linux-kernel - [PATCH v2 0/1] mm: kfence: fix unexpected leak scan on kfence pool

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:   Tue, 28 Jun 2022 19:37:10 +0800
From:   <yee.lee@...iatek.com>
To:     <linux-kernel@...r.kernel.org>
CC:     <catalin.marinas@....com>, Yee Lee <yee.lee@...iatek.com>,
        "Matthias Brugger" <matthias.bgg@...il.com>,
        "moderated list:ARM/Mediatek SoC support" 
        <linux-arm-kernel@...ts.infradead.org>,
        "moderated list:ARM/Mediatek SoC support" 
        <linux-mediatek@...ts.infradead.org>
Subject: [PATCH v2 0/1] mm: kfence: fix unexpected leak scan on kfence pool

From: Yee Lee <yee.lee@...iatek.com>

Since the latest patches of kmemleak separated its address management 
to two rb-trees, phys and virt, the kmemleak_free failed to free kfence_pool
from the virt tree. It caused unexpected scan the blocks and triggered
kfence faults.

Reference: 
https://lore.kernel.org/linux-mm/20220611035551.1823303-1-patrick.wang.shcn@gmail.com/

 ==================================================================
 BUG: KFENCE: invalid read in scan_block+0x13c/0x838

  Invalid read at 0x000000003dc26873:
  scan_block+0x13c/0x838
  scan_gray_list+0x1f0/0x478
  kmemleak_scan+0x63c/0xd64
  kmemleak_write+0x618/0x8cc
  full_proxy_write+0x70/0x138
  vfs_write+0x108/0x314
  ksys_write+0x7c/0x14c
  __arm64_sys_write+0x20/0x30
  el0_svc_common+0xa8/0x144
  do_el0_svc+0x30/0xd4
  el0_svc+0x38/0x15c
  el0t_64_sync_handler+0x88/0xf8
  el0t_64_sync+0x1a0/0x1a4

 CPU: 0 PID: 128 Comm: sh Not tainted 5.18.0-mainline-40996-g7d83a175ff4a-dirty #1
 Hardware name: linux,dummy-virt (DT)
 ==================================================================

This patch applies kmemleak_ignore_phys() to replace the original kmemleak_free and
adapts it to the late enabling case. 

v1->v2:
 - use kmemleak_ignore_phys() to bypass the scanning.
 - move out the freeing opeartion from late enabling as it's trivial.

Yee Lee (1):
  mm: kfence: apply kmemleak_ignore_phys on early allocated pool

 mm/kfence/core.c | 18 +++++++++---------
 1 file changed, 9 insertions(+), 9 deletions(-)

-- 
2.18.0