From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id 16AC4C433EF for ; Wed, 27 Apr 2022 07:34:30 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id 8C9F66B0073; Wed, 27 Apr 2022 03:34:30 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id 879DB6B0078; Wed, 27 Apr 2022 03:34:30 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 74CC06B0073; Wed, 27 Apr 2022 03:34:30 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (relay.hostedemail.com [64.99.140.28]) by kanga.kvack.org (Postfix) with ESMTP id 608D16B0073 for ; Wed, 27 Apr 2022 03:34:30 -0400 (EDT) Received: from smtpin06.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay09.hostedemail.com (Postfix) with ESMTP id 3904C29557 for ; Wed, 27 Apr 2022 07:34:30 +0000 (UTC) X-FDA: 79401846300.06.40A4A88 Received: from mail-yb1-f179.google.com (mail-yb1-f179.google.com [209.85.219.179]) by imf04.hostedemail.com (Postfix) with ESMTP id 8D9024005D for ; Wed, 27 Apr 2022 07:34:25 +0000 (UTC) Received: by mail-yb1-f179.google.com with SMTP id f38so1845832ybi.3 for ; Wed, 27 Apr 2022 00:34:29 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20210112; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=MeaX4XdIMOSF04IoR3Cab+z51sfQuXXpK7U3HQj8e9Y=; b=hrx36cVw/CY8EF92h5eVbLNh7vWB+J2wMLxiihlJLMVIrB09HKNrVpmudoLr6cBTkF dTD6fYbQbe//a0D1xDVLTbodu6ak07ePMkofE2pde60ZH/ukdZz5XN8c6kU2mc3qEZo5 IGs0I08RMsWPfVww55ImcBBESzBwMpqhQDuPMQcURMIlO243HR8YWJ4VVm95ZBkByJNn 5Jw/jgkylrTeEs743xCSQYs9OOVwUqaThcN3etmD+rUK/H6GAaplb9PN9xKPUTvs+8ws Z1aFBFXccngNPA6LZWxQe3E77+EM2vY7X3Ec8JdBjBlCh+VatF138DxaOSrj/cUGcUa+ qPeA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=MeaX4XdIMOSF04IoR3Cab+z51sfQuXXpK7U3HQj8e9Y=; b=pRokw9lZMrRSJdNhvoR2g5dy2jG3mKpZ1bgB3RPX/e8i0LWzKj7Y/C6/IOl2rPteJw MZbHspgBCyyb0kVVQSiEa2Gd/1mJB9ub311dQkcAls++LoklrFLd9kVn7iySlMCDb8uw /9PM+qR1U+iqZokyb5uEVeyZIZvf+WXjxTwnWr+pixF4rVGRngbSP3xgp0ZLzKB9BMhp mKH5+l/JPdZhR56TZiMF1EKwsZ0jAVFIScgmetAcwZ54aMI3FmUe82CUsnzr0ymPah5r JIWbA38CCqV4B0ppe1fi+KMsgywPIwhhgANXQVa4Y6QPwjg64TyLdQV5DFYpBiDjNNWj XmHQ== X-Gm-Message-State: AOAM533/0nNNot45/t3ZhZRalv5nguw4P3UIC9Qbwt72hZZSjNnIr1lU 92haKjWOPCHrmfrbpXUDP1OubMhskNFrckw89mISLg== X-Google-Smtp-Source: ABdhPJw9A1Am1YqwfUuHH25Kgd2alp4pSOBVU71IoXBxNEVLye8foPf3rKxSyf4BvnRSRdqbNgOHt/92tIlzULZ1jNY= X-Received: by 2002:a25:cc0b:0:b0:648:4590:6cb6 with SMTP id l11-20020a25cc0b000000b0064845906cb6mr15972505ybf.87.1651044868807; Wed, 27 Apr 2022 00:34:28 -0700 (PDT) MIME-Version: 1.0 References: <20220427071100.3844081-1-xu.xin16@zte.com.cn> In-Reply-To: <20220427071100.3844081-1-xu.xin16@zte.com.cn> From: Marco Elver Date: Wed, 27 Apr 2022 09:33:52 +0200 Message-ID: Subject: Re: [PATCH] mm/kfence: fix a potential NULL pointer dereference To: cgel.zte@gmail.com Cc: glider@google.com, akpm@linux-foundation.org, dvyukov@google.com, kasan-dev@googlegroups.com, linux-kernel@vger.kernel.org, linux-mm@kvack.org, xu xin , Zeal Robot Content-Type: text/plain; charset="UTF-8" X-Rspamd-Server: rspam04 X-Rspamd-Queue-Id: 8D9024005D X-Stat-Signature: sxya8kn5a3p3n1ezihdirrkewjbbfafh X-Rspam-User: Authentication-Results: imf04.hostedemail.com; dkim=pass header.d=google.com header.s=20210112 header.b=hrx36cVw; spf=pass (imf04.hostedemail.com: domain of elver@google.com designates 209.85.219.179 as permitted sender) smtp.mailfrom=elver@google.com; dmarc=pass (policy=reject) header.from=google.com X-HE-Tag: 1651044865-35476 X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: On Wed, 27 Apr 2022 at 09:11, wrote: > > From: xu xin > > In __kfence_free(), the returned 'meta' from addr_to_metadata() > might be NULL just as the implementation of addr_to_metadata() > shows. > > Let's add a check of the pointer 'meta' to avoid NULL pointer > dereference. The patch brings three changes: > > 1. Add checks in both kfence_free() and __kfence_free(); > 2. kfence_free is not inline function any longer and new inline > function '__try_free_kfence_meta' is introduced. This is very bad for performance (see below). > 3. The check of is_kfence_address() is not required for > __kfence_free() now because __kfence_free has done the check in > addr_to_metadata(); > > Reported-by: Zeal Robot Is this a static analysis robot? Please show a real stack trace with an actual NULL-deref. Nack - please see: https://lore.kernel.org/all/CANpmjNO5-o1B9r2eYS_482RBVJSyPoHSnV2t+M8fJdFzBf6d2A@mail.gmail.com/ > Signed-off-by: xu xin > --- > include/linux/kfence.h | 10 ++-------- > mm/kfence/core.c | 30 +++++++++++++++++++++++++++--- > 2 files changed, 29 insertions(+), 11 deletions(-) > > diff --git a/include/linux/kfence.h b/include/linux/kfence.h > index 726857a4b680..fbf6391ab53c 100644 > --- a/include/linux/kfence.h > +++ b/include/linux/kfence.h > @@ -160,7 +160,7 @@ void *kfence_object_start(const void *addr); > * __kfence_free() - release a KFENCE heap object to KFENCE pool > * @addr: object to be freed > * > - * Requires: is_kfence_address(addr) > + * Requires: is_kfence_address(addr), but now it's unnecessary (As an aside, something can't be required and be unnecessary at the same time.) There's a reason it was designed this way - is_kfence_address() is much cheaper than a full call. > * Release a KFENCE object and mark it as freed. > */ > @@ -179,13 +179,7 @@ void __kfence_free(void *addr); > * allocator's free codepath. The allocator must check the return value to > * determine if it was a KFENCE object or not. > */ > -static __always_inline __must_check bool kfence_free(void *addr) > -{ > - if (!is_kfence_address(addr)) > - return false; > - __kfence_free(addr); > - return true; > -} > +bool __must_check kfence_free(void *addr); There's a reason is_kfence_address() is inline here, because this function is actually called in relatively hot paths, and a simple load+cmp is much cheaper than a call! > /** > * kfence_handle_page_fault() - perform page fault handling for KFENCE pages > diff --git a/mm/kfence/core.c b/mm/kfence/core.c > index 6e69986c3f0d..1405585369b3 100644 > --- a/mm/kfence/core.c > +++ b/mm/kfence/core.c > @@ -1048,10 +1048,10 @@ void *kfence_object_start(const void *addr) > return meta ? (void *)meta->addr : NULL; > } > > -void __kfence_free(void *addr) > -{ > - struct kfence_metadata *meta = addr_to_metadata((unsigned long)addr); > > +/* Require: meta is not NULL*/ > +static __always_inline void __try_free_kfence_meta(struct kfence_metadata *meta) > +{ > #ifdef CONFIG_MEMCG > KFENCE_WARN_ON(meta->objcg); > #endif > @@ -1067,6 +1067,30 @@ void __kfence_free(void *addr) > kfence_guarded_free(addr, meta, false); > } > > +void __kfence_free(void *addr) > +{ > + struct kfence_metadata *meta = addr_to_metadata((unsigned long)addr); > + > + if (!meta) { > + kfence_report_error(addr, false, NULL, NULL, KFENCE_ERROR_INVALID); > + return; > + } > + > + __try_free_kfence_meta(meta); > +} > + > +bool __must_check kfence_free(void *addr) > +{ > + struct kfence_metadata *meta = addr_to_metadata((unsigned long)addr); > + > + if (!meta) > + return false; > + > + __try_free_kfence_meta(meta); > + > + return true; > +} > + > bool kfence_handle_page_fault(unsigned long addr, bool is_write, struct pt_regs *regs) > { > const int page_index = (addr - (unsigned long)__kfence_pool) / PAGE_SIZE; > -- > 2.25.1 >