lkml.org 
[lkml]   [2022]   [Apr]   [5]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.10 078/599] mm/kmemleak: reset tag when compare object pointer
    Date
    From: Kuan-Ying Lee <Kuan-Ying.Lee@mediatek.com>

    commit bfc8089f00fa526dea983844c880fa8106c33ac4 upstream.

    When we use HW-tag based kasan and enable vmalloc support, we hit the
    following bug. It is due to comparison between tagged object and
    non-tagged pointer.

    We need to reset the kasan tag when we need to compare tagged object and
    non-tagged pointer.

    kmemleak: [name:kmemleak&]Scan area larger than object 0xffffffe77076f440
    CPU: 4 PID: 1 Comm: init Tainted: G S W 5.15.25-android13-0-g5cacf919c2bc #1
    Hardware name: MT6983(ENG) (DT)
    Call trace:
    add_scan_area+0xc4/0x244
    kmemleak_scan_area+0x40/0x9c
    layout_and_allocate+0x1e8/0x288
    load_module+0x2c8/0xf00
    __se_sys_finit_module+0x190/0x1d0
    __arm64_sys_finit_module+0x20/0x30
    invoke_syscall+0x60/0x170
    el0_svc_common+0xc8/0x114
    do_el0_svc+0x28/0xa0
    el0_svc+0x60/0xf8
    el0t_64_sync_handler+0x88/0xec
    el0t_64_sync+0x1b4/0x1b8
    kmemleak: [name:kmemleak&]Object 0xf5ffffe77076b000 (size 32768):
    kmemleak: [name:kmemleak&] comm "init", pid 1, jiffies 4294894197
    kmemleak: [name:kmemleak&] min_count = 0
    kmemleak: [name:kmemleak&] count = 0
    kmemleak: [name:kmemleak&] flags = 0x1
    kmemleak: [name:kmemleak&] checksum = 0
    kmemleak: [name:kmemleak&] backtrace:
    module_alloc+0x9c/0x120
    move_module+0x34/0x19c
    layout_and_allocate+0x1c4/0x288
    load_module+0x2c8/0xf00
    __se_sys_finit_module+0x190/0x1d0
    __arm64_sys_finit_module+0x20/0x30
    invoke_syscall+0x60/0x170
    el0_svc_common+0xc8/0x114
    do_el0_svc+0x28/0xa0
    el0_svc+0x60/0xf8
    el0t_64_sync_handler+0x88/0xec
    el0t_64_sync+0x1b4/0x1b8

    Link: https://lkml.kernel.org/r/20220318034051.30687-1-Kuan-Ying.Lee@mediatek.com
    Signed-off-by: Kuan-Ying Lee <Kuan-Ying.Lee@mediatek.com>
    Reviewed-by: Catalin Marinas <catalin.marinas@arm.com>
    Cc: Matthias Brugger <matthias.bgg@gmail.com>
    Cc: Chinwen Chang <chinwen.chang@mediatek.com>
    Cc: Nicholas Tang <nicholas.tang@mediatek.com>
    Cc: Yee Lee <yee.lee@mediatek.com>
    Cc: <stable@vger.kernel.org>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    ---
    mm/kmemleak.c | 9 +++++++--
    1 file changed, 7 insertions(+), 2 deletions(-)

    --- a/mm/kmemleak.c
    +++ b/mm/kmemleak.c
    @@ -787,6 +787,8 @@ static void add_scan_area(unsigned long
    unsigned long flags;
    struct kmemleak_object *object;
    struct kmemleak_scan_area *area = NULL;
    + unsigned long untagged_ptr;
    + unsigned long untagged_objp;

    object = find_and_get_object(ptr, 1);
    if (!object) {
    @@ -795,6 +797,9 @@ static void add_scan_area(unsigned long
    return;
    }

    + untagged_ptr = (unsigned long)kasan_reset_tag((void *)ptr);
    + untagged_objp = (unsigned long)kasan_reset_tag((void *)object->pointer);
    +
    if (scan_area_cache)
    area = kmem_cache_alloc(scan_area_cache, gfp_kmemleak_mask(gfp));

    @@ -806,8 +811,8 @@ static void add_scan_area(unsigned long
    goto out_unlock;
    }
    if (size == SIZE_MAX) {
    - size = object->pointer + object->size - ptr;
    - } else if (ptr + size > object->pointer + object->size) {
    + size = untagged_objp + object->size - untagged_ptr;
    + } else if (untagged_ptr + size > untagged_objp + object->size) {
    kmemleak_warn("Scan area larger than object 0x%08lx\n", ptr);
    dump_object_info(object);
    kmem_cache_free(scan_area_cache, area);

    \
     
     \ /
      Last update: 2022-04-06 01:53    [W:4.082 / U:0.024 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site