From: Marco Elver <elver@google.com>
To: andrey.konovalov@linux.dev
Cc: Andrew Morton <akpm@linux-foundation.org>,
Andrey Konovalov <andreyknvl@gmail.com>,
Alexander Potapenko <glider@google.com>,
Dmitry Vyukov <dvyukov@google.com>,
Andrey Ryabinin <ryabinin.a.a@gmail.com>,
kasan-dev@googlegroups.com, linux-mm@kvack.org,
"Paul E . McKenney" <paulmck@kernel.org>,
Liam.Howlett@oracle.com, linux-kernel@vger.kernel.org
Subject: Re: [PATCH mm] kasan: avoid resetting aux_lock
Date: Tue, 9 Jan 2024 23:36:01 +0100 [thread overview]
Message-ID: <CANpmjNMvixmGviZ+NTXdnBXxDxotXbjQ1Q9uB3kERX8rXN+Wkw@mail.gmail.com> (raw)
In-Reply-To: <20240109221234.90929-1-andrey.konovalov@linux.dev>
On Tue, 9 Jan 2024 at 23:12, <andrey.konovalov@linux.dev> wrote:
>
> From: Andrey Konovalov <andreyknvl@gmail.com>
>
> With commit 63b85ac56a64 ("kasan: stop leaking stack trace handles"),
> KASAN zeroes out alloc meta when an object is freed. The zeroed out data
> purposefully includes alloc and auxiliary stack traces but also
> accidentally includes aux_lock.
>
> As aux_lock is only initialized for each object slot during slab
> creation, when the freed slot is reallocated, saving auxiliary stack
> traces for the new object leads to lockdep reports when taking the
> zeroed out aux_lock.
>
> Arguably, we could reinitialize aux_lock when the object is reallocated,
> but a simpler solution is to avoid zeroing out aux_lock when an object
> gets freed.
>
> Reported-by: Paul E. McKenney <paulmck@kernel.org>
> Closes: https://lore.kernel.org/linux-next/5cc0f83c-e1d6-45c5-be89-9b86746fe731@paulmck-laptop/
> Fixes: 63b85ac56a64 ("kasan: stop leaking stack trace handles")
> Signed-off-by: Andrey Konovalov <andreyknvl@gmail.com>
Reviewed-by: Marco Elver <elver@google.com>
> ---
> mm/kasan/generic.c | 10 ++++++++--
> 1 file changed, 8 insertions(+), 2 deletions(-)
>
> diff --git a/mm/kasan/generic.c b/mm/kasan/generic.c
> index 24c13dfb1e94..df6627f62402 100644
> --- a/mm/kasan/generic.c
> +++ b/mm/kasan/generic.c
> @@ -487,6 +487,7 @@ void kasan_init_object_meta(struct kmem_cache *cache, const void *object)
> __memset(alloc_meta, 0, sizeof(*alloc_meta));
>
> /*
> + * Prepare the lock for saving auxiliary stack traces.
> * Temporarily disable KASAN bug reporting to allow instrumented
> * raw_spin_lock_init to access aux_lock, which resides inside
> * of a redzone.
> @@ -510,8 +511,13 @@ static void release_alloc_meta(struct kasan_alloc_meta *meta)
> stack_depot_put(meta->aux_stack[0]);
> stack_depot_put(meta->aux_stack[1]);
>
> - /* Zero out alloc meta to mark it as invalid. */
> - __memset(meta, 0, sizeof(*meta));
> + /*
> + * Zero out alloc meta to mark it as invalid but keep aux_lock
> + * initialized to avoid having to reinitialize it when another object
> + * is allocated in the same slot.
> + */
> + __memset(&meta->alloc_track, 0, sizeof(meta->alloc_track));
> + __memset(meta->aux_stack, 0, sizeof(meta->aux_stack));
> }
>
> static void release_free_meta(const void *object, struct kasan_free_meta *meta)
> --
> 2.25.1
>
next prev parent reply other threads:[~2024-01-09 22:36 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2024-01-09 22:12 [PATCH mm] kasan: avoid resetting aux_lock andrey.konovalov
2024-01-09 22:36 ` Marco Elver [this message]
2024-01-09 23:53 ` Paul E. McKenney
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=CANpmjNMvixmGviZ+NTXdnBXxDxotXbjQ1Q9uB3kERX8rXN+Wkw@mail.gmail.com \
--to=elver@google.com \
--cc=Liam.Howlett@oracle.com \
--cc=akpm@linux-foundation.org \
--cc=andrey.konovalov@linux.dev \
--cc=andreyknvl@gmail.com \
--cc=dvyukov@google.com \
--cc=glider@google.com \
--cc=kasan-dev@googlegroups.com \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-mm@kvack.org \
--cc=paulmck@kernel.org \
--cc=ryabinin.a.a@gmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).