Skip to content
  • Zhen Lei's avatar
    kasan: fix shadow_size calculation error in kasan_module_alloc · 1e8e18f6
    Zhen Lei authored
    There is a special case that the size is "(N << KASAN_SHADOW_SCALE_SHIFT)
    Pages plus X", the value of X is [1, KASAN_SHADOW_SCALE_SIZE-1].  The
    operation "size >> KASAN_SHADOW_SCALE_SHIFT" will drop X, and the
    roundup operation can not retrieve the missed one page.  For example:
    size=0x28006, PAGE_SIZE=0x1000, KASAN_SHADOW_SCALE_SHIFT=3, we will get
    shadow_size=0x5000, but actually we need 6 pages.
    
      shadow_size = round_up(size >> KASAN_SHADOW_SCALE_SHIFT, PAGE_SIZE);
    
    This can lead to a kernel crash when kasan is enabled and the value of
    mod->core_layout.size or mod->init_layout.size is like above.  Because
    the shadow memory of X has not been allocated and mapped.
    
    move_module:
      ptr = module_alloc(mod->core_layout.size);
      ...
      memset(ptr, 0, mod->core_layout.size);		//crashed
    
      Unable to handle kernel paging request at virtual address ffff0fffff97b000
      ......
      Call trace:
        __asan_storeN+0x174/0x1a8
        memset+0x24/0x48
        layout_an...
    1e8e18f6