linux-kernel - Re: [PATCH] mm/kfence: fix a potential NULL pointer dereference

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Wed, 27 Apr 2022 20:18:16 +0800
From:   kernel test robot <lkp@...el.com>
To:     cgel.zte@...il.com, glider@...gle.com, elver@...gle.com,
        akpm@...ux-foundation.org
Cc:     llvm@...ts.linux.dev, kbuild-all@...ts.01.org, dvyukov@...gle.com,
        kasan-dev@...glegroups.com, linux-kernel@...r.kernel.org,
        linux-mm@...ck.org, xu xin <xu.xin16@....com.cn>,
        Zeal Robot <zealci@....com.cn>
Subject: Re: [PATCH] mm/kfence: fix a potential NULL pointer dereference

Hi,

Thank you for the patch! Yet something to improve:

[auto build test ERROR on hnaz-mm/master]

url:    https://github.com/intel-lab-lkp/linux/commits/cgel-zte-gmail-com/mm-kfence-fix-a-potential-NULL-pointer-dereference/20220427-151258
base:   https://github.com/hnaz/linux-mm master
config: x86_64-randconfig-a014 (https://download.01.org/0day-ci/archive/20220427/202204272015.3JRd9BKR-lkp@intel.com/config)
compiler: clang version 15.0.0 (https://github.com/llvm/llvm-project 1cddcfdc3c683b393df1a5c9063252eb60e52818)
reproduce (this is a W=1 build):
        wget https://raw.githubusercontent.com/intel/lkp-tests/master/sbin/make.cross -O ~/bin/make.cross
        chmod +x ~/bin/make.cross
        # https://github.com/intel-lab-lkp/linux/commit/920e9e639493bc72bee803c763f09760e3acd063
        git remote add linux-review https://github.com/intel-lab-lkp/linux
        git fetch --no-tags linux-review cgel-zte-gmail-com/mm-kfence-fix-a-potential-NULL-pointer-dereference/20220427-151258
        git checkout 920e9e639493bc72bee803c763f09760e3acd063
        # save the config file
        mkdir build_dir && cp config build_dir/.config
        COMPILER_INSTALL_PATH=$HOME/0day COMPILER=clang make.cross W=1 O=build_dir ARCH=x86_64 SHELL=/bin/bash

If you fix the issue, kindly add following tag as appropriate
Reported-by: kernel test robot <lkp@...el.com>

All errors (new ones prefixed by >>):

>> mm/kfence/core.c:1067:23: error: use of undeclared identifier 'addr'
                   kfence_guarded_free(addr, meta, false);
                                       ^
   mm/kfence/core.c:1075:23: warning: incompatible pointer to integer conversion passing 'void *' to parameter of type 'unsigned long' [-Wint-conversion]
                   kfence_report_error(addr, false, NULL, NULL, KFENCE_ERROR_INVALID);
                                       ^~~~
   mm/kfence/kfence.h:129:40: note: passing argument to parameter 'address' here
   void kfence_report_error(unsigned long address, bool is_write, struct pt_regs *regs,
                                          ^
   1 warning and 1 error generated.


vim +/addr +1067 mm/kfence/core.c

0ce20dd840897b1 Alexander Potapenko 2021-02-25  1050  
0ce20dd840897b1 Alexander Potapenko 2021-02-25  1051  
920e9e639493bc7 xu xin              2022-04-27  1052  /* Require: meta is not NULL*/
920e9e639493bc7 xu xin              2022-04-27  1053  static __always_inline void __try_free_kfence_meta(struct kfence_metadata *meta)
920e9e639493bc7 xu xin              2022-04-27  1054  {
8f0b36497303487 Muchun Song         2022-04-01  1055  #ifdef CONFIG_MEMCG
8f0b36497303487 Muchun Song         2022-04-01  1056  	KFENCE_WARN_ON(meta->objcg);
8f0b36497303487 Muchun Song         2022-04-01  1057  #endif
0ce20dd840897b1 Alexander Potapenko 2021-02-25  1058  	/*
0ce20dd840897b1 Alexander Potapenko 2021-02-25  1059  	 * If the objects of the cache are SLAB_TYPESAFE_BY_RCU, defer freeing
0ce20dd840897b1 Alexander Potapenko 2021-02-25  1060  	 * the object, as the object page may be recycled for other-typed
0ce20dd840897b1 Alexander Potapenko 2021-02-25  1061  	 * objects once it has been freed. meta->cache may be NULL if the cache
0ce20dd840897b1 Alexander Potapenko 2021-02-25  1062  	 * was destroyed.
0ce20dd840897b1 Alexander Potapenko 2021-02-25  1063  	 */
0ce20dd840897b1 Alexander Potapenko 2021-02-25  1064  	if (unlikely(meta->cache && (meta->cache->flags & SLAB_TYPESAFE_BY_RCU)))
0ce20dd840897b1 Alexander Potapenko 2021-02-25  1065  		call_rcu(&meta->rcu_head, rcu_guarded_free);
0ce20dd840897b1 Alexander Potapenko 2021-02-25  1066  	else
0ce20dd840897b1 Alexander Potapenko 2021-02-25 @1067  		kfence_guarded_free(addr, meta, false);
0ce20dd840897b1 Alexander Potapenko 2021-02-25  1068  }
0ce20dd840897b1 Alexander Potapenko 2021-02-25  1069  

-- 
0-DAY CI Kernel Test Service
https://01.org/lkp