_t phys, size_t size)
    {
    - if (!IS_ENABLED(CONFIG_HIGHMEM) || PHYS_PFN(phys) < max_low_pfn)
    + if (PHYS_PFN(phys) >= min_low_pfn && PHYS_PFN(phys) < max_low_pfn)
    kmemleak_free_part(__va(phys), size);
    }
    EXPORT_SYMBOL(kmemleak_free_part_phys);
    @@ -1214,7 +1214,7 @@ EXPORT_SYMBOL(kmemleak_free_part_phys);
    */
    void __ref kmemleak_not_leak_phys(phys_addr_t phys)
    {
    - if (!IS_ENABLED(CONFIG_HIGHMEM) || PHYS_PFN(phys) < max_low_pfn)
    + if (PHYS_PFN(phys) >= min_low_pfn && PHYS_PFN(phys) < max_low_pfn)
    kmemleak_not_leak(__va(phys));
    }
    EXPORT_SYMBOL(kmemleak_not_leak_phys);
    @@ -1225,7 +1225,7 @@ EXPORT_SYMBOL(kmemleak_not_leak_phys);
    */
    void __ref kmemleak_ignore_phys(phys_addr_t phys)
    {
    - if (!IS_ENABLED(CONFIG_HIGHMEM) || PHYS_PFN(phys) < max_low_pfn)
    + if (PHYS_PFN(phys) >= min_low_pfn && PHYS_PFN(phys) < max_low_pfn)
    kmemleak_ignore(__va(phys));
    }
    EXPORT_SYMBOL(kmemleak_ignore_phys);

    \
     
     \ /
      Last update: 2022-04-18 16:05    [W:5.321 / U:0.004 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site