linux-mm.kvack.org archive mirror
 help / color / mirror / Atom feed
From: Andrey Konovalov <andreyknvl@gmail.com>
To: Daniel Axtens <dja@axtens.net>
Cc: LKML <linux-kernel@vger.kernel.org>,
	 Linux Memory Management List <linux-mm@kvack.org>,
	kasan-dev <kasan-dev@googlegroups.com>,
	 Andrew Morton <akpm@linux-foundation.org>,
	Nicholas Piggin <npiggin@gmail.com>,
	 David Gow <davidgow@google.com>,
	Dmitry Vyukov <dvyukov@google.com>,
	 Uladzislau Rezki <urezki@gmail.com>
Subject: Re: [PATCH] mm/vmalloc: unbreak kasan vmalloc support
Date: Sun, 20 Jun 2021 14:44:17 +0300	[thread overview]
Message-ID: <CA+fCnZcV3F5xMtvu6n=w9PKRfuJf5v80M8kenkmMv4gb5+btnQ@mail.gmail.com> (raw)
In-Reply-To: <20210617081330.98629-1-dja@axtens.net>

On Thu, Jun 17, 2021 at 11:13 AM Daniel Axtens <dja@axtens.net> wrote:
>
> In commit 121e6f3258fe ("mm/vmalloc: hugepage vmalloc mappings"),
> __vmalloc_node_range was changed such that __get_vm_area_node was no
> longer called with the requested/real size of the vmalloc allocation, but
> rather with a rounded-up size.
>
> This means that __get_vm_area_node called kasan_unpoision_vmalloc() with
> a rounded up size rather than the real size. This led to it allowing
> access to too much memory and so missing vmalloc OOBs and failing the
> kasan kunit tests.
>
> Pass the real size and the desired shift into __get_vm_area_node. This
> allows it to round up the size for the underlying allocators while
> still unpoisioning the correct quantity of shadow memory.
>
> Adjust the other call-sites to pass in PAGE_SHIFT for the shift value.
>
> Cc: Nicholas Piggin <npiggin@gmail.com>
> Cc: David Gow <davidgow@google.com>
> Cc: Dmitry Vyukov <dvyukov@google.com>
> Cc: Andrey Konovalov <andreyknvl@gmail.com>
> Cc: Uladzislau Rezki (Sony) <urezki@gmail.com>
> Link: https://bugzilla.kernel.org/show_bug.cgi?id=213335
> Fixes: 121e6f3258fe ("mm/vmalloc: hugepage vmalloc mappings")
> Signed-off-by: Daniel Axtens <dja@axtens.net>
> ---
>  mm/vmalloc.c | 24 ++++++++++++++----------
>  1 file changed, 14 insertions(+), 10 deletions(-)
>
> diff --git a/mm/vmalloc.c b/mm/vmalloc.c
> index aaad569e8963..3471cbeb083c 100644
> --- a/mm/vmalloc.c
> +++ b/mm/vmalloc.c
> @@ -2362,15 +2362,16 @@ static void clear_vm_uninitialized_flag(struct vm_struct *vm)
>  }
>
>  static struct vm_struct *__get_vm_area_node(unsigned long size,
> -               unsigned long align, unsigned long flags, unsigned long start,
> -               unsigned long end, int node, gfp_t gfp_mask, const void *caller)
> +               unsigned long align, unsigned long shift, unsigned long flags,
> +               unsigned long start, unsigned long end, int node,
> +               gfp_t gfp_mask, const void *caller)
>  {
>         struct vmap_area *va;
>         struct vm_struct *area;
>         unsigned long requested_size = size;
>
>         BUG_ON(in_interrupt());
> -       size = PAGE_ALIGN(size);
> +       size = ALIGN(size, 1ul << shift);
>         if (unlikely(!size))
>                 return NULL;
>
> @@ -2402,8 +2403,8 @@ struct vm_struct *__get_vm_area_caller(unsigned long size, unsigned long flags,
>                                        unsigned long start, unsigned long end,
>                                        const void *caller)
>  {
> -       return __get_vm_area_node(size, 1, flags, start, end, NUMA_NO_NODE,
> -                                 GFP_KERNEL, caller);
> +       return __get_vm_area_node(size, 1, PAGE_SHIFT, flags, start, end,
> +                                 NUMA_NO_NODE, GFP_KERNEL, caller);
>  }
>
>  /**
> @@ -2419,7 +2420,8 @@ struct vm_struct *__get_vm_area_caller(unsigned long size, unsigned long flags,
>   */
>  struct vm_struct *get_vm_area(unsigned long size, unsigned long flags)
>  {
> -       return __get_vm_area_node(size, 1, flags, VMALLOC_START, VMALLOC_END,
> +       return __get_vm_area_node(size, 1, PAGE_SHIFT, flags,
> +                                 VMALLOC_START, VMALLOC_END,
>                                   NUMA_NO_NODE, GFP_KERNEL,
>                                   __builtin_return_address(0));
>  }
> @@ -2427,7 +2429,8 @@ struct vm_struct *get_vm_area(unsigned long size, unsigned long flags)
>  struct vm_struct *get_vm_area_caller(unsigned long size, unsigned long flags,
>                                 const void *caller)
>  {
> -       return __get_vm_area_node(size, 1, flags, VMALLOC_START, VMALLOC_END,
> +       return __get_vm_area_node(size, 1, PAGE_SHIFT, flags,
> +                                 VMALLOC_START, VMALLOC_END,
>                                   NUMA_NO_NODE, GFP_KERNEL, caller);
>  }
>
> @@ -2949,9 +2952,9 @@ void *__vmalloc_node_range(unsigned long size, unsigned long align,
>         }
>
>  again:
> -       size = PAGE_ALIGN(size);
> -       area = __get_vm_area_node(size, align, VM_ALLOC | VM_UNINITIALIZED |
> -                               vm_flags, start, end, node, gfp_mask, caller);
> +       area = __get_vm_area_node(real_size, align, shift, VM_ALLOC |
> +                                 VM_UNINITIALIZED | vm_flags, start, end, node,
> +                                 gfp_mask, caller);
>         if (!area) {
>                 warn_alloc(gfp_mask, NULL,
>                         "vmalloc error: size %lu, vm_struct allocation failed",
> @@ -2970,6 +2973,7 @@ void *__vmalloc_node_range(unsigned long size, unsigned long align,
>          */
>         clear_vm_uninitialized_flag(area);
>
> +       size = PAGE_ALIGN(size);
>         kmemleak_vmalloc(area, size, gfp_mask);
>
>         return addr;
> --
> 2.30.2
>

This fixes the vmalloc_oob test for me. Thank you, Daniel!

Tested-by: Andrey Konovalov <andreyknvl@gmail.com>
Acked-by: Andrey Konovalov <andreyknvl@gmail.com>


      parent reply	other threads:[~2021-06-20 11:44 UTC|newest]

Thread overview: 5+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2021-06-17  8:13 [PATCH] mm/vmalloc: unbreak kasan vmalloc support Daniel Axtens
2021-06-17  8:43 ` David Gow
2021-06-17  9:40 ` Nicholas Piggin
2021-06-19 13:02   ` Uladzislau Rezki
2021-06-20 11:44 ` Andrey Konovalov [this message]

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to='CA+fCnZcV3F5xMtvu6n=w9PKRfuJf5v80M8kenkmMv4gb5+btnQ@mail.gmail.com' \
    --to=andreyknvl@gmail.com \
    --cc=akpm@linux-foundation.org \
    --cc=davidgow@google.com \
    --cc=dja@axtens.net \
    --cc=dvyukov@google.com \
    --cc=kasan-dev@googlegroups.com \
    --cc=linux-kernel@vger.kernel.org \
    --cc=linux-mm@kvack.org \
    --cc=npiggin@gmail.com \
    --cc=urezki@gmail.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).