2022-02-16 21:36:13

by andrey.konovalov

Subject: [PATCH mm] kasan: print virtual mapping info in reports

From: Andrey Konovalov <[email protected]>

Print virtual mapping range and its creator in reports affecting virtual
mappings.

Also get physical page pointer for such mappings, so page information
gets printed as well.

Signed-off-by: Andrey Konovalov <[email protected]>

---

Note: no need to merge this patch into any of the KASAN vmalloc patches
that are already in mm, better to keep it separate.
---
mm/kasan/report.c | 12 +++++++++++-
1 file changed, 11 insertions(+), 1 deletion(-)

diff --git a/mm/kasan/report.c b/mm/kasan/report.c
index 137c2c0b09db..8002fb3c417d 100644
--- a/mm/kasan/report.c
+++ b/mm/kasan/report.c
@@ -260,8 +260,18 @@ static void print_address_description(void *addr, u8 tag)
pr_err(" %pS\n", addr);
}

+ if (is_vmalloc_addr(addr)) {
+ struct vm_struct *va = find_vm_area(addr);
+
+ pr_err("The buggy address belongs to the virtual mapping at\n"
+ " [%px, %px) created by:\n"
+ " %pS\n", va->addr, va->addr + va->size, va->caller);
+
+ page = vmalloc_to_page(page);
+ }
+
if (page) {
- pr_err("The buggy address belongs to the page:\n");
+ pr_err("The buggy address belongs to the physical page:\n");
dump_page(page, "kasan: bad access detected");
}

--
2.25.1

2022-02-17 14:44:40

by Mark Rutland

Subject: Re: [PATCH mm] kasan: print virtual mapping info in reports

On Wed, Feb 16, 2022 at 08:01:37PM +0100, [email protected] wrote:
> From: Andrey Konovalov <[email protected]>
>
> Print virtual mapping range and its creator in reports affecting virtual
> mappings.
>
> Also get physical page pointer for such mappings, so page information
> gets printed as well.
>
> Signed-off-by: Andrey Konovalov <[email protected]>
>
> ---
>
> Note: no need to merge this patch into any of the KASAN vmalloc patches
> that are already in mm, better to keep it separate.
> ---
> mm/kasan/report.c | 12 +++++++++++-
> 1 file changed, 11 insertions(+), 1 deletion(-)
>
> diff --git a/mm/kasan/report.c b/mm/kasan/report.c
> index 137c2c0b09db..8002fb3c417d 100644
> --- a/mm/kasan/report.c
> +++ b/mm/kasan/report.c
> @@ -260,8 +260,18 @@ static void print_address_description(void *addr, u8 tag)
> pr_err(" %pS\n", addr);
> }
>
> + if (is_vmalloc_addr(addr)) {
> + struct vm_struct *va = find_vm_area(addr);
> +
> + pr_err("The buggy address belongs to the virtual mapping at\n"
> + " [%px, %px) created by:\n"
> + " %pS\n", va->addr, va->addr + va->size, va->caller);

The return value of find_vm_area() needs a NULL check here;
is_vmalloc_addr(addr) just checks that `addr` is within the vmalloc VA
range, and doesn't guarantee that there is a vmap_area associated with
that `addr`.

Without the NULL-check, we'll blow up on the `va->addr` dereference and
will fail to make the report, which would be unfortunate.

Thanks,
Mark.

> +
> + page = vmalloc_to_page(page);
> + }
> +
> if (page) {
> - pr_err("The buggy address belongs to the page:\n");
> + pr_err("The buggy address belongs to the physical page:\n");
> dump_page(page, "kasan: bad access detected");
> }
>
> --
> 2.25.1
>

2022-02-18 15:28:32

by Andrey Konovalov

Subject: Re: [PATCH mm] kasan: print virtual mapping info in reports

On Thu, Feb 17, 2022 at 1:00 PM Mark Rutland <[email protected]> wrote:
>
> On Wed, Feb 16, 2022 at 08:01:37PM +0100, [email protected] wrote:
> > From: Andrey Konovalov <[email protected]>
> >
> > Print virtual mapping range and its creator in reports affecting virtual
> > mappings.
> >
> > Also get physical page pointer for such mappings, so page information
> > gets printed as well.
> >
> > Signed-off-by: Andrey Konovalov <[email protected]>
> >
> > ---
> >
> > Note: no need to merge this patch into any of the KASAN vmalloc patches
> > that are already in mm, better to keep it separate.
> > ---
> > mm/kasan/report.c | 12 +++++++++++-
> > 1 file changed, 11 insertions(+), 1 deletion(-)
> >
> > diff --git a/mm/kasan/report.c b/mm/kasan/report.c
> > index 137c2c0b09db..8002fb3c417d 100644
> > --- a/mm/kasan/report.c
> > +++ b/mm/kasan/report.c
> > @@ -260,8 +260,18 @@ static void print_address_description(void *addr, u8 tag)
> > pr_err(" %pS\n", addr);
> > }
> >
> > + if (is_vmalloc_addr(addr)) {
> > + struct vm_struct *va = find_vm_area(addr);
> > +
> > + pr_err("The buggy address belongs to the virtual mapping at\n"
> > + " [%px, %px) created by:\n"
> > + " %pS\n", va->addr, va->addr + va->size, va->caller);
>
> The return value of find_vm_area() needs a NULL check here;
> is_vmalloc_addr(addr) just checks that `addr` is within the vmalloc VA
> range, and doesn't guarantee that there is a vmap_area associated with
> that `addr`.
>
> Without the NULL-check, we'll blow up on the `va->addr` dereference and
> will fail to make the report, which would be unfortunate.

Indeed. Will fix in v2. Thanks, Mark!