Commit e269b5d2 authored by Suren Baghdasaryan's avatar Suren Baghdasaryan Committed by Andrew Morton
Browse files

alloc_tag: fix module allocation tags populated area calculation 

vm_module_tags_populate() calculation of the populated area assumes that
area starts at a page boundary and therefore when new pages are allocation,
the end of the area is page-aligned as well. If the start of the area is
not page-aligned then allocating a page and incrementing the end of the
area by PAGE_SIZE leads to an area at the end but within the area boundary
which is not populated. Accessing this are will lead to a kernel panic.
Fix the calculation by down-aligning the start of the area and using that
as the location allocated pages are mapped to.

[gehao@kylinos.cn: fix vm_module_tags_populate's KASAN poisoning logic]
  Link: https://lkml.kernel.org/r/20241205170528.81000-1-hao.ge@linux.dev
[gehao@kylinos.cn: fix panic when CONFIG_KASAN enabled and CONFIG_KASAN_VMALLOC not enabled]
  Link: https://lkml.kernel.org/r/20241212072126.134572-1-hao.ge@linux.dev
Link: https://lkml.kernel.org/r/20241130001423.1114965-1-surenb@google.com


Fixes: 0f9b6856 ("alloc_tag: populate memory for module tags as needed")
Signed-off-by: default avatarSuren Baghdasaryan <surenb@google.com>
Reported-by: default avatarkernel test robot <oliver.sang@intel.com>
Closes: https://lore.kernel.org/oe-lkp/202411132111.6a221562-lkp@intel.com


Acked-by: default avatarYu Zhao <yuzhao@google.com>
Tested-by: default avatarAdrian Huang <ahuang12@lenovo.com>
Cc: David Wang <00107082@163.com>
Cc: Kent Overstreet <kent.overstreet@linux.dev>
Cc: Mike Rapoport (Microsoft) <rppt@kernel.org>
Cc: Pasha Tatashin <pasha.tatashin@soleen.com>
Cc: Sourav Panda <souravpanda@google.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
parent 640a6039

lib/alloc_tag.c

+29 −5
Original line number Diff line number Diff line
@@ -408,28 +408,52 @@ static bool find_aligned_area(struct ma_state *mas, unsigned long section_size, 


static int vm_module_tags_populate(void)

{

	unsigned long phys_size = vm_module_tags->nr_pages << PAGE_SHIFT;

	unsigned long phys_end = ALIGN_DOWN(module_tags.start_addr, PAGE_SIZE) +

				 (vm_module_tags->nr_pages << PAGE_SHIFT);

	unsigned long new_end = module_tags.start_addr + module_tags.size;



	if (phys_size < module_tags.size) {

	if (phys_end < new_end) {

		struct page **next_page = vm_module_tags->pages + vm_module_tags->nr_pages;

		unsigned long addr = module_tags.start_addr + phys_size;

		unsigned long old_shadow_end = ALIGN(phys_end, MODULE_ALIGN);

		unsigned long new_shadow_end = ALIGN(new_end, MODULE_ALIGN);

		unsigned long more_pages;

		unsigned long nr;



		more_pages = ALIGN(module_tags.size - phys_size, PAGE_SIZE) >> PAGE_SHIFT;

		more_pages = ALIGN(new_end - phys_end, PAGE_SIZE) >> PAGE_SHIFT;

		nr = alloc_pages_bulk_array_node(GFP_KERNEL | __GFP_NOWARN,

						 NUMA_NO_NODE, more_pages, next_page);

		if (nr < more_pages ||

		    vmap_pages_range(addr, addr + (nr << PAGE_SHIFT), PAGE_KERNEL,

		    vmap_pages_range(phys_end, phys_end + (nr << PAGE_SHIFT), PAGE_KERNEL,

				     next_page, PAGE_SHIFT) < 0) {

			/* Clean up and error out */

			for (int i = 0; i < nr; i++)

				__free_page(next_page[i]);

			return -ENOMEM;

		}



		vm_module_tags->nr_pages += nr;



		/*

		 * Kasan allocates 1 byte of shadow for every 8 bytes of data.

		 * When kasan_alloc_module_shadow allocates shadow memory,

		 * its unit of allocation is a page.

		 * Therefore, here we need to align to MODULE_ALIGN.

		 */

		if (old_shadow_end < new_shadow_end)

			kasan_alloc_module_shadow((void *)old_shadow_end,

						  new_shadow_end - old_shadow_end,

						  GFP_KERNEL);

	}



	/*

	 * Mark the pages as accessible, now that they are mapped.

	 * With hardware tag-based KASAN, marking is skipped for

	 * non-VM_ALLOC mappings, see __kasan_unpoison_vmalloc().

	 */

	kasan_unpoison_vmalloc((void *)module_tags.start_addr,

				new_end - module_tags.start_addr,

				KASAN_VMALLOC_PROT_NORMAL);



	return 0;

}