From patchwork Tue Dec 19 21:19:51 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: andrey.konovalov@linux.dev X-Patchwork-Id: 13499117 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id AF8FCC41535 for ; Tue, 19 Dec 2023 21:20:06 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id 0969C6B007D; Tue, 19 Dec 2023 16:20:02 -0500 (EST) Received: by kanga.kvack.org (Postfix, from userid 40) id DB2326B007E; Tue, 19 Dec 2023 16:20:01 -0500 (EST) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id BE1C56B0081; Tue, 19 Dec 2023 16:20:01 -0500 (EST) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0012.hostedemail.com [216.40.44.12]) by kanga.kvack.org (Postfix) with ESMTP id A28566B007E for ; Tue, 19 Dec 2023 16:20:01 -0500 (EST) Received: from smtpin02.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay03.hostedemail.com (Postfix) with ESMTP id 8424FA0156 for ; Tue, 19 Dec 2023 21:20:01 +0000 (UTC) X-FDA: 81584835402.02.5647B90 Received: from out-179.mta1.migadu.com (out-179.mta1.migadu.com [95.215.58.179]) by imf24.hostedemail.com (Postfix) with ESMTP id A8086180017 for ; Tue, 19 Dec 2023 21:19:59 +0000 (UTC) Authentication-Results: imf24.hostedemail.com; dkim=pass header.d=linux.dev header.s=key1 header.b=IR+Whe6+; dmarc=pass (policy=none) header.from=linux.dev; spf=pass (imf24.hostedemail.com: domain of andrey.konovalov@linux.dev designates 95.215.58.179 as permitted sender) smtp.mailfrom=andrey.konovalov@linux.dev ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1703020799; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references:dkim-signature; bh=IugD6msAA76PLOkulY8RL+cRtUx1nL2a5VcYM7ZPFvs=; b=EWneya9LsYU1L0pyNhfY3FTVJNmtDww4iRQW8/wU30JWouwBLB5yylLJbqUzRMRsf0LlmX 7sMqBrSj/ZI0b5225lJ8ZMXdTxIbEMXi0yhPLlbMMbYpIjQgEc4Xy9CQ+Zb/Nq3xXi1Pnk /bDPB5gjQoKCYSPWsZca6hBpf97VfbY= ARC-Authentication-Results: i=1; imf24.hostedemail.com; dkim=pass header.d=linux.dev header.s=key1 header.b=IR+Whe6+; dmarc=pass (policy=none) header.from=linux.dev; spf=pass (imf24.hostedemail.com: domain of andrey.konovalov@linux.dev designates 95.215.58.179 as permitted sender) smtp.mailfrom=andrey.konovalov@linux.dev ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1703020799; a=rsa-sha256; cv=none; b=qKsMl6VXiYBAtW5Q6qeu54ZdMEVsFBARSCy3IevfA2tqr/hnhsroCElZ2hHpDXoY98wPB2 qIoCSTFjUNw4mulnq2CyfDWp5Lho1Q2H9LbPTclOK0iCqOr4omFF3wD1M0M2NjPobo+dNX GoKHmHKm569bCLB71Sws3rUbnptN7z4= X-Report-Abuse: Please report any abuse attempt to abuse@migadu.com and include these headers. DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linux.dev; s=key1; t=1703020798; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=IugD6msAA76PLOkulY8RL+cRtUx1nL2a5VcYM7ZPFvs=; b=IR+Whe6+qpxv+At+vArbXY01tYtvfspW3PKw8UAncGDGnEEps0UIMWhP+wPzEx5NxY9M8h m1TDVtQZm9HrpXOj1mV5z/Lc+HwiQjOjMkmc/bfj2auMjP1/9llRH/NH6L89Gq+qP7zEz3 M7vUVsknaJSSv98tDJGKvpfbqCVOHN0= From: andrey.konovalov@linux.dev To: Andrew Morton Cc: Andrey Konovalov , Marco Elver , Alexander Potapenko , Dmitry Vyukov , Vlastimil Babka , kasan-dev@googlegroups.com, Evgenii Stepanov , Tetsuo Handa , linux-mm@kvack.org, linux-kernel@vger.kernel.org, Andrey Konovalov , syzbot+186b55175d8360728234@syzkaller.appspotmail.com Subject: [PATCH v3 mm 2/4] kasan: handle concurrent kasan_record_aux_stack calls Date: Tue, 19 Dec 2023 22:19:51 +0100 Message-Id: <1606b960e2f746862d1f459515972f9695bf448a.1703020707.git.andreyknvl@google.com> In-Reply-To: References: MIME-Version: 1.0 X-Migadu-Flow: FLOW_OUT X-Rspam-User: X-Rspamd-Server: rspam12 X-Rspamd-Queue-Id: A8086180017 X-Stat-Signature: o7fj1b5gkrn7upx4twio15z33hyyt1rk X-HE-Tag: 1703020799-361599 X-HE-Meta: U2FsdGVkX19cqsLTC1wyDTZgNYgoqWWCQqwkp58f/qypSLX68pUeGep3onJkIjtRcuBvTO/YpChx0R/E2SyvQUZY/CeuWxOgWGtHERfQ9hKb1kANNXpMoomPz+QvjBuLFGpkWnJNaSXJWXUs249mAK/9myx9OToZhJfIFhRc9X1qB6KRjwb/3NHoO5xLP6fqzxh+rdYj8LEfdcw+6N2bt8YqS47a2s9/4nuI27yPGsNsdC7bErho3c8OPArMv2DDm74JszuM08WyPxruXYUWkx5G67NmAPPv7zshmF/chBxKV5oG+4TcXvS0TQbvf2HikoXVBdpKusw/wRXxGcTkg6qS8HDb3wQiJZ6mN6V6s8b6WlVcIHL08a3MqPh6oY/WTQ5EbAqdL6WXq5dNxP+nYfTZGpWlBK7jMTDIdMozKv2r9o4cG4RGFTMhj30pQoEljs2yZ7vvMTZXYmFtkoGeSO9JP2QheaaGSXk/dYZxQILF17VfEfhh58Kb5UULLf2c9ade/6gyJliH/luspAeY9hqfUVzKanS7TStnR4pONvMUdvGmzXmUv5+NEJNcvZ0lGUlNAN/q62/a0hfRurX7afHXh0GCnx2u3TLFmVIEWtDjuUc8FIb++pRCXJAG9qWSESvEY047n7aqm8sFrHJ2Htj0W1ZojD2VcdXwa2Xcrgf54SlpTAXGI7VmrKsjrIASSHKIeqzW4EYz//22QIEuGfArXCeRlPvZthz8JUv+em9CnuxDDY8azaLMPzCQacB/7JslEGa+BcRwSedHKOwR1OHqqsYRRDIPv7/Yuto+eyoo4FIYA0eFpEGdkgJx8h2+rqBYlJcloRxcm90RH1owwoixls3+ULCF7U4P/b1XiB52x34ik5jiwyctaNFUk/f5xi9C/TAn2c9WUQDi/f52k7PpTCwpcDydjVM7LfsNl8utbE4zsMI7B+6EGYOzKHOLsrtcLLSOJQwINdG40u+ QVDMPIH6 Lh2+h15MsfUk8ZRwQbnM1/U8ig7Nd9VpvAp1mymvpnXKOk+gH8q70qz3EmAW+pIgdQ02hhDb0nExb6T7YozldbrHRF9mD8wBgJMRzQcQTsWdvmvxQSyahbRHc3q/9Sd13t+CP69VuYMkuucFKJi31uJ+4HKhYiOkvMaf+unFH25U8CyClI0y2GUVkXY/hio9kgUo68+O3yR0V2Xm4auQD2pDTPSkNbCTSi51lrgQAD1/aZTEi601Qes1WoDSSrd1l9xRKdO9UrtX0qbE/vaGVCBp55LDDYN0t82LwPGIVGt92lVSy5Rk0k63L4Rbes+dZ3KuA+eZHvenA74k= X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: List-Subscribe: List-Unsubscribe: From: Andrey Konovalov kasan_record_aux_stack can be called concurrently on the same object. This might lead to a race condition when rotating the saved aux stack trace handles, which in turns leads to incorrect accounting of stack depot handles and refcount underflows in the stack depot code. Fix by introducing a raw spinlock to protect the aux stack trace handles in kasan_record_aux_stack. Reported-by: Tetsuo Handa Reported-by: syzbot+186b55175d8360728234@syzkaller.appspotmail.com Closes: https://lore.kernel.org/all/000000000000784b1c060b0074a2@google.com/ Fixes: 773688a6cb24 ("kasan: use stack_depot_put for Generic mode") Signed-off-by: Andrey Konovalov Reviewed-by: Marco Elver --- Changes v2->v3: - Use raw spinlock to avoid lockdep complaints on RT kernels. Changes v1->v2: - Use per-object spinlock instead of a global one. --- mm/kasan/generic.c | 32 +++++++++++++++++++++++++++++--- mm/kasan/kasan.h | 8 ++++++++ 2 files changed, 37 insertions(+), 3 deletions(-) diff --git a/mm/kasan/generic.c b/mm/kasan/generic.c index 54e20b2bc3e1..55e6b5db2cae 100644 --- a/mm/kasan/generic.c +++ b/mm/kasan/generic.c @@ -25,6 +25,7 @@ #include #include #include +#include #include #include #include @@ -471,8 +472,18 @@ void kasan_init_object_meta(struct kmem_cache *cache, const void *object) struct kasan_free_meta *free_meta; alloc_meta = kasan_get_alloc_meta(cache, object); - if (alloc_meta) + if (alloc_meta) { __memset(alloc_meta, 0, sizeof(*alloc_meta)); + + /* + * Temporarily disable KASAN bug reporting to allow instrumented + * raw_spin_lock_init to access aux_lock, which resides inside + * of a redzone. + */ + kasan_disable_current(); + raw_spin_lock_init(&alloc_meta->aux_lock); + kasan_enable_current(); + } free_meta = kasan_get_free_meta(cache, object); if (free_meta) __memset(free_meta, 0, sizeof(*free_meta)); @@ -502,6 +513,8 @@ static void __kasan_record_aux_stack(void *addr, depot_flags_t depot_flags) struct kmem_cache *cache; struct kasan_alloc_meta *alloc_meta; void *object; + depot_stack_handle_t new_handle, old_handle; + unsigned long flags; if (is_kfence_address(addr) || !slab) return; @@ -512,9 +525,22 @@ static void __kasan_record_aux_stack(void *addr, depot_flags_t depot_flags) if (!alloc_meta) return; - stack_depot_put(alloc_meta->aux_stack[1]); + new_handle = kasan_save_stack(0, depot_flags); + + /* + * Temporarily disable KASAN bug reporting to allow instrumented + * spinlock functions to access aux_lock, which resides inside of a + * redzone. + */ + kasan_disable_current(); + raw_spin_lock_irqsave(&alloc_meta->aux_lock, flags); + old_handle = alloc_meta->aux_stack[1]; alloc_meta->aux_stack[1] = alloc_meta->aux_stack[0]; - alloc_meta->aux_stack[0] = kasan_save_stack(0, depot_flags); + alloc_meta->aux_stack[0] = new_handle; + raw_spin_unlock_irqrestore(&alloc_meta->aux_lock, flags); + kasan_enable_current(); + + stack_depot_put(old_handle); } void kasan_record_aux_stack(void *addr) diff --git a/mm/kasan/kasan.h b/mm/kasan/kasan.h index 5e298e3ac909..69e4f5e58e33 100644 --- a/mm/kasan/kasan.h +++ b/mm/kasan/kasan.h @@ -6,6 +6,7 @@ #include #include #include +#include #include #if defined(CONFIG_KASAN_SW_TAGS) || defined(CONFIG_KASAN_HW_TAGS) @@ -249,6 +250,13 @@ struct kasan_global { struct kasan_alloc_meta { struct kasan_track alloc_track; /* Free track is stored in kasan_free_meta. */ + /* + * aux_lock protects aux_stack from accesses from concurrent + * kasan_record_aux_stack calls. It is a raw spinlock to avoid sleeping + * on RT kernels, as kasan_record_aux_stack_noalloc can be called from + * non-sleepable contexts. + */ + raw_spinlock_t aux_lock; depot_stack_handle_t aux_stack[2]; };