linux-kernel - Re: [PATCH] mm/kasan: Don't vfree() nonexistent vm

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Fri, 18 May 2018 18:01:02 +0200
From:   David Hildenbrand <david@...hat.com>
To:     Andrey Ryabinin <aryabinin@...tuozzo.com>,
        Andrew Morton <akpm@...ux-foundation.org>
Cc:     Paul Menzel <pmenzel+linux-kasan-dev@...gen.mpg.de>,
        Alexander Potapenko <glider@...gle.com>,
        Dmitry Vyukov <dvyukov@...gle.com>, kasan-dev@...glegroups.com,
        linux-kernel@...r.kernel.org, linux-mm@...ck.org,
        stable@...r.kernel.org
Subject: Re: [PATCH] mm/kasan: Don't vfree() nonexistent vm_area.

On 18.05.2018 17:57, David Hildenbrand wrote:
> On 01.02.2018 17:33, Andrey Ryabinin wrote:
>> KASAN uses different routines to map shadow for hot added memory and memory
>> obtained in boot process. Attempt to offline memory onlined by normal boot
>> process leads to this:
>>
>>     Trying to vfree() nonexistent vm area (000000005d3b34b9)
>>     WARNING: CPU: 2 PID: 13215 at mm/vmalloc.c:1525 __vunmap+0x147/0x190
>>
>>     Call Trace:
>>      kasan_mem_notifier+0xad/0xb9
>>      notifier_call_chain+0x166/0x260
>>      __blocking_notifier_call_chain+0xdb/0x140
>>      __offline_pages+0x96a/0xb10
>>      memory_subsys_offline+0x76/0xc0
>>      device_offline+0xb8/0x120
>>      store_mem_state+0xfa/0x120
>>      kernfs_fop_write+0x1d5/0x320
>>      __vfs_write+0xd4/0x530
>>      vfs_write+0x105/0x340
>>      SyS_write+0xb0/0x140
>>
>> Obviously we can't call vfree() to free memory that wasn't allocated via
>> vmalloc(). Use find_vm_area() to see if we can call vfree().
>>
>> Unfortunately it's a bit tricky to properly unmap and free shadow allocated
>> during boot, so we'll have to keep it. If memory will come online again
>> that shadow will be reused.
>>
> 
> While debugging kasan memory hotplug problems I am having, stumbled over
> this patch.
> 
> Couldn't we handle that via VM_KASAN like in kasan_module_alloc/free
> instead?
> 

Just realized that this will most probably not work. So please ignore my
comment for now :)

-- 

Thanks,

David / dhildenb