| Message ID | 1aa83e48627978de8068d5e3314185f3a0d7a849.1614302398.git.andreyknvl@google.com (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
| Series | kasan, mm: fix crash with HW_TAGS and DEBUG_PAGEALLOC | expand |
On Fri, 26 Feb 2021 02:25:37 +0100 Andrey Konovalov <andreyknvl@google.com> wrote: > Currently, kasan_free_nondeferred_pages()->kasan_free_pages() is called > after debug_pagealloc_unmap_pages(). This causes a crash when > debug_pagealloc is enabled, as HW_TAGS KASAN can't set tags on an > unmapped page. > > This patch puts kasan_free_nondeferred_pages() before > debug_pagealloc_unmap_pages(). > > Besides fixing the crash, this also makes the annotation order consistent > with debug_pagealloc_map_pages() preceding kasan_alloc_pages(). > This bug exists in 5.12, does it not? If so, is cc:stable appropriate and if so, do we have a suitable Fixes: commit? Thanks.
On Thu, Mar 4, 2021 at 12:23 AM Andrew Morton <akpm@linux-foundation.org> wrote: > > On Fri, 26 Feb 2021 02:25:37 +0100 Andrey Konovalov <andreyknvl@google.com> wrote: > > > Currently, kasan_free_nondeferred_pages()->kasan_free_pages() is called > > after debug_pagealloc_unmap_pages(). This causes a crash when > > debug_pagealloc is enabled, as HW_TAGS KASAN can't set tags on an > > unmapped page. > > > > This patch puts kasan_free_nondeferred_pages() before > > debug_pagealloc_unmap_pages(). > > > > Besides fixing the crash, this also makes the annotation order consistent > > with debug_pagealloc_map_pages() preceding kasan_alloc_pages(). > > > > This bug exists in 5.12, does it not? > > If so, is cc:stable appropriate and if so, do we have a suitable Fixes: > commit? Sure: Fixes: 94ab5b61ee16 ("kasan, arm64: enable CONFIG_KASAN_HW_TAGS") Cc: <stable@vger.kernel.org>
On Fri, Feb 26, 2021 at 2:25 AM Andrey Konovalov <andreyknvl@google.com> wrote: > > Currently, kasan_free_nondeferred_pages()->kasan_free_pages() is called > after debug_pagealloc_unmap_pages(). This causes a crash when > debug_pagealloc is enabled, as HW_TAGS KASAN can't set tags on an > unmapped page. > > This patch puts kasan_free_nondeferred_pages() before > debug_pagealloc_unmap_pages(). > > Besides fixing the crash, this also makes the annotation order consistent > with debug_pagealloc_map_pages() preceding kasan_alloc_pages(). > > Signed-off-by: Andrey Konovalov <andreyknvl@google.com> > --- > mm/page_alloc.c | 8 ++++++-- > 1 file changed, 6 insertions(+), 2 deletions(-) > > diff --git a/mm/page_alloc.c b/mm/page_alloc.c > index c89e7b107514..54bc237fd319 100644 > --- a/mm/page_alloc.c > +++ b/mm/page_alloc.c > @@ -1311,10 +1311,14 @@ static __always_inline bool free_pages_prepare(struct page *page, > */ > arch_free_page(page, order); > > - debug_pagealloc_unmap_pages(page, 1 << order); > - > + /* > + * With hardware tag-based KASAN, memory tags must be set > + * before unmapping the page with debug_pagealloc. > + */ > kasan_free_nondeferred_pages(page, order, fpi_flags); Looking at this again, I think we need to move kasan_() callback above arch_free_page(), as that can also make the page unavailable. I'll send v2.
diff --git a/mm/page_alloc.c b/mm/page_alloc.c index c89e7b107514..54bc237fd319 100644 --- a/mm/page_alloc.c +++ b/mm/page_alloc.c @@ -1311,10 +1311,14 @@ static __always_inline bool free_pages_prepare(struct page *page, */ arch_free_page(page, order); - debug_pagealloc_unmap_pages(page, 1 << order); - + /* + * With hardware tag-based KASAN, memory tags must be set + * before unmapping the page with debug_pagealloc. + */ kasan_free_nondeferred_pages(page, order, fpi_flags); + debug_pagealloc_unmap_pages(page, 1 << order); + return true; }
Currently, kasan_free_nondeferred_pages()->kasan_free_pages() is called after debug_pagealloc_unmap_pages(). This causes a crash when debug_pagealloc is enabled, as HW_TAGS KASAN can't set tags on an unmapped page. This patch puts kasan_free_nondeferred_pages() before debug_pagealloc_unmap_pages(). Besides fixing the crash, this also makes the annotation order consistent with debug_pagealloc_map_pages() preceding kasan_alloc_pages(). Signed-off-by: Andrey Konovalov <andreyknvl@google.com> --- mm/page_alloc.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-)