Commit 19f1c3ac authored by Andrey Konovalov's avatar Andrey Konovalov Committed by Linus Torvalds
Browse files

kasan, vmalloc: unpoison VM_ALLOC pages after mapping 

Make KASAN unpoison vmalloc mappings after they have been mapped in when
it's possible: for vmalloc() (indentified via VM_ALLOC) and vm_map_ram().

The reasons for this are:

 - For vmalloc() and vm_map_ram(): pages don't get unpoisoned in case
   mapping them fails.

 - For vmalloc(): HW_TAGS KASAN needs pages to be mapped to set tags via
   kasan_unpoison_vmalloc().

As a part of these changes, the return value of __vmalloc_node_range() is
changed to area->addr.  This is a non-functional change, as
__vmalloc_area_node() returns area->addr anyway.

Link: https://lkml.kernel.org/r/fcb98980e6fcd3c4be6acdcb5d6110898ef28548.1643047180.git.andreyknvl@google.com


Signed-off-by: default avatarAndrey Konovalov <andreyknvl@google.com>
Reviewed-by: default avatarAlexander Potapenko <glider@google.com>
Acked-by: default avatarMarco Elver <elver@google.com>
Cc: Andrey Ryabinin <ryabinin.a.a@gmail.com>
Cc: Catalin Marinas <catalin.marinas@arm.com>
Cc: Dmitry Vyukov <dvyukov@google.com>
Cc: Evgenii Stepanov <eugenis@google.com>
Cc: Mark Rutland <mark.rutland@arm.com>
Cc: Peter Collingbourne <pcc@google.com>
Cc: Vincenzo Frascino <vincenzo.frascino@arm.com>
Cc: Will Deacon <will@kernel.org>
Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
parent 01d92c7f

mm/vmalloc.c

+22 −8
Original line number Diff line number Diff line
@@ -2231,14 +2231,15 @@ void *vm_map_ram(struct page **pages, unsigned int count, int node) 
		mem = (void *)addr;

	}



	mem = kasan_unpoison_vmalloc(mem, size);



	if (vmap_pages_range(addr, addr + size, PAGE_KERNEL,

				pages, PAGE_SHIFT) < 0) {

		vm_unmap_ram(mem, count);

		return NULL;

	}



	/* Mark the pages as accessible, now that they are mapped. */

	mem = kasan_unpoison_vmalloc(mem, size);



	return mem;

}

EXPORT_SYMBOL(vm_map_ram);
@@ -2466,6 +2467,13 @@ static struct vm_struct *__get_vm_area_node(unsigned long size, 


	setup_vmalloc_vm(area, va, flags, caller);



	/*

	 * Mark pages for non-VM_ALLOC mappings as accessible. Do it now as a

	 * best-effort approach, as they can be mapped outside of vmalloc code.

	 * For VM_ALLOC mappings, the pages are marked as accessible after

	 * getting mapped in __vmalloc_node_range().

	 */

	if (!(flags & VM_ALLOC))

		area->addr = kasan_unpoison_vmalloc(area->addr, requested_size);



	return area;
@@ -3075,7 +3083,7 @@ void *__vmalloc_node_range(unsigned long size, unsigned long align, 
			const void *caller)

{

	struct vm_struct *area;

	void *addr;

	void *ret;

	unsigned long real_size = size;

	unsigned long real_align = align;

	unsigned int shift = PAGE_SHIFT;
@@ -3137,10 +3145,13 @@ void *__vmalloc_node_range(unsigned long size, unsigned long align, 
		prot = arch_vmap_pgprot_tagged(prot);



	/* Allocate physical pages and map them into vmalloc space. */

	addr = __vmalloc_area_node(area, gfp_mask, prot, shift, node);

	if (!addr)

	ret = __vmalloc_area_node(area, gfp_mask, prot, shift, node);

	if (!ret)

		goto fail;



	/* Mark the pages as accessible, now that they are mapped. */

	area->addr = kasan_unpoison_vmalloc(area->addr, real_size);



	/*

	 * In this function, newly allocated vm_struct has VM_UNINITIALIZED

	 * flag. It means that vm_struct is not fully initialized.
@@ -3152,7 +3163,7 @@ void *__vmalloc_node_range(unsigned long size, unsigned long align, 
	if (!(vm_flags & VM_DEFER_KMEMLEAK))

		kmemleak_vmalloc(area, size, gfp_mask);



	return addr;

	return area->addr;



fail:

	if (shift > PAGE_SHIFT) {
@@ -3836,7 +3847,10 @@ struct vm_struct **pcpu_get_vm_areas(const unsigned long *offsets, 
	}

	spin_unlock(&vmap_area_lock);



	/* mark allocated areas as accessible */

	/*

	 * Mark allocated areas as accessible. Do it now as a best-effort

	 * approach, as they can be mapped outside of vmalloc code.

	 */

	for (area = 0; area < nr_vms; area++)

		vms[area]->addr = kasan_unpoison_vmalloc(vms[area]->addr,

							 vms[area]->size);