Skip to content

Commit 8377d77

Browse files
LeviYeoReumgregkh
authored andcommitted
kasan: remove kasan_find_vm_area() to prevent possible deadlock
commit 6ee9b3d upstream. find_vm_area() couldn't be called in atomic_context. If find_vm_area() is called to reports vm area information, kasan can trigger deadlock like: CPU0 CPU1 vmalloc(); alloc_vmap_area(); spin_lock(&vn->busy.lock) spin_lock_bh(&some_lock); <interrupt occurs> <in softirq> spin_lock(&some_lock); <access invalid address> kasan_report(); print_report(); print_address_description(); kasan_find_vm_area(); find_vm_area(); spin_lock(&vn->busy.lock) // deadlock! To prevent possible deadlock while kasan reports, remove kasan_find_vm_area(). Link: https://lkml.kernel.org/r/20250703181018.580833-1-yeoreum.yun@arm.com Fixes: c056a36 ("kasan: print virtual mapping info in reports") Signed-off-by: Yeoreum Yun <yeoreum.yun@arm.com> Reported-by: Yunseong Kim <ysk@kzalloc.com> Reviewed-by: Andrey Ryabinin <ryabinin.a.a@gmail.com> Cc: Alexander Potapenko <glider@google.com> Cc: Andrey Konovalov <andreyknvl@gmail.com> Cc: Byungchul Park <byungchul@sk.com> Cc: Dmitriy Vyukov <dvyukov@google.com> Cc: Sebastian Andrzej Siewior <bigeasy@linutronix.de> Cc: Steven Rostedt <rostedt@goodmis.org> Cc: Vincenzo Frascino <vincenzo.frascino@arm.com> Cc: <stable@vger.kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
1 parent d3927e5 commit 8377d77

1 file changed

Lines changed: 2 additions & 11 deletions

File tree

mm/kasan/report.c

Lines changed: 2 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -385,17 +385,8 @@ static void print_address_description(void *addr, u8 tag,
385385
}
386386

387387
if (is_vmalloc_addr(addr)) {
388-
struct vm_struct *va = find_vm_area(addr);
389-
390-
if (va) {
391-
pr_err("The buggy address belongs to the virtual mapping at\n"
392-
" [%px, %px) created by:\n"
393-
" %pS\n",
394-
va->addr, va->addr + va->size, va->caller);
395-
pr_err("\n");
396-
397-
page = vmalloc_to_page(addr);
398-
}
388+
pr_err("The buggy address %px belongs to a vmalloc virtual mapping\n", addr);
389+
page = vmalloc_to_page(addr);
399390
}
400391

401392
if (page) {

0 commit comments

Comments
 (0)