linux-kernel - [PATCH] mm: kmemleak: Fix upper boundary check for physical address objects

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-Id: <20250127184233.2974311-1-catalin.marinas@arm.com>
Date: Mon, 27 Jan 2025 18:42:33 +0000
From: Catalin Marinas <catalin.marinas@....com>
To: linux-mm@...ck.org
Cc: linux-kernel@...r.kernel.org,
	Jakub Kicinski <kuba@...nel.org>,
	"Matthieu Baerts (NGI0)" <matttbe@...nel.org>,
	Patrick Wang <patrick.wang.shcn@...il.com>,
	Andrew Morton <akpm@...ux-foundation.org>
Subject: [PATCH] mm: kmemleak: Fix upper boundary check for physical address objects

Memblock allocations are registered by kmemleak separately, based on
their physical address. During the scanning stage, it checks whether an
object is within the min_low_pfn and max_low_pfn boundaries and ignores
it otherwise.

With the recent addition of __percpu pointer leak detection (commit
6c99d4eb7c5e ("kmemleak: enable tracking for percpu pointers")),
kmemleak started reporting leaks in setup_zone_pageset() and
setup_per_cpu_pageset(). These were caused by the node_data[0] object
(initialised in alloc_node_data()) ending on the PFN_PHYS(max_low_pfn)
boundary. The non-strict upper boundary check introduced by commit
84c326299191 ("mm: kmemleak: check physical address when scan") causes
the pg_data_t object to be ignored (not scanned) and the __percpu
pointers it contains to be reported as leaks.

Make the max_low_pfn upper boundary check strict when deciding whether
to ignore a physical address object and not scan it.

Signed-off-by: Catalin Marinas <catalin.marinas@....com>
Fixes: 84c326299191 ("mm: kmemleak: check physical address when scan")
Reported-by: Jakub Kicinski <kuba@...nel.org>
Tested-by: Matthieu Baerts (NGI0) <matttbe@...nel.org>
Cc: Patrick Wang <patrick.wang.shcn@...il.com>
Cc: Andrew Morton <akpm@...ux-foundation.org>
Cc: <stable@...r.kernel.org> # 6.0.x
---
 mm/kmemleak.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/mm/kmemleak.c b/mm/kmemleak.c
index 820ba3b5cbfc..bb7d61fc4da3 100644
--- a/mm/kmemleak.c
+++ b/mm/kmemleak.c
@@ -1689,7 +1689,7 @@ static void kmemleak_scan(void)
 			unsigned long phys = object->pointer;

 			if (PHYS_PFN(phys) < min_low_pfn ||
-			    PHYS_PFN(phys + object->size) >= max_low_pfn)
+			    PHYS_PFN(phys + object->size) > max_low_pfn)
 				__paint_it(object, KMEMLEAK_BLACK);
 		}