Sorry, pls ignore this mail, my bad. Regards, Li ---- On Mon, 11 Jul 2022 19:08:04 +0800 Li Chen <me@linux.beauty> wrote --- > From: Patrick Wang <patrick.wang.shcn@xxxxxxxxx> > > commit 23c2d497de21f25898fbea70aeb292ab8acc8c94 upstream. > > The kmemleak_*_phys() apis do not check the address for lowmem's min > boundary, while the caller may pass an address below lowmem, which will > trigger an oops: > > # echo scan > /sys/kernel/debug/kmemleak > Unable to handle kernel paging request at virtual address ff5fffffffe00000 > Oops [#1] > Modules linked in: > CPU: 2 PID: 134 Comm: bash Not tainted 5.18.0-rc1-next-20220407 #33 > Hardware name: riscv-virtio,qemu (DT) > epc : scan_block+0x74/0x15c > ra : scan_block+0x72/0x15c > epc : ffffffff801e5806 ra : ffffffff801e5804 sp : ff200000104abc30 > gp : ffffffff815cd4e8 tp : ff60000004cfa340 t0 : 0000000000000200 > t1 : 00aaaaaac23954cc t2 : 00000000000003ff s0 : ff200000104abc90 > s1 : ffffffff81b0ff28 a0 : 0000000000000000 a1 : ff5fffffffe01000 > a2 : ffffffff81b0ff28 a3 : 0000000000000002 a4 : 0000000000000001 > a5 : 0000000000000000 a6 : ff200000104abd7c a7 : 0000000000000005 > s2 : ff5fffffffe00ff9 s3 : ffffffff815cd998 s4 : ffffffff815d0e90 > s5 : ffffffff81b0ff28 s6 : 0000000000000020 s7 : ffffffff815d0eb0 > s8 : ffffffffffffffff s9 : ff5fffffffe00000 s10: ff5fffffffe01000 > s11: 0000000000000022 t3 : 00ffffffaa17db4c t4 : 000000000000000f > t5 : 0000000000000001 t6 : 0000000000000000 > status: 0000000000000100 badaddr: ff5fffffffe00000 cause: 000000000000000d > scan_gray_list+0x12e/0x1a6 > kmemleak_scan+0x2aa/0x57e > kmemleak_write+0x32a/0x40c > full_proxy_write+0x56/0x82 > vfs_write+0xa6/0x2a6 > ksys_write+0x6c/0xe2 > sys_write+0x22/0x2a > ret_from_syscall+0x0/0x2 > > The callers may not quite know the actual address they pass(e.g. from > devicetree). So the kmemleak_*_phys() apis should guarantee the address > they finally use is in lowmem range, so check the address for lowmem's > min boundary. > > Link: https://lkml.kernel.org/r/20220413122925.33856-1-patrick.wang.shcn@xxxxxxxxx > Signed-off-by: Patrick Wang <patrick.wang.shcn@xxxxxxxxx> > Acked-by: Catalin Marinas <catalin.marinas@xxxxxxx> > Cc: <stable@xxxxxxxxxxxxxxx> > Signed-off-by: Andrew Morton <akpm@xxxxxxxxxxxxxxxxxxxx> > Signed-off-by: Linus Torvalds <torvalds@xxxxxxxxxxxxxxxxxxxx> > Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx> > --- > mm/kmemleak.c | 8 ++++---- > 1 file changed, 4 insertions(+), 4 deletions(-) > > diff --git a/mm/kmemleak.c b/mm/kmemleak.c > index b78861b8e013..859303aae180 100644 > --- a/mm/kmemleak.c > +++ b/mm/kmemleak.c > @@ -1125,7 +1125,7 @@ EXPORT_SYMBOL(kmemleak_no_scan); > void __ref kmemleak_alloc_phys(phys_addr_t phys, size_t size, int min_count, > gfp_t gfp) > { > - if (!IS_ENABLED(CONFIG_HIGHMEM) || PHYS_PFN(phys) < max_low_pfn) > + if (PHYS_PFN(phys) >= min_low_pfn && PHYS_PFN(phys) < max_low_pfn) > kmemleak_alloc(__va(phys), size, min_count, gfp); > } > EXPORT_SYMBOL(kmemleak_alloc_phys); > @@ -1139,7 +1139,7 @@ EXPORT_SYMBOL(kmemleak_alloc_phys); > */ > void __ref kmemleak_free_part_phys(phys_addr_t phys, size_t size) > { > - if (!IS_ENABLED(CONFIG_HIGHMEM) || PHYS_PFN(phys) < max_low_pfn) > + if (PHYS_PFN(phys) >= min_low_pfn && PHYS_PFN(phys) < max_low_pfn) > kmemleak_free_part(__va(phys), size); > } > EXPORT_SYMBOL(kmemleak_free_part_phys); > @@ -1151,7 +1151,7 @@ EXPORT_SYMBOL(kmemleak_free_part_phys); > */ > void __ref kmemleak_not_leak_phys(phys_addr_t phys) > { > - if (!IS_ENABLED(CONFIG_HIGHMEM) || PHYS_PFN(phys) < max_low_pfn) > + if (PHYS_PFN(phys) >= min_low_pfn && PHYS_PFN(phys) < max_low_pfn) > kmemleak_not_leak(__va(phys)); > } > EXPORT_SYMBOL(kmemleak_not_leak_phys); > @@ -1163,7 +1163,7 @@ EXPORT_SYMBOL(kmemleak_not_leak_phys); > */ > void __ref kmemleak_ignore_phys(phys_addr_t phys) > { > - if (!IS_ENABLED(CONFIG_HIGHMEM) || PHYS_PFN(phys) < max_low_pfn) > + if (PHYS_PFN(phys) >= min_low_pfn && PHYS_PFN(phys) < max_low_pfn) > kmemleak_ignore(__va(phys)); > } > EXPORT_SYMBOL(kmemleak_ignore_phys); > -- > 2.36.1 > >
