From: Marco Elver <elver@google.com> To: Alexander Potapenko <glider@google.com> Cc: Vegard Nossum <vegard.nossum@oracle.com>, Dmitry Vyukov <dvyukov@google.com>, Linux Memory Management List <linux-mm@kvack.org>, Al Viro <viro@zeniv.linux.org.uk>, adilger.kernel@dilger.ca, Andrew Morton <akpm@linux-foundation.org>, Andrey Konovalov <andreyknvl@google.com>, Andrey Ryabinin <aryabinin@virtuozzo.com>, Andy Lutomirski <luto@kernel.org>, Ard Biesheuvel <ard.biesheuvel@linaro.org>, Arnd Bergmann <arnd@arndb.de>, hch@infradead.org, hch@lst.de, darrick.wong@oracle.com, davem@davemloft.net, dmitry.torokhov@gmail.com, ebiggers@google.com, Eric Dumazet <edumazet@google.com>, ericvh@gmail.com, gregkh@linuxfoundation.org, harry.wentland@amd.com, herbert@gondor.apana.org.au, iii@linux.ibm.com, mingo@elte.hu, jasowang@redhat.com, axboe@kernel.dk, m.szyprowski@samsung.com, Mark Rutland <mark.rutland@arm.com>, martin.petersen@oracle.com, schwidefsky@de.ibm.com, Matthew Wilcox <willy@infradead.org>, mst@redhat.com, monstr@monstr.eu, pmladek@suse.com, Qian Cai <cai@lca.pw>, Randy Dunlap <rdunlap@infradead.org>, robin.murphy@arm.com, sergey.senozhatsky@gmail.com, Steven Rostedt <rostedt@goodmis.org>, tiwai@suse.com, tytso@mit.edu, Thomas Gleixner <tglx@linutronix.de>, gor@linux.ibm.com, wsa@the-dreams.de Subject: Re: [PATCH RFC v3 01/36] stackdepot: check depot_index before accessing the stack slab Date: Wed, 27 Nov 2019 15:22:33 +0100 Message-ID: <CANpmjNMCkCM0_6dfzP8Mi4_uU_mHhXSTfFmF+=nA6zzvB11j0Q@mail.gmail.com> (raw) In-Reply-To: <20191122112621.204798-2-glider@google.com> On Fri, 22 Nov 2019 at 12:26, <glider@google.com> wrote: > > Avoid crashes on corrupted stack ids. Under what circumstances can they be corrupted? > Signed-off-by: Alexander Potapenko <glider@google.com> > To: Alexander Potapenko <glider@google.com> > Cc: Vegard Nossum <vegard.nossum@oracle.com> > Cc: Dmitry Vyukov <dvyukov@google.com> > Cc: linux-mm@kvack.org > > --- > v3: > - fix the return statement > > Change-Id: I0a0b38ed5057090696a2c6ff0be7cfcc24ae6738 > --- > lib/stackdepot.c | 17 +++++++++++++++-- > 1 file changed, 15 insertions(+), 2 deletions(-) > > diff --git a/lib/stackdepot.c b/lib/stackdepot.c > index ed717dd08ff3..0bc6182bc7a6 100644 > --- a/lib/stackdepot.c > +++ b/lib/stackdepot.c > @@ -198,9 +198,22 @@ unsigned int stack_depot_fetch(depot_stack_handle_t handle, > unsigned long **entries) > { > union handle_parts parts = { .handle = handle }; > - void *slab = stack_slabs[parts.slabindex]; > + void *slab; > size_t offset = parts.offset << STACK_ALLOC_ALIGN; > - struct stack_record *stack = slab + offset; > + struct stack_record *stack; > + > + if (parts.slabindex > depot_index) { > + WARN(1, "slab index %d out of bounds (%d) for stack id %08x\n", > + parts.slabindex, depot_index, handle); On syzbot with panic_on_warn this will crash the kernel. Is this desirable? Or is a pr_err here more appropriate? > + *entries = NULL; > + return 0; > + } > + slab = stack_slabs[parts.slabindex]; > + stack = slab + offset; > + if (!stack) { > + entries = NULL; > + return 0; > + } > > *entries = stack->entries; > return stack->size; > -- > 2.24.0.432.g9d3f5f5b63-goog >
next prev parent reply index Thread overview: 120+ messages / expand[flat|nested] mbox.gz Atom feed top 2019-11-22 11:25 [PATCH RFC v3 00/36] Add KernelMemorySanitizer infrastructure glider 2019-11-22 11:25 ` [PATCH RFC v3 01/36] stackdepot: check depot_index before accessing the stack slab glider 2019-11-27 14:22 ` Marco Elver [this message] 2019-11-22 11:25 ` [PATCH RFC v3 02/36] stackdepot: build with -fno-builtin glider 2019-11-27 14:22 ` Marco Elver 2019-11-22 11:25 ` [PATCH RFC v3 03/36] kasan: stackdepot: move filter_irq_stacks() to stackdepot.c glider 2019-11-27 14:22 ` Marco Elver 2019-11-27 14:56 ` Alexander Potapenko 2019-11-22 11:25 ` [PATCH RFC v3 04/36] stackdepot: reserve 5 extra bits in depot_stack_handle_t glider 2019-11-27 14:23 ` Marco Elver 2019-11-22 11:25 ` [PATCH RFC v3 05/36] kmsan: add ReST documentation glider 2019-11-27 14:22 ` Marco Elver 2019-12-03 12:42 ` Alexander Potapenko 2019-11-22 11:25 ` [PATCH RFC v3 06/36] kmsan: gfp: introduce __GFP_NO_KMSAN_SHADOW glider 2019-11-27 14:48 ` Marco Elver 2019-12-03 12:57 ` Alexander Potapenko 2019-11-22 11:25 ` [PATCH RFC v3 07/36] kmsan: introduce __no_sanitize_memory and __SANITIZE_MEMORY__ glider 2019-11-28 13:13 ` Marco Elver 2019-11-29 16:09 ` Andrey Konovalov 2019-12-16 11:35 ` Alexander Potapenko 2019-11-22 11:25 ` [PATCH RFC v3 08/36] kmsan: reduce vmalloc space glider 2019-11-28 13:30 ` Marco Elver 2019-11-22 11:25 ` [PATCH RFC v3 09/36] kmsan: add KMSAN bits to struct page and struct task_struct glider 2019-11-28 13:44 ` Marco Elver 2019-11-28 14:05 ` Alexander Potapenko 2019-11-22 11:25 ` [PATCH RFC v3 10/36] kmsan: add KMSAN runtime glider 2019-11-24 19:44 ` Wolfram Sang 2019-11-25 9:14 ` Alexander Potapenko 2019-11-29 16:07 ` Marco Elver 2019-12-19 14:16 ` Alexander Potapenko 2019-12-02 15:39 ` Andrey Konovalov 2019-12-20 18:58 ` Alexander Potapenko 2019-12-03 14:34 ` Andrey Konovalov 2019-11-22 11:25 ` [PATCH RFC v3 11/36] kmsan: stackdepot: don't allocate KMSAN metadata for stackdepot glider 2019-11-29 14:52 ` Andrey Konovalov 2019-12-03 14:27 ` Alexander Potapenko 2019-11-22 11:25 ` [PATCH RFC v3 12/36] kmsan: define READ_ONCE_NOCHECK() glider 2019-12-02 10:03 ` Marco Elver 2019-12-03 12:45 ` Alexander Potapenko 2019-11-22 11:25 ` [PATCH RFC v3 13/36] kmsan: make READ_ONCE_TASK_STACK() return initialized values glider 2019-12-02 10:07 ` Marco Elver 2019-12-05 15:52 ` Alexander Potapenko 2019-11-22 11:25 ` [PATCH RFC v3 14/36] kmsan: x86: sync metadata pages on page fault glider 2019-11-22 11:26 ` [PATCH RFC v3 15/36] kmsan: add tests for KMSAN glider 2019-11-29 14:14 ` Andrey Konovalov 2019-12-05 14:30 ` Alexander Potapenko 2019-11-22 11:26 ` [PATCH RFC v3 16/36] crypto: kmsan: disable accelerated configs under KMSAN glider 2019-12-02 13:25 ` Marco Elver 2019-12-05 14:51 ` Alexander Potapenko 2019-11-22 11:26 ` [PATCH RFC v3 17/36] kmsan: x86: disable UNWINDER_ORC " glider 2019-12-02 13:30 ` Marco Elver 2019-11-22 11:26 ` [PATCH RFC v3 18/36] kmsan: disable LOCK_DEBUGGING_SUPPORT glider 2019-12-02 13:33 ` Marco Elver 2019-12-03 14:34 ` Alexander Potapenko 2019-12-03 15:00 ` Qian Cai 2019-12-03 15:14 ` Alexander Potapenko 2019-12-03 18:02 ` Qian Cai 2019-12-03 18:38 ` Steven Rostedt 2019-12-04 8:41 ` Alexander Potapenko 2019-12-04 12:22 ` Petr Mladek 2019-12-04 13:12 ` Qian Cai 2019-12-04 16:24 ` Alexander Potapenko 2019-12-04 18:03 ` Qian Cai 2019-11-22 11:26 ` [PATCH RFC v3 20/36] kmsan: x86: increase stack sizes in KMSAN builds glider 2019-12-02 14:31 ` Marco Elver 2019-11-22 11:26 ` [PATCH RFC v3 21/36] kmsan: disable KMSAN instrumentation for certain kernel parts glider 2019-11-29 15:07 ` Andrey Konovalov 2019-12-10 10:35 ` Alexander Potapenko 2019-12-10 12:38 ` Alexander Potapenko 2019-12-10 12:43 ` Qian Cai 2019-11-22 11:26 ` [PATCH RFC v3 22/36] kmsan: mm: call KMSAN hooks from SLUB code glider 2019-12-02 15:36 ` Marco Elver 2019-12-10 12:07 ` Alexander Potapenko 2019-11-22 11:26 ` [PATCH RFC v3 23/36] kmsan: call KMSAN hooks where needed glider 2019-11-26 10:17 ` Petr Mladek 2019-11-26 10:52 ` Alexander Potapenko 2019-11-29 16:21 ` Andrey Konovalov 2019-12-16 11:30 ` Alexander Potapenko 2019-11-22 11:26 ` [PATCH RFC v3 24/36] kmsan: disable instrumentation of certain functions glider 2019-11-29 14:59 ` Andrey Konovalov 2019-12-18 10:02 ` Alexander Potapenko 2019-11-22 11:26 ` [PATCH RFC v3 25/36] kmsan: unpoison |tlb| in arch_tlb_gather_mmu() glider 2019-11-29 15:08 ` Andrey Konovalov 2019-12-03 14:19 ` Alexander Potapenko 2019-11-22 11:26 ` [PATCH RFC v3 26/36] kmsan: use __msan_memcpy() where possible glider 2019-11-29 15:13 ` Andrey Konovalov 2019-12-05 15:46 ` Alexander Potapenko 2019-11-22 11:26 ` [PATCH RFC v3 27/36] kmsan: hooks for copy_to_user() and friends glider 2019-11-29 15:34 ` Andrey Konovalov 2019-12-05 16:00 ` Alexander Potapenko 2019-12-05 16:44 ` Andrey Konovalov 2019-12-11 14:22 ` Alexander Potapenko 2019-11-22 11:26 ` [PATCH RFC v3 28/36] kmsan: enable KMSAN builds glider 2019-11-29 15:55 ` Andrey Konovalov 2019-12-11 12:51 ` Alexander Potapenko 2019-11-22 11:26 ` [PATCH RFC v3 29/36] kmsan: handle /dev/[u]random glider 2019-11-22 11:26 ` [PATCH RFC v3 30/36] kmsan: virtio: check/unpoison scatterlist in vring_map_one_sg() glider 2019-11-22 11:26 ` [PATCH RFC v3 31/36] kmsan: disable strscpy() optimization under KMSAN glider 2019-12-02 15:51 ` Marco Elver 2019-12-02 16:23 ` Alexander Potapenko 2019-12-03 11:19 ` Alexander Potapenko 2019-12-03 11:24 ` Marco Elver 2019-12-03 11:27 ` Alexander Potapenko 2019-11-22 11:26 ` [PATCH RFC v3 32/36] kmsan: add iomap support glider 2019-12-03 12:50 ` Marco Elver 2019-12-03 14:07 ` Alexander Potapenko 2019-11-22 11:26 ` [PATCH RFC v3 33/36] kmsan: dma: unpoison memory mapped by dma_direct_map_page() glider 2019-11-22 11:26 ` [PATCH RFC v3 34/36] kmsan: disable physical page merging in biovec glider 2019-12-03 12:54 ` Marco Elver 2019-12-03 13:38 ` Alexander Potapenko 2019-11-22 11:26 ` [PATCH RFC v3 35/36] kmsan: ext4: skip block merging logic in ext4_mpage_readpages for KMSAN glider 2019-11-25 16:05 ` Robin Murphy 2019-11-25 17:03 ` Alexander Potapenko 2019-12-03 14:22 ` Marco Elver 2019-12-05 14:31 ` Alexander Potapenko 2019-11-22 11:26 ` [PATCH RFC v3 36/36] net: kasan: kmsan: support CONFIG_GENERIC_CSUM on x86, enable it for KASAN/KMSAN glider 2019-12-03 14:17 ` Marco Elver 2019-12-05 14:37 ` Alexander Potapenko 2019-11-29 14:39 ` [PATCH RFC v3 00/36] Add KernelMemorySanitizer infrastructure Marco Elver 2019-12-02 16:02 ` Alexander Potapenko
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to='CANpmjNMCkCM0_6dfzP8Mi4_uU_mHhXSTfFmF+=nA6zzvB11j0Q@mail.gmail.com' \ --to=elver@google.com \ --cc=adilger.kernel@dilger.ca \ --cc=akpm@linux-foundation.org \ --cc=andreyknvl@google.com \ --cc=ard.biesheuvel@linaro.org \ --cc=arnd@arndb.de \ --cc=aryabinin@virtuozzo.com \ --cc=axboe@kernel.dk \ --cc=cai@lca.pw \ --cc=darrick.wong@oracle.com \ --cc=davem@davemloft.net \ --cc=dmitry.torokhov@gmail.com \ --cc=dvyukov@google.com \ --cc=ebiggers@google.com \ --cc=edumazet@google.com \ --cc=ericvh@gmail.com \ --cc=glider@google.com \ --cc=gor@linux.ibm.com \ --cc=gregkh@linuxfoundation.org \ --cc=harry.wentland@amd.com \ --cc=hch@infradead.org \ --cc=hch@lst.de \ --cc=herbert@gondor.apana.org.au \ --cc=iii@linux.ibm.com \ --cc=jasowang@redhat.com \ --cc=linux-mm@kvack.org \ --cc=luto@kernel.org \ --cc=m.szyprowski@samsung.com \ --cc=mark.rutland@arm.com \ --cc=martin.petersen@oracle.com \ --cc=mingo@elte.hu \ --cc=monstr@monstr.eu \ --cc=mst@redhat.com \ --cc=pmladek@suse.com \ --cc=rdunlap@infradead.org \ --cc=robin.murphy@arm.com \ --cc=rostedt@goodmis.org \ --cc=schwidefsky@de.ibm.com \ --cc=sergey.senozhatsky@gmail.com \ --cc=tglx@linutronix.de \ --cc=tiwai@suse.com \ --cc=tytso@mit.edu \ --cc=vegard.nossum@oracle.com \ --cc=viro@zeniv.linux.org.uk \ --cc=willy@infradead.org \ --cc=wsa@the-dreams.de \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: link
Linux-mm Archive on lore.kernel.org Archives are clonable: git clone --mirror https://lore.kernel.org/linux-mm/0 linux-mm/git/0.git # If you have public-inbox 1.1+ installed, you may # initialize and index your mirror using the following commands: public-inbox-init -V2 linux-mm linux-mm/ https://lore.kernel.org/linux-mm \ linux-mm@kvack.org public-inbox-index linux-mm Example config snippet for mirrors Newsgroup available over NNTP: nntp://nntp.lore.kernel.org/org.kvack.linux-mm AGPL code for this site: git clone https://public-inbox.org/public-inbox.git