Messages in this thread | | | Date | Fri, 24 Feb 2023 17:26:13 +0800 | Subject | Re: [PATCH] x86: profiling: Set prof_cpu_mask to NULL after free | From | Chen Zhongjin <> |
| |
get_maintainer.pl gets a wrong spelled mail address 'akpm@linux-foudation.org'.
Seems it's because Andrew left a wrong Reviewed-by in the last commit.. so -cc alone for Andrew.
Sorry for bothering.
On 2023/2/24 16:49, Chen Zhongjin wrote: > KASAN reported a UAF problem in profile_tick(): > > BUG: KASAN: use-after-free in profile_tick+0x5c/0x80 > Read of size 8 at addr ffff888100928aa0 by task bash/1108 > > CPU: 2 PID: 1108 Comm: bash Not tainted 5.10.0+ #72 > Call Trace: > <IRQ> > dump_stack+0x93/0xc5 > print_address_description.constprop.0+0x1c/0x3c0 > kasan_report.cold+0x37/0x74 > check_memory_region+0x161/0x1c0 > profile_tick+0x5c/0x80 > tick_sched_timer+0xcd/0x100 > __hrtimer_run_queues+0x23e/0x480 > hrtimer_interrupt+0x1c2/0x440 > asm_call_irq_on_stack+0xf/0x20 > </IRQ> > ... > > It is beacause in profiling_store(), profile_init() is possible to fail > and free prof_cpu_mask. However prof_cpu_mask is not set to NULL and > cpumask_available(prof_cpu_mask) will return true in profile_tick(). > Then cpumask_test_cpu() will dereference prof_cpu_mask and trigger the > KASAN warning. > > There is no interface to disable profile_tick() even though profile_init() > has been already failed. So just set prof_cpu_mask to NULL when free it. > Then accessing to prof_cpu_mask can be rejected by prof_buffer or > cpumask_available(). > > Fixes: c309b917cab5 ("cpumask: convert kernel/profile.c") > Signed-off-by: Chen Zhongjin <chenzhongjin@huawei.com> > --- > kernel/profile.c | 3 ++- > 1 file changed, 2 insertions(+), 1 deletion(-) > > diff --git a/kernel/profile.c b/kernel/profile.c > index 8a77769bc4b4..d60f9634fb2a 100644 > --- a/kernel/profile.c > +++ b/kernel/profile.c > @@ -133,6 +133,7 @@ int __ref profile_init(void) > return 0; > > free_cpumask_var(prof_cpu_mask); > + prof_cpu_mask = NULL; > return -ENOMEM; > } > > @@ -334,7 +335,7 @@ void profile_tick(int type) > { > struct pt_regs *regs = get_irq_regs(); > > - if (!user_mode(regs) && cpumask_available(prof_cpu_mask) && > + if (!user_mode(regs) && prof_buffer && cpumask_available(prof_cpu_mask) && > cpumask_test_cpu(smp_processor_id(), prof_cpu_mask)) > profile_hit(type, (void *)profile_pc(regs)); > }
| |