| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Date: Tue, 31 May 2022 23:08:23 +0800
From: Patrick Wang <patrick.wang.shcn@...il.com>
To: catalin.marinas@....com, akpm@...ux-foundation.org
Cc: linux-mm@...ck.org, linux-kernel@...r.kernel.org,
yee.lee@...iatek.com, patrick.wang.shcn@...il.com
Subject: [PATCH] mm: kmemleak: check boundary of objects allocated with physical address when scan
The kmemleak_*_phys() interface uses "min_low_pfn" and
"max_low_pfn" to check address. But on some architectures,
kmemleak_*_phys() is called before those two variables
initialized. Add OBJECT_PHYS flag for the objects allocated
with physical address, and check the boundary when scan
instead of in kmemleak_*_phys().
This commit will solve:
https://lore.kernel.org/r/20220527032504.30341-1-yee.lee@mediatek.com
https://lore.kernel.org/r/9dd08bb5-f39e-53d8-f88d-bec598a08c93@gmail.com
Suggested-by: Catalin Marinas <catalin.marinas@....com>
Signed-off-by: Patrick Wang <patrick.wang.shcn@...il.com>
---
mm/kmemleak.c | 48 ++++++++++++++++++++++++++++++------------------
1 file changed, 30 insertions(+), 18 deletions(-)
diff --git a/mm/kmemleak.c b/mm/kmemleak.c
index a182f5ddaf68..1e2f90db9850 100644
--- a/mm/kmemleak.c
+++ b/mm/kmemleak.c
@@ -172,6 +172,8 @@ struct kmemleak_object {
#define OBJECT_NO_SCAN (1 << 2)
/* flag set to fully scan the object when scan_area allocation failed */
#define OBJECT_FULL_SCAN (1 << 3)
+/* flag set for object allocated with physical address */
+#define OBJECT_PHYS (1 << 4)
#define HEX_PREFIX " "
/* number of bytes to print per line; must be 16 or 32 */
@@ -575,7 +577,8 @@ static int __save_stack_trace(unsigned long *trace)
* memory block and add it to the object_list and object_tree_root.
*/
static struct kmemleak_object *create_object(unsigned long ptr, size_t size,
- int min_count, gfp_t gfp)
+ int min_count, gfp_t gfp,
+ bool is_phys)
{
unsigned long flags;
struct kmemleak_object *object, *parent;
@@ -595,7 +598,7 @@ static struct kmemleak_object *create_object(unsigned long ptr, size_t size,
INIT_HLIST_HEAD(&object->area_list);
raw_spin_lock_init(&object->lock);
atomic_set(&object->use_count, 1);
- object->flags = OBJECT_ALLOCATED;
+ object->flags = OBJECT_ALLOCATED | (is_phys ? OBJECT_PHYS : 0);
object->pointer = ptr;
object->size = kfence_ksize((void *)ptr) ?: size;
object->excess_ref = 0;
@@ -729,10 +732,10 @@ static void delete_object_part(unsigned long ptr, size_t size)
end = object->pointer + object->size;
if (ptr > start)
create_object(start, ptr - start, object->min_count,
- GFP_KERNEL);
+ GFP_KERNEL, object->flags & OBJECT_PHYS);
if (ptr + size < end)
create_object(ptr + size, end - ptr - size, object->min_count,
- GFP_KERNEL);
+ GFP_KERNEL, object->flags & OBJECT_PHYS);
__delete_object(object);
}
@@ -904,7 +907,7 @@ void __ref kmemleak_alloc(const void *ptr, size_t size, int min_count,
pr_debug("%s(0x%p, %zu, %d)\n", __func__, ptr, size, min_count);
if (kmemleak_enabled && ptr && !IS_ERR(ptr))
- create_object((unsigned long)ptr, size, min_count, gfp);
+ create_object((unsigned long)ptr, size, min_count, gfp, false);
}
EXPORT_SYMBOL_GPL(kmemleak_alloc);
@@ -931,7 +934,7 @@ void __ref kmemleak_alloc_percpu(const void __percpu *ptr, size_t size,
if (kmemleak_enabled && ptr && !IS_ERR(ptr))
for_each_possible_cpu(cpu)
create_object((unsigned long)per_cpu_ptr(ptr, cpu),
- size, 0, gfp);
+ size, 0, gfp, false);
}
EXPORT_SYMBOL_GPL(kmemleak_alloc_percpu);
@@ -953,7 +956,7 @@ void __ref kmemleak_vmalloc(const struct vm_struct *area, size_t size, gfp_t gfp
* the virtual address of the vmalloc'ed block.
*/
if (kmemleak_enabled) {
- create_object((unsigned long)area->addr, size, 2, gfp);
+ create_object((unsigned long)area->addr, size, 2, gfp, false);
object_set_excess_ref((unsigned long)area,
(unsigned long)area->addr);
}
@@ -1132,8 +1135,13 @@ EXPORT_SYMBOL(kmemleak_no_scan);
void __ref kmemleak_alloc_phys(phys_addr_t phys, size_t size, int min_count,
gfp_t gfp)
{
- if (PHYS_PFN(phys) >= min_low_pfn && PHYS_PFN(phys) < max_low_pfn)
- kmemleak_alloc(__va(phys), size, min_count, gfp);
+ pr_debug("%s(0x%p, %zu, %d)\n", __func__, __va(phys), size, min_count);
+
+ if (kmemleak_enabled && (unsigned long)__va(phys) >= PAGE_OFFSET &&
+ !IS_ERR(__va(phys)))
+ /* create object with OBJECT_PHYS flag */
+ create_object((unsigned long)__va(phys), size, min_count,
+ gfp, true);
}
EXPORT_SYMBOL(kmemleak_alloc_phys);
@@ -1146,8 +1154,7 @@ EXPORT_SYMBOL(kmemleak_alloc_phys);
*/
void __ref kmemleak_free_part_phys(phys_addr_t phys, size_t size)
{
- if (PHYS_PFN(phys) >= min_low_pfn && PHYS_PFN(phys) < max_low_pfn)
- kmemleak_free_part(__va(phys), size);
+ kmemleak_free_part(__va(phys), size);
}
EXPORT_SYMBOL(kmemleak_free_part_phys);
@@ -1158,8 +1165,7 @@ EXPORT_SYMBOL(kmemleak_free_part_phys);
*/
void __ref kmemleak_not_leak_phys(phys_addr_t phys)
{
- if (PHYS_PFN(phys) >= min_low_pfn && PHYS_PFN(phys) < max_low_pfn)
- kmemleak_not_leak(__va(phys));
+ kmemleak_not_leak(__va(phys));
}
EXPORT_SYMBOL(kmemleak_not_leak_phys);
@@ -1170,8 +1176,7 @@ EXPORT_SYMBOL(kmemleak_not_leak_phys);
*/
void __ref kmemleak_ignore_phys(phys_addr_t phys)
{
- if (PHYS_PFN(phys) >= min_low_pfn && PHYS_PFN(phys) < max_low_pfn)
- kmemleak_ignore(__va(phys));
+ kmemleak_ignore(__va(phys));
}
EXPORT_SYMBOL(kmemleak_ignore_phys);
@@ -1436,6 +1441,13 @@ static void kmemleak_scan(void)
dump_object_info(object);
}
#endif
+
+ /* outside lowmem, make it black */
+ if (object->flags & OBJECT_PHYS)
+ if (PHYS_PFN(__pa((void *)object->pointer)) < min_low_pfn ||
+ PHYS_PFN(__pa((void *)object->pointer)) >= max_low_pfn)
+ __paint_it(object, KMEMLEAK_BLACK);
+
/* reset the reference count (whiten the object) */
object->count = 0;
if (color_gray(object) && get_object(object))
@@ -1966,14 +1978,14 @@ void __init kmemleak_init(void)
/* register the data/bss sections */
create_object((unsigned long)_sdata, _edata - _sdata,
- KMEMLEAK_GREY, GFP_ATOMIC);
+ KMEMLEAK_GREY, GFP_ATOMIC, false);
create_object((unsigned long)__bss_start, __bss_stop - __bss_start,
- KMEMLEAK_GREY, GFP_ATOMIC);
+ KMEMLEAK_GREY, GFP_ATOMIC, false);
/* only register .data..ro_after_init if not within .data */
if (&__start_ro_after_init < &_sdata || &__end_ro_after_init > &_edata)
create_object((unsigned long)__start_ro_after_init,
__end_ro_after_init - __start_ro_after_init,
- KMEMLEAK_GREY, GFP_ATOMIC);
+ KMEMLEAK_GREY, GFP_ATOMIC, false);
}
/*
--
2.25.1
Powered by blists - more mailing lists