Skip to content

Commit 9e15afa

Browse files
Qian Caitorvalds
authored andcommitted
mm/page_alloc: silence a KASAN false positive
kernel_init_free_pages() will use memset() on s390 to clear all pages from kmalloc_order() which will override KASAN redzones because a redzone was setup from the end of the allocation size to the end of the last page. Silence it by not reporting it there. An example of the report is, BUG: KASAN: slab-out-of-bounds in __free_pages_ok Write of size 4096 at addr 000000014beaa000 Call Trace: show_stack+0x152/0x210 dump_stack+0x1f8/0x248 print_address_description.isra.13+0x5e/0x4d0 kasan_report+0x130/0x178 check_memory_region+0x190/0x218 memset+0x34/0x60 __free_pages_ok+0x894/0x12f0 kfree+0x4f2/0x5e0 unpack_to_rootfs+0x60e/0x650 populate_rootfs+0x56/0x358 do_one_initcall+0x1f4/0xa20 kernel_init_freeable+0x758/0x7e8 kernel_init+0x1c/0x170 ret_from_fork+0x24/0x28 Memory state around the buggy address: 000000014bea9f00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 000000014bea9f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 >000000014beaa000: 03 fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe ^ 000000014beaa080: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe 000000014beaa100: fe fe fe fe fe fe fe fe fe fe fe fe fe fe Fixes: 6471384 ("mm: security: introduce init_on_alloc=1 and init_on_free=1 boot options") Signed-off-by: Qian Cai <[email protected]> Signed-off-by: Andrew Morton <[email protected]> Tested-by: Vasily Gorbik <[email protected]> Acked-by: Vasily Gorbik <[email protected]> Cc: Dmitry Vyukov <[email protected]> Cc: Christian Borntraeger <[email protected]> Cc: Alexander Potapenko <[email protected]> Cc: Kees Cook <[email protected]> Cc: Heiko Carstens <[email protected]> Link: http://lkml.kernel.org/r/[email protected] Signed-off-by: Linus Torvalds <[email protected]>
1 parent 535b81e commit 9e15afa

File tree

1 file changed

+3
-0
lines changed

1 file changed

+3
-0
lines changed

mm/page_alloc.c

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1156,8 +1156,11 @@ static void kernel_init_free_pages(struct page *page, int numpages)
11561156
{
11571157
int i;
11581158

1159+
/* s390's use of memset() could override KASAN redzones. */
1160+
kasan_disable_current();
11591161
for (i = 0; i < numpages; i++)
11601162
clear_highpage(page + i);
1163+
kasan_enable_current();
11611164
}
11621165

11631166
static __always_inline bool free_pages_prepare(struct page *page,

0 commit comments

Comments
 (0)