From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-26.3 required=3.0 tests=BAYES_00,DKIMWL_WL_MED, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS, INCLUDES_CR_TRAILER,INCLUDES_PATCH,MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS, URIBL_BLOCKED,USER_AGENT_GIT,USER_IN_DEF_DKIM_WL autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 10520C432BE for ; Wed, 18 Aug 2021 13:03:11 +0000 (UTC) Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by mail.kernel.org (Postfix) with ESMTP id 9CD4361053 for ; Wed, 18 Aug 2021 13:03:10 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.4.1 mail.kernel.org 9CD4361053 Authentication-Results: mail.kernel.org; dmarc=fail (p=reject dis=none) header.from=google.com Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=kvack.org Received: by kanga.kvack.org (Postfix) id E0D706B006C; Wed, 18 Aug 2021 09:03:09 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id DBCEC8D0001; Wed, 18 Aug 2021 09:03:09 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id CAB9B6B0073; Wed, 18 Aug 2021 09:03:09 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from forelay.hostedemail.com (smtprelay0152.hostedemail.com [216.40.44.152]) by kanga.kvack.org (Postfix) with ESMTP id B45696B006C for ; Wed, 18 Aug 2021 09:03:09 -0400 (EDT) Received: from smtpin27.hostedemail.com (10.5.19.251.rfc1918.com [10.5.19.251]) by forelay05.hostedemail.com (Postfix) with ESMTP id 463CE180199B4 for ; Wed, 18 Aug 2021 13:03:09 +0000 (UTC) X-FDA: 78488216898.27.7EC55B6 Received: from mail-wm1-f73.google.com (mail-wm1-f73.google.com [209.85.128.73]) by imf16.hostedemail.com (Postfix) with ESMTP id 6C628F003E71 for ; Wed, 18 Aug 2021 13:03:07 +0000 (UTC) Received: by mail-wm1-f73.google.com with SMTP id g70-20020a1c20490000b02902e6753bf473so2237070wmg.0 for ; Wed, 18 Aug 2021 06:03:07 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=date:message-id:mime-version:subject:from:to:cc; bh=RrG3CyO9Gjt37gk9O8igCLRvqsHUd/YOk6xR8PM41xQ=; b=mUuxo16hVJ+iZgyLxC/SaVrM1114EX1QQ8bF2KypKKGX1JQEyAfvoujkSpT0sGjXTh MmG7VHJVTVnSrFHhgY0E8Xr0I7tz+ZAMbyqFV312p3CuLzmNv/iH1Rjv/ge2Oe426hqh pup5K/Ou0j9iqKQLgX+OxbxI8iAoZyYbSleEejVKg5aDm+a0zwEyEkD6QzV7IEUCMxs8 jaydHwdr9D2u1R3P9aAmXFZ/SavvdP9B7wfMP3mRTX1DjzGLo5XGcaZD6GGDueu7ehZe nqpdtyOxPLHHmPgYQUVC1EMuERPjPRKxHlidRCzvKDJKXzywaY5qkAhb2zSu0pifJh3g 1C8A== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:date:message-id:mime-version:subject:from:to:cc; bh=RrG3CyO9Gjt37gk9O8igCLRvqsHUd/YOk6xR8PM41xQ=; b=cHdqbhw01zlKhbiJ38ss1L7UdwrmIfXnIM4er/gdBE2C/N9NGt4BysPcJZ/Q+x5snC /VCBsuFfjsKTrL7RW+aPFtcfxrye+wQT9ULMuKYdhO+1qgFTFq/eOMXafYxHpXizX1lU NniST5GZyZIV+qOEmHraooBVomFNMdNHGBlSMDCIfnxDSDHVrVhXFM0OI2xSQm38+mcG 2jtI+wWFzIz77Tg4qEMlam7ah56X0OUfFtMIbSplp4SFjM94+FzkRDxADdCG1N9tNW6T tKMtyfY68iw8ubzGSMzxJfNIMNB4ZyTRkmCd5ngZrKl+Rrjwa8i6NGIvXZKaAxy63GHR MbYw== X-Gm-Message-State: AOAM531zAlQny/dLQfZezgnsW97Iyn5IJ5B2ms1Y8hMdg1vO0uCc/4cQ vv6ngLZK7JhAwxUFK33MRIorgdwFQg== X-Google-Smtp-Source: ABdhPJzbSbjgQk5lmEa3hM+PK3vcJ+Jbea7iM+3mGTQTNzNWuNnofg3TzKJCoftHPaHYa4/ctrMFY6/l4Q== X-Received: from elver.muc.corp.google.com ([2a00:79e0:15:13:52dc:2f6d:34df:96a5]) (user=elver job=sendgmr) by 2002:a05:600c:35d3:: with SMTP id r19mr574288wmq.1.1629291785265; Wed, 18 Aug 2021 06:03:05 -0700 (PDT) Date: Wed, 18 Aug 2021 15:03:00 +0200 Message-Id: <20210818130300.2482437-1-elver@google.com> Mime-Version: 1.0 X-Mailer: git-send-email 2.33.0.rc1.237.g0d66db33f3-goog Subject: [PATCH] kfence: fix is_kfence_address() for addresses below KFENCE_POOL_SIZE From: Marco Elver To: elver@google.com, akpm@linux-foundation.org Cc: glider@google.com, dvyukov@google.com, linux-kernel@vger.kernel.org, linux-mm@kvack.org, kasan-dev@googlegroups.com, Kuan-Ying Lee , stable@vger.kernel.org Content-Type: text/plain; charset="UTF-8" X-Rspamd-Queue-Id: 6C628F003E71 Authentication-Results: imf16.hostedemail.com; dkim=pass header.d=google.com header.s=20161025 header.b=mUuxo16h; dmarc=pass (policy=reject) header.from=google.com; spf=pass (imf16.hostedemail.com: domain of 3CQUdYQUKCJY4BL4H6EE6B4.2ECB8DKN-CCAL02A.EH6@flex--elver.bounces.google.com designates 209.85.128.73 as permitted sender) smtp.mailfrom=3CQUdYQUKCJY4BL4H6EE6B4.2ECB8DKN-CCAL02A.EH6@flex--elver.bounces.google.com X-Rspamd-Server: rspam04 X-Stat-Signature: j8ubrm54bnk1k9769j1mjjgwmassex86 X-HE-Tag: 1629291787-384973 X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: Originally the addr != NULL check was meant to take care of the case where __kfence_pool == NULL (KFENCE is disabled). However, this does not work for addresses where addr > 0 && addr < KFENCE_POOL_SIZE. This can be the case on NULL-deref where addr > 0 && addr < PAGE_SIZE or any other faulting access with addr < KFENCE_POOL_SIZE. While the kernel would likely crash, the stack traces and report might be confusing due to double faults upon KFENCE's attempt to unprotect such an address. Fix it by just checking that __kfence_pool != NULL instead. Fixes: 0ce20dd84089 ("mm: add Kernel Electric-Fence infrastructure") Reported-by: Kuan-Ying Lee Signed-off-by: Marco Elver Cc: [5.12+] --- include/linux/kfence.h | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/include/linux/kfence.h b/include/linux/kfence.h index a70d1ea03532..3fe6dd8a18c1 100644 --- a/include/linux/kfence.h +++ b/include/linux/kfence.h @@ -51,10 +51,11 @@ extern atomic_t kfence_allocation_gate; static __always_inline bool is_kfence_address(const void *addr) { /* - * The non-NULL check is required in case the __kfence_pool pointer was - * never initialized; keep it in the slow-path after the range-check. + * The __kfence_pool != NULL check is required to deal with the case + * where __kfence_pool == NULL && addr < KFENCE_POOL_SIZE. Keep it in + * the slow-path after the range-check! */ - return unlikely((unsigned long)((char *)addr - __kfence_pool) < KFENCE_POOL_SIZE && addr); + return unlikely((unsigned long)((char *)addr - __kfence_pool) < KFENCE_POOL_SIZE && __kfence_pool); } /** -- 2.33.0.rc1.237.g0d66db33f3-goog