lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Message-Id: <20240314142656.17699-1-anton@tuxera.com>
Date: Thu, 14 Mar 2024 14:26:56 +0000
From: Anton Altaparmakov <anton@...era.com>
To: "Rafael J . Wysocki" <rafael@...nel.org>,
	Pavel Machek <pavel@....cz>,
	Thomas Gleixner <tglx@...utronix.de>,
	Ingo Molnar <mingo@...hat.com>,
	Borislav Petkov <bp@...en8.de>,
	Dave Hansen <dave.hansen@...ux.intel.com>,
	x86@...nel.org,
	"H . Peter Anvin" <hpa@...or.com>,
	Chen Yu <yu.c.chen@...el.com>
Cc: Pawan Gupta <pawan.kumar.gupta@...ux.intel.com>,
	Catalin Marinas <catalin.marinas@....com>,
	linux-mm@...ck.org,
	Matthieu Baerts <matthieu.baerts@...sares.net>,
	Mat Martineau <mathew.j.martineau@...ux.intel.com>,
	"Rafael J . Wysocki" <rafael.j.wysocki@...el.com>,
	Ingo Molnar <mingo@...nel.org>,
	linux-pm@...r.kernel.org,
	linux-kernel@...r.kernel.org,
	Anton Altaparmakov <anton@...era.com>,
	stable@...r.kernel.org
Subject: [PATCH] x86/pm: Fix false positive kmemleak report in msr_build_context().

Since

  7ee18d677989 ("x86/power: Make restore_processor_context() sane")

kmemleak reports this issue:

unreferenced object 0xf68241e0 (size 32):
  comm "swapper/0", pid 1, jiffies 4294668610 (age 68.432s)
  hex dump (first 32 bytes):
    00 cc cc cc 29 10 01 c0 00 00 00 00 00 00 00 00  ....)...........
    00 42 82 f6 cc cc cc cc cc cc cc cc cc cc cc cc  .B..............
  backtrace:
    [<461c1d50>] __kmem_cache_alloc_node+0x106/0x260
    [<ea65e13b>] __kmalloc+0x54/0x160
    [<c3858cd2>] msr_build_context.constprop.0+0x35/0x100
    [<46635aff>] pm_check_save_msr+0x63/0x80
    [<6b6bb938>] do_one_initcall+0x41/0x1f0
    [<3f3add60>] kernel_init_freeable+0x199/0x1e8
    [<3b538fde>] kernel_init+0x1a/0x110
    [<938ae2b2>] ret_from_fork+0x1c/0x28

Reproducer:

- Run rsync of whole kernel tree (multiple times if needed).
- start a kmemleak scan
- Note this is just an example: a lot of our internal tests hit these.

The root cause is we expect the same as the equivalent fix in commit
b0b592cf0836, i.e. the alignment within the packed struct saved_context
which has everything unaligned as there is only "u16 gs;" at start of
struct where in the past there were four u16 there thus aligning
everything afterwards.  The issue is with the fact that Kmemleak only
searches for pointers that are aligned (see how pointers are scanned in
kmemleak.c) so when the struct members are not aligned it doesn't see
them.

Note we have picked this up on 5.4, 6.1 and 6.6 kernels but we expect it
is the same on all kernels >= 4.15 as the commit 7ee18d677989 which
changed from having four u16 to a single u16 at the start of the struct
was introduced in 4.15.

Fixes: 7ee18d677989 ("x86/power: Make restore_processor_context() sane")
Signed-off-by: Anton Altaparmakov <anton@...era.com>
Cc: stable@...r.kernel.org
---
 arch/x86/include/asm/suspend_32.h | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/arch/x86/include/asm/suspend_32.h b/arch/x86/include/asm/suspend_32.h
index a800abb1a992..d8416b3bf832 100644
--- a/arch/x86/include/asm/suspend_32.h
+++ b/arch/x86/include/asm/suspend_32.h
@@ -12,11 +12,6 @@
 
 /* image of the saved processor state */
 struct saved_context {
-	/*
-	 * On x86_32, all segment registers except gs are saved at kernel
-	 * entry in pt_regs.
-	 */
-	u16 gs;
 	unsigned long cr0, cr2, cr3, cr4;
 	u64 misc_enable;
 	struct saved_msrs saved_msrs;
@@ -27,6 +22,11 @@ struct saved_context {
 	unsigned long tr;
 	unsigned long safety;
 	unsigned long return_address;
+	/*
+	 * On x86_32, all segment registers except gs are saved at kernel
+	 * entry in pt_regs.
+	 */
+	u16 gs;
 	bool misc_enable_saved;
 } __attribute__((packed));
 
-- 
2.39.3 (Apple Git-146)


Powered by blists - more mailing lists

Powered by Openwall GNU/*/Linux Powered by OpenVZ