linux-kernel - Re: [PATCH] mm: kfence: fix using kfence_metadata without initialization in show

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Wed, 15 Mar 2023 22:04:33 +0100
From:   Marco Elver <elver@...gle.com>
To:     Andrew Morton <akpm@...ux-foundation.org>
Cc:     Muchun Song <songmuchun@...edance.com>, glider@...gle.com,
        dvyukov@...gle.com, jannh@...gle.com, sjpark@...zon.de,
        kasan-dev@...glegroups.com, linux-mm@...ck.org,
        linux-kernel@...r.kernel.org, muchun.song@...ux.dev
Subject: Re: [PATCH] mm: kfence: fix using kfence_metadata without
 initialization in show_object()

On Wed, 15 Mar 2023 at 20:54, Andrew Morton <akpm@...ux-foundation.org> wrote:
>
> On Wed, 15 Mar 2023 09:07:40 +0100 Marco Elver <elver@...gle.com> wrote:
>
> > On Wed, 15 Mar 2023 at 04:45, Muchun Song <songmuchun@...edance.com> wrote:
> > >
> > > The variable kfence_metadata is initialized in kfence_init_pool(), then, it is
> > > not initialized if kfence is disabled after booting. In this case, kfence_metadata
> > > will be used (e.g. ->lock and ->state fields) without initialization when reading
> > > /sys/kernel/debug/kfence/objects. There will be a warning if you enable
> > > CONFIG_DEBUG_SPINLOCK. Fix it by creating debugfs files when necessary.
> > >
> > > Fixes: 0ce20dd84089 ("mm: add Kernel Electric-Fence infrastructure")
> > > Signed-off-by: Muchun Song <songmuchun@...edance.com>
> >
> > Tested-by: Marco Elver <elver@...gle.com>
> > Reviewed-by: Marco Elver <elver@...gle.com>
>
> Thanks, I'll add cc:stable to this.
>
> I assume the warning is the only known adverse effect of this bug?

For architectures where the initial spinlock state is 0, the warning
is the only issue. For architectures where that's not the case, it
might result in lockup of the task querying the 'objects' file --
which isn't the case for any arch that supports KFENCE by the looks of
it (last I checked 'sh' and 'parisc' don't support KFENCE).

Thanks,
-- Marco