Skip to content

Commit 595f78d

Browse files
LeviYeoReumgregkh
authored andcommitted
kasan: remove kasan_find_vm_area() to prevent possible deadlock
commit 6ee9b3d84775944fb8c8a447961cd01274ac671c upstream. find_vm_area() couldn't be called in atomic_context. If find_vm_area() is called to reports vm area information, kasan can trigger deadlock like: CPU0 CPU1 vmalloc(); alloc_vmap_area(); spin_lock(&vn->busy.lock) spin_lock_bh(&some_lock); <interrupt occurs> <in softirq> spin_lock(&some_lock); <access invalid address> kasan_report(); print_report(); print_address_description(); kasan_find_vm_area(); find_vm_area(); spin_lock(&vn->busy.lock) // deadlock! To prevent possible deadlock while kasan reports, remove kasan_find_vm_area(). Link: https://lkml.kernel.org/r/[email protected] Fixes: c056a36 ("kasan: print virtual mapping info in reports") Signed-off-by: Yeoreum Yun <[email protected]> Reported-by: Yunseong Kim <[email protected]> Reviewed-by: Andrey Ryabinin <[email protected]> Cc: Alexander Potapenko <[email protected]> Cc: Andrey Konovalov <[email protected]> Cc: Byungchul Park <[email protected]> Cc: Dmitriy Vyukov <[email protected]> Cc: Sebastian Andrzej Siewior <[email protected]> Cc: Steven Rostedt <[email protected]> Cc: Vincenzo Frascino <[email protected]> Cc: <[email protected]> Signed-off-by: Andrew Morton <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]>
1 parent 8c90dbc commit 595f78d

File tree

1 file changed

+2
-11
lines changed

1 file changed

+2
-11
lines changed

mm/kasan/report.c

Lines changed: 2 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -337,17 +337,8 @@ static void print_address_description(void *addr, u8 tag,
337337
}
338338

339339
if (is_vmalloc_addr(addr)) {
340-
struct vm_struct *va = find_vm_area(addr);
341-
342-
if (va) {
343-
pr_err("The buggy address belongs to the virtual mapping at\n"
344-
" [%px, %px) created by:\n"
345-
" %pS\n",
346-
va->addr, va->addr + va->size, va->caller);
347-
pr_err("\n");
348-
349-
page = vmalloc_to_page(addr);
350-
}
340+
pr_err("The buggy address %px belongs to a vmalloc virtual mapping\n", addr);
341+
page = vmalloc_to_page(addr);
351342
}
352343

353344
if (page) {

0 commit comments

Comments
 (0)