linux-kernel - Re: [PING PATCH] powerpc/kasan: Fix addr error caused by page alignment

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <dfc07bfb-4fcc-4aa8-bfe6-3987b6741b82@csgroup.eu>
Date: Tue, 23 Jan 2024 07:10:10 +0000
From: Christophe Leroy <christophe.leroy@...roup.eu>
To: Jiangfeng Xiao <xiaojiangfeng@...wei.com>, "npiggin@...il.com"
	<npiggin@...il.com>, "aneesh.kumar@...nel.org" <aneesh.kumar@...nel.org>,
	"naveen.n.rao@...ux.ibm.com" <naveen.n.rao@...ux.ibm.com>,
	"mpe@...erman.id.au" <mpe@...erman.id.au>
CC: "linuxppc-dev@...ts.ozlabs.org" <linuxppc-dev@...ts.ozlabs.org>,
	"linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
	"nixiaoming@...wei.com" <nixiaoming@...wei.com>, "wangbing6@...wei.com"
	<wangbing6@...wei.com>, "douzhaolei@...wei.com" <douzhaolei@...wei.com>,
	"wangfangpeng1@...wei.com" <wangfangpeng1@...wei.com>
Subject: Re: [PING PATCH] powerpc/kasan: Fix addr error caused by page
 alignment



Le 23/01/2024 à 02:45, Jiangfeng Xiao a écrit :
> [Vous ne recevez pas souvent de courriers de xiaojiangfeng@...wei.com. Découvrez pourquoi ceci est important à https://aka.ms/LearnAboutSenderIdentification ]
> 
> In kasan_init_region, when k_start is not page aligned,
> at the begin of for loop, k_cur = k_start & PAGE_MASK
> is less than k_start, and then va = block + k_cur - k_start
> is less than block, the addr va is invalid, because the
> memory address space from va to block is not alloced by
> memblock_alloc, which will not be reserved
> by memblock_reserve later, it will be used by other places.
> 
> As a result, memory overwriting occurs.
> 
> for example:
> int __init __weak kasan_init_region(void *start, size_t size)
> {
> [...]
>          /* if say block(dcd97000) k_start(feef7400) k_end(feeff3fe) */
>          block = memblock_alloc(k_end - k_start, PAGE_SIZE);
>          [...]
>          for (k_cur = k_start & PAGE_MASK; k_cur < k_end; k_cur += PAGE_SIZE) {
>                  /* at the begin of for loop
>                   * block(dcd97000) va(dcd96c00) k_cur(feef7000) k_start(feef7400)
>                   * va(dcd96c00) is less than block(dcd97000), va is invalid
>                   */
>                  void *va = block + k_cur - k_start;
>                  [...]
>          }
> [...]
> }
> 
> Therefore, page alignment is performed on k_start before
> memblock_alloc to ensure the validity of the VA address.
> 
> Fixes: 663c0c9496a6 ("powerpc/kasan: Fix shadow area set up for modules.")
> 
> Signed-off-by: Jiangfeng Xiao <xiaojiangfeng@...wei.com>

Be patient, your patch is not lost. Now we have it twice, see:

https://patchwork.ozlabs.org/project/linuxppc-dev/list/?submitter=76392

> ---
>   arch/powerpc/mm/kasan/init_32.c | 1 +
>   1 file changed, 1 insertion(+)
> 
> diff --git a/arch/powerpc/mm/kasan/init_32.c b/arch/powerpc/mm/kasan/init_32.c
> index a70828a..aa9aa11 100644
> --- a/arch/powerpc/mm/kasan/init_32.c
> +++ b/arch/powerpc/mm/kasan/init_32.c
> @@ -64,6 +64,7 @@ int __init __weak kasan_init_region(void *start, size_t size)
>          if (ret)
>                  return ret;
> 
> +       k_start = k_start & PAGE_MASK;
>          block = memblock_alloc(k_end - k_start, PAGE_SIZE);
>          if (!block)
>                  return -ENOMEM;
> --
> 1.8.5.6
>