linux-kernel - Re: [PATCH mm] kasan: print virtual mapping info in reports

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Thu, 17 Feb 2022 12:00:09 +0000
From:   Mark Rutland <mark.rutland@....com>
To:     andrey.konovalov@...ux.dev
Cc:     Marco Elver <elver@...gle.com>,
        Alexander Potapenko <glider@...gle.com>,
        Andrew Morton <akpm@...ux-foundation.org>,
        Andrey Konovalov <andreyknvl@...il.com>,
        Dmitry Vyukov <dvyukov@...gle.com>,
        Andrey Ryabinin <ryabinin.a.a@...il.com>,
        kasan-dev@...glegroups.com,
        Vincenzo Frascino <vincenzo.frascino@....com>,
        Catalin Marinas <catalin.marinas@....com>, linux-mm@...ck.org,
        linux-kernel@...r.kernel.org,
        Andrey Konovalov <andreyknvl@...gle.com>
Subject: Re: [PATCH mm] kasan: print virtual mapping info in reports

On Wed, Feb 16, 2022 at 08:01:37PM +0100, andrey.konovalov@...ux.dev wrote:
> From: Andrey Konovalov <andreyknvl@...gle.com>
> 
> Print virtual mapping range and its creator in reports affecting virtual
> mappings.
> 
> Also get physical page pointer for such mappings, so page information
> gets printed as well.
> 
> Signed-off-by: Andrey Konovalov <andreyknvl@...gle.com>
> 
> ---
> 
> Note: no need to merge this patch into any of the KASAN vmalloc patches
> that are already in mm, better to keep it separate.
> ---
>  mm/kasan/report.c | 12 +++++++++++-
>  1 file changed, 11 insertions(+), 1 deletion(-)
> 
> diff --git a/mm/kasan/report.c b/mm/kasan/report.c
> index 137c2c0b09db..8002fb3c417d 100644
> --- a/mm/kasan/report.c
> +++ b/mm/kasan/report.c
> @@ -260,8 +260,18 @@ static void print_address_description(void *addr, u8 tag)
>  		pr_err(" %pS\n", addr);
>  	}
>  
> +	if (is_vmalloc_addr(addr)) {
> +		struct vm_struct *va = find_vm_area(addr);
> +
> +		pr_err("The buggy address belongs to the virtual mapping at\n"
> +		       " [%px, %px) created by:\n"
> +		       " %pS\n", va->addr, va->addr + va->size, va->caller);

The return value of find_vm_area() needs a NULL check here;
is_vmalloc_addr(addr) just checks that `addr` is within the vmalloc VA
range, and doesn't guarantee that there is a vmap_area associated with
that `addr`.

Without the NULL-check, we'll blow up on the `va->addr` dereference and
will fail to make the report, which would be unfortunate.

Thanks,
Mark.

> +
> +		page = vmalloc_to_page(page);
> +	}
> +
>  	if (page) {
> -		pr_err("The buggy address belongs to the page:\n");
> +		pr_err("The buggy address belongs to the physical page:\n");
>  		dump_page(page, "kasan: bad access detected");
>  	}
>  
> -- 
> 2.25.1
>