Skip to content

Commit

Permalink
mm/alloc_tag: fix vm_module_tags_populate's KASAN poisoning logic
Browse files Browse the repository at this point in the history
After commit 233e893 ("alloc_tag: fix module allocation tags
populated area calculation"), We still encountered a KASAN bug.

This is because we have only actually performed page allocation and
address mapping here.  we need to unpoisoned portions of underlying
memory.

Here is the log for KASAN:

[    5.041171][    T1] ==================================================================
[    5.042047][    T1] BUG: KASAN: vmalloc-out-of-bounds in move_module+0x2c0/0x708
[    5.042723][    T1] Write of size 240 at addr ffff80007e510000 by task systemd/1
[    5.043412][    T1]
[    5.043523][   T72] input: QEMU QEMU USB Tablet as /devices/pci0000:00/0000:00:01.1/0000:02:001
[    5.043614][    T1] CPU: 0 UID: 0 PID: 1 Comm: systemd Not tainted 6.13.0-rc1+ torvalds#28
[    5.045560][    T1] Hardware name: QEMU KVM Virtual Machine, BIOS 0.0.0 02/06/2015
[    5.046328][    T1] Call trace:
[    5.046670][    T1]  show_stack+0x20/0x38 (C)
[    5.047127][    T1]  dump_stack_lvl+0x80/0xf8
[    5.047533][    T1]  print_address_description.constprop.0+0x58/0x358
[    5.048092][   T72] hid-generic 0003:0627:0001.0001: input,hidraw0: USB HID v0.01 Mouse [QEMU 0
[    5.048126][    T1]  print_report+0xb0/0x280
[    5.049682][    T1]  kasan_report+0xb8/0x108
[    5.050170][    T1]  kasan_check_range+0xe8/0x190
[    5.050685][    T1]  memcpy+0x58/0xa0
[    5.051135][    T1]  move_module+0x2c0/0x708
[    5.051586][    T1]  layout_and_allocate.constprop.0+0x308/0x5b8
[    5.052219][    T1]  load_module+0x134/0x16c8
[    5.052671][    T1]  init_module_from_file+0xdc/0x138
[    5.053193][    T1]  idempotent_init_module+0x344/0x600
[    5.053742][    T1]  __arm64_sys_finit_module+0xbc/0x150
[    5.054289][    T1]  invoke_syscall+0xd4/0x258
[    5.054749][    T1]  el0_svc_common.constprop.0+0xb4/0x240
[    5.055319][    T1]  do_el0_svc+0x48/0x68
[    5.055743][    T1]  el0_svc+0x40/0xe0
[    5.056142][    T1]  el0t_64_sync_handler+0x10c/0x138
[    5.056658][    T1]  el0t_64_sync+0x1ac/0x1b0

Link: https://lkml.kernel.org/r/20241205170528.81000-1-hao.ge@linux.dev
Fixes: 233e893 ("alloc_tag: fix module allocation tags populated area calculation")
Signed-off-by: Hao Ge <gehao@kylinos.cn>
Acked-by: Suren Baghdasaryan <surenb@google.com>
Cc: David Wang <00107082@163.com>
Cc: Kent Overstreet <kent.overstreet@linux.dev>
Cc: Mike Rapoport (Microsoft) <rppt@kernel.org>
Cc: Pasha Tatashin <pasha.tatashin@soleen.com>
Cc: Sourav Panda <souravpanda@google.com>
Cc: Yu Zhao <yuzhao@google.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
  • Loading branch information
GeHao01994 authored and akpm00 committed Dec 7, 2024
1 parent 8bb0c37 commit e5113a7
Showing 1 changed file with 9 additions and 0 deletions.
9 changes: 9 additions & 0 deletions lib/alloc_tag.c
Original file line number Diff line number Diff line change
Expand Up @@ -424,6 +424,15 @@ static int vm_module_tags_populate(void)
vm_module_tags->nr_pages += nr;
}

/*
* Mark the pages as accessible, now that they are mapped.
* With hardware tag-based KASAN, marking is skipped for
* non-VM_ALLOC mappings, see __kasan_unpoison_vmalloc().
*/
kasan_unpoison_vmalloc((void *)module_tags.start_addr,
new_end - module_tags.start_addr,
KASAN_VMALLOC_PROT_NORMAL);

return 0;
}

Expand Down

0 comments on commit e5113a7

Please sign in to comment.