From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-3.8 required=3.0 tests=DKIMWL_WL_HIGH,DKIM_SIGNED, DKIM_VALID,HEADER_FROM_DIFFERENT_DOMAINS,LOTS_OF_MONEY,MAILING_LIST_MULTI, SIGNED_OFF_BY,SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED autolearn=no autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 3C55EC433DF for ; Sat, 23 May 2020 05:22:45 +0000 (UTC) Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by mail.kernel.org (Postfix) with ESMTP id EDCF920759 for ; Sat, 23 May 2020 05:22:44 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=pass (1024-bit key) header.d=kernel.org header.i=@kernel.org header.b="EP993Azi" DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org EDCF920759 Authentication-Results: mail.kernel.org; dmarc=none (p=none dis=none) header.from=linux-foundation.org Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=owner-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix) id 92F6180009; Sat, 23 May 2020 01:22:44 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id 8DFD580007; Sat, 23 May 2020 01:22:44 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 81C7180009; Sat, 23 May 2020 01:22:44 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from forelay.hostedemail.com (smtprelay0185.hostedemail.com [216.40.44.185]) by kanga.kvack.org (Postfix) with ESMTP id 6BA6280007 for ; Sat, 23 May 2020 01:22:44 -0400 (EDT) Received: from smtpin16.hostedemail.com (10.5.19.251.rfc1918.com [10.5.19.251]) by forelay01.hostedemail.com (Postfix) with ESMTP id 2AFB6180AD81A for ; Sat, 23 May 2020 05:22:44 +0000 (UTC) X-FDA: 76846839048.16.clam07_34edf411fa112 X-HE-Tag: clam07_34edf411fa112 X-Filterd-Recvd-Size: 6014 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by imf04.hostedemail.com (Postfix) with ESMTP for ; Sat, 23 May 2020 05:22:43 +0000 (UTC) Received: from localhost.localdomain (c-73-231-172-41.hsd1.ca.comcast.net [73.231.172.41]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 7A9CA2072C; Sat, 23 May 2020 05:22:42 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1590211362; bh=2yhhuYGGaY84kljBIC8q+s1fdhs2AOKMd8coz0sCrgA=; h=Date:From:To:Subject:In-Reply-To:From; b=EP993AziQhMOqBk3mc23BTS8FQ0LYUpetGgNNXPwwhr5oQj4XHT0TC0GUF+0IgNMq cFWWRMSa73beP5ZO1RIDL+uhhI58nYyLcBh/dykrqCo+GS+d3EqootTdXGKZwMcTwg 2ejb5yWkmWsvmx3/lFVVX3OTmy8JXQftFijEmrbQ= Date: Fri, 22 May 2020 22:22:42 -0700 From: Andrew Morton To: akpm@linux-foundation.org, dan.j.williams@intel.com, dave.jiang@intel.com, david@redhat.com, linux-mm@kvack.org, mm-commits@vger.kernel.org, pasha.tatashin@soleen.com, stable@vger.kernel.org, torvalds@linux-foundation.org, vishal.l.verma@intel.com Subject: [patch 01/11] device-dax: don't leak kernel memory to user space after unloading kmem Message-ID: <20200523052242.zhORsI9Zg%akpm@linux-foundation.org> In-Reply-To: <20200522222217.ee14ad7eda7aab1e6697da6c@linux-foundation.org> User-Agent: s-nail v14.8.16 MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: =46rom: David Hildenbrand Subject: device-dax: don't leak kernel memory to user space after unloading= kmem Assume we have kmem configured and loaded: [root@localhost ~]# cat /proc/iomem ... 140000000-33fffffff : Persistent Memory$ 140000000-1481fffff : namespace0.0 150000000-33fffffff : dax0.0 150000000-33fffffff : System RAM Assume we try to unload kmem. This force-unloading will work, even if memory cannot get removed from the system. [root@localhost ~]# rmmod kmem [ 86.380228] removing memory fails, because memory [0x0000000150000000-= 0x0000000157ffffff] is onlined ... [ 86.431225] kmem dax0.0: DAX region [mem 0x150000000-0x33fffffff] cann= ot be hotremoved until the next reboot Now, we can reconfigure the namespace: [root@localhost ~]# ndctl create-namespace --force --reconfig=3Dnamespace= 0.0 --mode=3Ddevdax [ 131.409351] nd_pmem namespace0.0: could not reserve region [mem 0x1400= 00000-0x33fffffff]dax [ 131.410147] nd_pmem: probe of namespace0.0 failed with error -16namesp= ace0.0 --mode=3Ddevdax ... This fails as expected due to the busy memory resource, and the memory cannot be used. However, the dax0.0 device is removed, and along its name. The name of the memory resource now points at freed memory (name of the device). [root@localhost ~]# cat /proc/iomem ... 140000000-33fffffff : Persistent Memory 140000000-1481fffff : namespace0.0 150000000-33fffffff : =EF=BF=BD_=EF=BF=BD^7_=EF=BF=BD=EF=BF=BD/_=EF=BF= =BD=EF=BF=BDwR=EF=BF=BD=EF=BF=BDWQ=EF=BF=BD=EF=BF=BD=EF=BF=BD^=EF=BF=BD=EF= =BF=BD=EF=BF=BD ... 150000000-33fffffff : System RAM We have to make sure to duplicate the string. While at it, remove the superfluous setting of the name and fixup a stale comment. Link: http://lkml.kernel.org/r/20200508084217.9160-2-david@redhat.com Fixes: 9f960da72b25 ("device-dax: "Hotremove" persistent memory that is use= d like normal RAM") Signed-off-by: David Hildenbrand Cc: Dan Williams Cc: Vishal Verma Cc: Dave Jiang Cc: Pavel Tatashin Cc: Andrew Morton Cc: [5.3] Signed-off-by: Andrew Morton --- drivers/dax/kmem.c | 14 +++++++++++--- 1 file changed, 11 insertions(+), 3 deletions(-) --- a/drivers/dax/kmem.c~device-dax-dont-leak-kernel-memory-to-user-space-a= fter-unloading-kmem +++ a/drivers/dax/kmem.c @@ -22,6 +22,7 @@ int dev_dax_kmem_probe(struct device *de resource_size_t kmem_size; resource_size_t kmem_end; struct resource *new_res; + const char *new_res_name; int numa_node; int rc; =20 @@ -48,11 +49,16 @@ int dev_dax_kmem_probe(struct device *de kmem_size &=3D ~(memory_block_size_bytes() - 1); kmem_end =3D kmem_start + kmem_size; =20 - /* Region is permanently reserved. Hot-remove not yet implemented. */ - new_res =3D request_mem_region(kmem_start, kmem_size, dev_name(dev)); + new_res_name =3D kstrdup(dev_name(dev), GFP_KERNEL); + if (!new_res_name) + return -ENOMEM; + + /* Region is permanently reserved if hotremove fails. */ + new_res =3D request_mem_region(kmem_start, kmem_size, new_res_name); if (!new_res) { dev_warn(dev, "could not reserve region [%pa-%pa]\n", &kmem_start, &kmem_end); + kfree(new_res_name); return -EBUSY; } =20 @@ -63,12 +69,12 @@ int dev_dax_kmem_probe(struct device *de * unknown to us that will break add_memory() below. */ new_res->flags =3D IORESOURCE_SYSTEM_RAM; - new_res->name =3D dev_name(dev); =20 rc =3D add_memory(numa_node, new_res->start, resource_size(new_res)); if (rc) { release_resource(new_res); kfree(new_res); + kfree(new_res_name); return rc; } dev_dax->dax_kmem_res =3D new_res; @@ -83,6 +89,7 @@ static int dev_dax_kmem_remove(struct de struct resource *res =3D dev_dax->dax_kmem_res; resource_size_t kmem_start =3D res->start; resource_size_t kmem_size =3D resource_size(res); + const char *res_name =3D res->name; int rc; =20 /* @@ -102,6 +109,7 @@ static int dev_dax_kmem_remove(struct de /* Release and free dax resources */ release_resource(res); kfree(res); + kfree(res_name); dev_dax->dax_kmem_res =3D NULL; =20 return 0; _