github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-11-06 21:58:01 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

mm: kmsan: fix ioremap error cleanup

Browse Source 
Looking further at kmsan_ioremap_page_range(), I found three cases where
error cleanup leaks metadata blocks.

1. If the first iteration fails, clean is zero and cleanup is skipped,
   leaking any allocations that succeeded in that iteration.

2. If shadow mapping succeeds but origin mapping fails, the shadow
   pointer has already been cleared. Removing its mapping loses the
   backing block.

3. On failures after completed iterations, cleanup removes the earlier
   metadata mappings without freeing their backing blocks.

The cleanup needed here is the same as for iounmap, so it makes sense to
reuse kmsan_iounmap_pages().  Track the end of installed mappings with
mapped_end and advance it after each successful shadow mapping.  This
includes the current shadow block if origin mapping subsequently fails,
while the helper skips the missing origin mapping.

Run cleanup whenever err is non-zero.  Free allocations that have not been
mapped directly, and use the shared helper to unmap and free the installed
metadata, including blocks from completed iterations.

Link: https://lore.kernel.org/20261002200508.546-2-dmytrokoziuk68@gmail.com
Fixes: fdea03e12a ("mm: kmsan: handle alloc failures in kmsan_ioremap_page_range()")
Signed-off-by: Dima Koziuk <dmytrokoziuk68@gmail.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Reviewed-by: Alexander Potapenko <glider@google.com>
Cc: Marco Elver <elver@google.com>
Cc: Dmitry Vyukov <dvyukov@google.com>
Cc: Uladzislau Rezki (Sony) <urezki@gmail.com>
This commit is contained in:
Dima Koziuk 2026-10-02 23:05:08 +03:00 committed by Andrew Morton
parent 101fea09a8
commit 29f8fcb55c
1 changed files with 12 additions and 23 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

35
mm/kmsan/hooks.c
View File

@ -186,16 +186,17 @@ int kmsan_ioremap_page_range(unsigned long start, unsigned long end,
gfp_t gfp_mask = GFP_KERNEL | __GFP_ZERO;
struct page *shadow, *origin;
unsigned long off = 0;
int nr, err = 0, clean = 0, mapped;
unsigned long mapped_end = start;
int nr, err = 0, mapped;
if (!kmsan_enabled || kmsan_in_runtime())
return 0;
nr = (end - start) / PAGE_SIZE;
kmsan_enter_runtime();
for (int i = 0; i < nr; i++, off += PAGE_SIZE, clean = i) {
shadow = alloc_pages(gfp_mask, 1);
origin = alloc_pages(gfp_mask, 1);
for (int i = 0; i < nr; i++, off += PAGE_SIZE) {
shadow = alloc_pages(gfp_mask, KMSAN_IOREMAP_META_ORDER);
origin = alloc_pages(gfp_mask, KMSAN_IOREMAP_META_ORDER);
if (!shadow || !origin) {
err = -ENOMEM;
goto ret;
@ -209,39 +210,27 @@ int kmsan_ioremap_page_range(unsigned long start, unsigned long end,
goto ret;
}
shadow = NULL;
mapped_end = start + off + PAGE_SIZE;
mapped = __vmap_pages_range_noflush(
vmalloc_origin(start + off),
vmalloc_origin(start + off + PAGE_SIZE), prot, &origin,
PAGE_SHIFT);
if (mapped) {
__vunmap_range_noflush(
vmalloc_shadow(start + off),
vmalloc_shadow(start + off + PAGE_SIZE));
err = mapped;
goto ret;
}
origin = NULL;
}
/* Page mapping loop finished normally, nothing to clean up. */
clean = 0;
ret:
if (clean > 0) {
/*
* Something went wrong. Clean up shadow/origin pages allocated
* on the last loop iteration, then delete mappings created
* during the previous iterations.
*/
if (err) {
if (shadow)
__free_pages(shadow, 1);
__free_pages(shadow, KMSAN_IOREMAP_META_ORDER);
if (origin)
__free_pages(origin, 1);
__vunmap_range_noflush(
vmalloc_shadow(start),
vmalloc_shadow(start + clean * PAGE_SIZE));
__vunmap_range_noflush(
vmalloc_origin(start),
vmalloc_origin(start + clean * PAGE_SIZE));
__free_pages(origin, KMSAN_IOREMAP_META_ORDER);
if (mapped_end > start)
kmsan_iounmap_pages(start, mapped_end);
}
flush_cache_vmap(vmalloc_shadow(start), vmalloc_shadow(end));
flush_cache_vmap(vmalloc_origin(start), vmalloc_origin(end));