From patchwork Wed Apr 27 07:11:00 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: CGEL X-Patchwork-Id: 12828388 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id 97585C433F5 for ; Wed, 27 Apr 2022 07:11:15 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id 11CDE6B0073; Wed, 27 Apr 2022 03:11:15 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id 0CCE26B0075; Wed, 27 Apr 2022 03:11:15 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id ED5AA6B0078; Wed, 27 Apr 2022 03:11:14 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (relay.hostedemail.com [64.99.140.26]) by kanga.kvack.org (Postfix) with ESMTP id DF8316B0073 for ; Wed, 27 Apr 2022 03:11:14 -0400 (EDT) Received: from smtpin03.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay10.hostedemail.com (Postfix) with ESMTP id B57191E6E for ; Wed, 27 Apr 2022 07:11:14 +0000 (UTC) X-FDA: 79401787668.03.877225D Received: from mail-qt1-f182.google.com (mail-qt1-f182.google.com [209.85.160.182]) by imf02.hostedemail.com (Postfix) with ESMTP id 260CA8005A for ; Wed, 27 Apr 2022 07:11:10 +0000 (UTC) Received: by mail-qt1-f182.google.com with SMTP id bz24so559379qtb.2 for ; Wed, 27 Apr 2022 00:11:13 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20210112; h=from:to:cc:subject:date:message-id:mime-version :content-transfer-encoding; bh=qwksdRpUlSuuWw1pxLBKhXiKlPkBnGHl88zbVVW36PY=; b=bsJROiROPQI0CsqMnAU6Zn7PpVxK7aTUo+iIBZoUNDEIFoqqMoAIb+ro5u2z39wvn+ ZpnnaPrlsPavmtXobVUPXO7DinfDMHRXTYhe1D7GPwqq1Iiue7gYtYrfmgyBNzqlFYcQ 52iWjNSjM9V9cjATe8QeqZs9VyFE1KaXI7ItMzVouBWAdWHU3FEtLFzMveTBPP2tlmFY VGd+s0jj+Os3pyDguKVysA/u8eytIqIFuM+3iBIKmCfAFAnHRaZ7UtcJmyWRI5ZjofjS /Ge00AoCsaES6hu+sPktSVptY3wMwIRjcZu7WtwtPOvcY7AlqzsOySbXPALHoLlfkjXG VoeQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:from:to:cc:subject:date:message-id:mime-version :content-transfer-encoding; bh=qwksdRpUlSuuWw1pxLBKhXiKlPkBnGHl88zbVVW36PY=; b=PCcj4piDmUghSSiyIh8Vi5jhzscXNqsqBNcve+sUrnbjbMW7eJ1qlRKuJEg9EXquZx mFudytMZ0uT17iDXesSGDbBfahi2LB+b+v5HcimZMthQ3tpUFlQ7nKgjIvO2oTiTfnnU Tgy+oQEXvbNwDvmI57s1LbW7lmQuh3hbwnJgyu1E+fSycrcyVgE0lCUlLfbB2uycYeDz qumew/JX+lEsZpLg6fkGJBNu/w1enk/u1v/fJMJii7KqIHR/K3gYPtrlE7Na5WD5NDpn RPfb6kpYhn1+Ppp4/80vUzjKOAWPG+O99vCQ1r3SOguuG+g7tBwWENvof7cCXbesbcZZ cy7A== X-Gm-Message-State: AOAM530tSZoMhOTy1OueWqQJbOyoA5909SgjQGz9HFcJ9MxS6/WTaSBn WN2riA3npHzJrD/aeu67H3Y= X-Google-Smtp-Source: ABdhPJxMpMlJ7xIUpezGsO2arZ+rxxRuzF/61noOP3FbtioWh6NWIyWd83VIO3CWtZOF3/zVxLlemw== X-Received: by 2002:a05:622a:58e:b0:2f3:81c7:cc59 with SMTP id c14-20020a05622a058e00b002f381c7cc59mr2565899qtb.614.1651043473412; Wed, 27 Apr 2022 00:11:13 -0700 (PDT) Received: from localhost.localdomain ([193.203.214.57]) by smtp.gmail.com with ESMTPSA id y13-20020a05622a164d00b002f1ff52c518sm9238002qtj.28.2022.04.27.00.11.09 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 27 Apr 2022 00:11:12 -0700 (PDT) From: cgel.zte@gmail.com X-Google-Original-From: xu.xin16@zte.com.cn To: glider@google.com, elver@google.com, akpm@linux-foundation.org Cc: dvyukov@google.com, kasan-dev@googlegroups.com, linux-kernel@vger.kernel.org, linux-mm@kvack.org, xu xin , Zeal Robot Subject: [PATCH] mm/kfence: fix a potential NULL pointer dereference Date: Wed, 27 Apr 2022 07:11:00 +0000 Message-Id: <20220427071100.3844081-1-xu.xin16@zte.com.cn> X-Mailer: git-send-email 2.25.1 MIME-Version: 1.0 X-Rspamd-Server: rspam02 X-Rspamd-Queue-Id: 260CA8005A X-Stat-Signature: p9r3w4hruuidjh1tb18baf91ywpw7dt1 X-Rspam-User: Authentication-Results: imf02.hostedemail.com; dkim=pass header.d=gmail.com header.s=20210112 header.b=bsJROiRO; spf=pass (imf02.hostedemail.com: domain of cgel.zte@gmail.com designates 209.85.160.182 as permitted sender) smtp.mailfrom=cgel.zte@gmail.com; dmarc=pass (policy=none) header.from=gmail.com X-HE-Tag: 1651043470-947618 X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: From: xu xin In __kfence_free(), the returned 'meta' from addr_to_metadata() might be NULL just as the implementation of addr_to_metadata() shows. Let's add a check of the pointer 'meta' to avoid NULL pointer dereference. The patch brings three changes: 1. Add checks in both kfence_free() and __kfence_free(); 2. kfence_free is not inline function any longer and new inline function '__try_free_kfence_meta' is introduced. 3. The check of is_kfence_address() is not required for __kfence_free() now because __kfence_free has done the check in addr_to_metadata(); Reported-by: Zeal Robot Signed-off-by: xu xin Reported-by: kernel test robot Reported-by: kernel test robot Reported-by: kernel test robot --- include/linux/kfence.h | 10 ++-------- mm/kfence/core.c | 30 +++++++++++++++++++++++++++--- 2 files changed, 29 insertions(+), 11 deletions(-) diff --git a/include/linux/kfence.h b/include/linux/kfence.h index 726857a4b680..fbf6391ab53c 100644 --- a/include/linux/kfence.h +++ b/include/linux/kfence.h @@ -160,7 +160,7 @@ void *kfence_object_start(const void *addr); * __kfence_free() - release a KFENCE heap object to KFENCE pool * @addr: object to be freed * - * Requires: is_kfence_address(addr) + * Requires: is_kfence_address(addr), but now it's unnecessary * * Release a KFENCE object and mark it as freed. */ @@ -179,13 +179,7 @@ void __kfence_free(void *addr); * allocator's free codepath. The allocator must check the return value to * determine if it was a KFENCE object or not. */ -static __always_inline __must_check bool kfence_free(void *addr) -{ - if (!is_kfence_address(addr)) - return false; - __kfence_free(addr); - return true; -} +bool __must_check kfence_free(void *addr); /** * kfence_handle_page_fault() - perform page fault handling for KFENCE pages diff --git a/mm/kfence/core.c b/mm/kfence/core.c index 6e69986c3f0d..1405585369b3 100644 --- a/mm/kfence/core.c +++ b/mm/kfence/core.c @@ -1048,10 +1048,10 @@ void *kfence_object_start(const void *addr) return meta ? (void *)meta->addr : NULL; } -void __kfence_free(void *addr) -{ - struct kfence_metadata *meta = addr_to_metadata((unsigned long)addr); +/* Require: meta is not NULL*/ +static __always_inline void __try_free_kfence_meta(struct kfence_metadata *meta) +{ #ifdef CONFIG_MEMCG KFENCE_WARN_ON(meta->objcg); #endif @@ -1067,6 +1067,30 @@ void __kfence_free(void *addr) kfence_guarded_free(addr, meta, false); } +void __kfence_free(void *addr) +{ + struct kfence_metadata *meta = addr_to_metadata((unsigned long)addr); + + if (!meta) { + kfence_report_error(addr, false, NULL, NULL, KFENCE_ERROR_INVALID); + return; + } + + __try_free_kfence_meta(meta); +} + +bool __must_check kfence_free(void *addr) +{ + struct kfence_metadata *meta = addr_to_metadata((unsigned long)addr); + + if (!meta) + return false; + + __try_free_kfence_meta(meta); + + return true; +} + bool kfence_handle_page_fault(unsigned long addr, bool is_write, struct pt_regs *regs) { const int page_index = (addr - (unsigned long)__kfence_pool) / PAGE_SIZE;