linux-kernel - [PATCH 5.15] of: reserved_mem: Have kmemleak ignore dynamically allocated reserved mem

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20230217200731.285514-1-isaacmanjarres@google.com>
Date:   Fri, 17 Feb 2023 12:07:30 -0800
From:   "Isaac J. Manjarres" <isaacmanjarres@...gle.com>
To:     Rob Herring <robh+dt@...nel.org>,
        Frank Rowand <frowand.list@...il.com>,
        Andrew Morton <akpm@...ux-foundation.org>,
        "Russell King (Oracle)" <rmk+kernel@...linux.org.uk>,
        Nick Kossifidis <mick@....forth.gr>,
        Mike Rapoport <rppt@...nel.org>
Cc:     Catalin Marinas <catalin.marinas@....com>,
        Saravana Kannan <saravanak@...gle.com>, linux-mm@...ck.org,
        "Isaac J. Manjarres" <isaacmanjarres@...gle.com>,
        "Kirill A . Shutemov" <kirill.shtuemov@...ux.intel.com>,
        "Rafael J . Wysocki" <rafael.j.wysocki@...el.com>,
        Rob Herring <robh@...nel.org>, stable@...r.kernel.org,
        kernel-team@...roid.com, devicetree@...r.kernel.org,
        linux-kernel@...r.kernel.org
Subject: [PATCH 5.15] of: reserved_mem: Have kmemleak ignore dynamically
 allocated reserved mem

commit ce4d9a1ea35ac5429e822c4106cb2859d5c71f3e upstream.

Patch series "Fix kmemleak crashes when scanning CMA regions", v2.

When trying to boot a device with an ARM64 kernel with the following
config options enabled:

CONFIG_DEBUG_PAGEALLOC=y
CONFIG_DEBUG_PAGEALLOC_ENABLE_DEFAULT=y
CONFIG_DEBUG_KMEMLEAK=y

a crash is encountered when kmemleak starts to scan the list of gray
or allocated objects that it maintains. Upon closer inspection, it was
observed that these page-faults always occurred when kmemleak attempted
to scan a CMA region.

At the moment, kmemleak is made aware of CMA regions that are specified
through the devicetree to be dynamically allocated within a range of
addresses. However, kmemleak should not need to scan CMA regions or any
reserved memory region, as those regions can be used for DMA transfers
between drivers and peripherals, and thus wouldn't contain anything
useful for kmemleak.

Additionally, since CMA regions are unmapped from the kernel's address
space when they are freed to the buddy allocator at boot when
CONFIG_DEBUG_PAGEALLOC is enabled, kmemleak shouldn't attempt to access
those memory regions, as that will trigger a crash. Thus, kmemleak
should ignore all dynamically allocated reserved memory regions.

This patch (of 1):

Currently, kmemleak ignores dynamically allocated reserved memory regions
that don't have a kernel mapping.  However, regions that do retain a
kernel mapping (e.g.  CMA regions) do get scanned by kmemleak.

This is not ideal for two reasons:

1  kmemleak works by scanning memory regions for pointers to allocated
   objects to determine if those objects have been leaked or not.
   However, reserved memory regions can be used between drivers and
   peripherals for DMA transfers, and thus, would not contain pointers to
   allocated objects, making it unnecessary for kmemleak to scan these
   reserved memory regions.

2  When CONFIG_DEBUG_PAGEALLOC is enabled, along with kmemleak, the
   CMA reserved memory regions are unmapped from the kernel's address
   space when they are freed to buddy at boot.  These CMA reserved regions
   are still tracked by kmemleak, however, and when kmemleak attempts to
   scan them, a crash will happen, as accessing the CMA region will result
   in a page-fault, since the regions are unmapped.

Thus, use kmemleak_ignore_phys() for all dynamically allocated reserved
memory regions, instead of those that do not have a kernel mapping
associated with them.

Link: https://lkml.kernel.org/r/20230208232001.2052777-1-isaacmanjarres@google.com
Link: https://lkml.kernel.org/r/20230208232001.2052777-2-isaacmanjarres@google.com
Fixes: a7259df76702 ("memblock: make memblock_find_in_range method private")
Signed-off-by: Isaac J. Manjarres <isaacmanjarres@...gle.com>
Acked-by: Mike Rapoport (IBM) <rppt@...nel.org>
Acked-by: Catalin Marinas <catalin.marinas@....com>
Cc: Frank Rowand <frowand.list@...il.com>
Cc: Kirill A. Shutemov <kirill.shtuemov@...ux.intel.com>
Cc: Nick Kossifidis <mick@....forth.gr>
Cc: Rafael J. Wysocki <rafael.j.wysocki@...el.com>
Cc: Rob Herring <robh@...nel.org>
Cc: Russell King (Oracle) <rmk+kernel@...linux.org.uk>
Cc: Saravana Kannan <saravanak@...gle.com>
Cc: <stable@...r.kernel.org>	[5.15+]
Signed-off-by: Andrew Morton <akpm@...ux-foundation.org>
---
 drivers/of/of_reserved_mem.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/of/of_reserved_mem.c b/drivers/of/of_reserved_mem.c
index 9da8835ba5a5..9e949ddcb146 100644
--- a/drivers/of/of_reserved_mem.c
+++ b/drivers/of/of_reserved_mem.c
@@ -47,9 +47,10 @@ static int __init early_init_dt_alloc_reserved_memory_arch(phys_addr_t size,
 		err = memblock_mark_nomap(base, size);
 		if (err)
 			memblock_free(base, size);
-		kmemleak_ignore_phys(base);
 	}

+	kmemleak_ignore_phys(base);
+
 	return err;
 }

-- 
2.39.2.637.g21b0678d19-goog