Re: [RFC PATCH 05/13] mm/kwatch: add watch expression parser and dereference engine

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] kwatch_deref_resolve fails to validate intermediate pointers against the kernel-space boundary, leading to potential kernel panics.
--

--- Patch [5]: [RFC PATCH 05/13] mm/kwatch: add watch expression parser and dereference engine ---
commit 2105aab4719c42ad84e86aced2cb286ed992fb63
Author: Jinchao Wang <wangjinchao600@gmail.com>

mm/kwatch: add watch expression parser and dereference engine

This commit introduces the watch expression parser and dereference engine
for KWatch. It provides functions to parse a textual watch expression into
a configuration and resolve the pointer chain dynamically at probe time.

> diff --git a/mm/kwatch/deref.c b/mm/kwatch/deref.c
> new file mode 100644
> index 0000000000000..a93c76139e7cd
> --- /dev/null
> +++ b/mm/kwatch/deref.c
[ ... ]
> +int kwatch_deref_resolve(const struct kwatch_config *cfg, struct pt_regs *regs,
> +			 unsigned long *out_addr, u16 *out_len)
> +{
[ ... ]
> +	/* 2. The Pointer-Chasing FSM */
> +	for (i = 0; i < cfg->offset_count; i++) {
> +		addr += cfg->offsets[i];
> +
> +		if (i < cfg->offset_count - 1) {
> +			unsigned long next_addr;
> +
> +			/* Dynamically read the pointer contents at runtime */
> +			if (get_kernel_nofault(next_addr, (unsigned long *)addr))

[Severity: High]
Is it safe to read from addr using get_kernel_nofault() before validating
that it falls within the kernel address space?

If a user configures a watch expression where an intermediate pointer
evaluates to a user-space address, reading it via get_kernel_nofault()
might trigger a hardware protection violation (e.g., SMAP or PAN) on
architectures where copy_from_kernel_nofault() does not internally
validate the address boundary.

Should the boundary check be moved inside the pointer-chasing loop prior
to the get_kernel_nofault() call?

> +				return -EFAULT;
> +
> +			addr = next_addr;
> +		}
> +	}
> +
> +	/* Enforce strict Kernel-Space boundary */
> +	if (unlikely(addr < TASK_SIZE_MAX))
> +		return -EINVAL;
> +
> +	*out_addr = addr;
> +	*out_len = cfg->watch_len;
> +	return 0;
> +}

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260714182243.10687-1-wangjinchao600@gmail.com?part=5