Skip to content

Commit 595f78d

Browse files
LeviYeoReumgregkh
authored andcommitted
kasan: remove kasan_find_vm_area() to prevent possible deadlock
commit 6ee9b3d upstream. find_vm_area() couldn't be called in atomic_context. If find_vm_area() is called to reports vm area information, kasan can trigger deadlock like: CPU0 CPU1 vmalloc(); alloc_vmap_area(); spin_lock(&vn->busy.lock) spin_lock_bh(&some_lock); <interrupt occurs> <in softirq> spin_lock(&some_lock); <access invalid address> kasan_report(); print_report(); print_address_description(); kasan_find_vm_area(); find_vm_area(); spin_lock(&vn->busy.lock) // deadlock! To prevent possible deadlock while kasan reports, remove kasan_find_vm_area(). Link: https://lkml.kernel.org/r/20250703181018.580833-1-yeoreum.yun@arm.com Fixes: c056a36 ("kasan: print virtual mapping info in reports") Signed-off-by: Yeoreum Yun <yeoreum.yun@arm.com> Reported-by: Yunseong Kim <ysk@kzalloc.com> Reviewed-by: Andrey Ryabinin <ryabinin.a.a@gmail.com> Cc: Alexander Potapenko <glider@google.com> Cc: Andrey Konovalov <andreyknvl@gmail.com> Cc: Byungchul Park <byungchul@sk.com> Cc: Dmitriy Vyukov <dvyukov@google.com> Cc: Sebastian Andrzej Siewior <bigeasy@linutronix.de> Cc: Steven Rostedt <rostedt@goodmis.org> Cc: Vincenzo Frascino <vincenzo.frascino@arm.com> Cc: <stable@vger.kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
1 parent 8c90dbc commit 595f78d

1 file changed

Lines changed: 2 additions & 11 deletions

File tree

mm/kasan/report.c

Lines changed: 2 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -337,17 +337,8 @@ static void print_address_description(void *addr, u8 tag,
337337
}
338338

339339
if (is_vmalloc_addr(addr)) {
340-
struct vm_struct *va = find_vm_area(addr);
341-
342-
if (va) {
343-
pr_err("The buggy address belongs to the virtual mapping at\n"
344-
" [%px, %px) created by:\n"
345-
" %pS\n",
346-
va->addr, va->addr + va->size, va->caller);
347-
pr_err("\n");
348-
349-
page = vmalloc_to_page(addr);
350-
}
340+
pr_err("The buggy address %px belongs to a vmalloc virtual mapping\n", addr);
341+
page = vmalloc_to_page(addr);
351342
}
352343

353344
if (page) {

0 commit comments

Comments
 (0)