From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id 9BE17ECAAD3 for ; Mon, 19 Sep 2022 12:03:18 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id 30904940007; Mon, 19 Sep 2022 08:03:18 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id 2B7B36B0075; Mon, 19 Sep 2022 08:03:18 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 15814940007; Mon, 19 Sep 2022 08:03:18 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0012.hostedemail.com [216.40.44.12]) by kanga.kvack.org (Postfix) with ESMTP id 07FA26B0074 for ; Mon, 19 Sep 2022 08:03:18 -0400 (EDT) Received: from smtpin12.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay02.hostedemail.com (Postfix) with ESMTP id D9690120A63 for ; Mon, 19 Sep 2022 12:03:17 +0000 (UTC) X-FDA: 79928699634.12.E31AA7B Received: from smtp-out2.suse.de (smtp-out2.suse.de [195.135.220.29]) by imf28.hostedemail.com (Postfix) with ESMTP id 5736AC000A for ; Mon, 19 Sep 2022 12:03:17 +0000 (UTC) Received: from imap2.suse-dmz.suse.de (imap2.suse-dmz.suse.de [192.168.254.74]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-521) server-digest SHA512) (No client certificate requested) by smtp-out2.suse.de (Postfix) with ESMTPS id ED3041F979; Mon, 19 Sep 2022 12:03:15 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=suse.cz; s=susede2_rsa; t=1663588995; h=from:from:reply-to:date:date:message-id:message-id:to:to:cc:cc: mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=ManmE5V1ehdOvXYbh2CMRxzGTWmNKmsd43FJKsh3l20=; b=1VEiDjt3TJwL0CYwU5+HX73Hh5ZW3EFDxgLV8jf4m1rdXtbsijG066zqBqByDMj8BkFgSY vza3ix8d9lK3mZUIwcYfxfkKNCrTUYfWpNSkdKXTInmBV4wF+/KEOmrhWrNY3oTBr9EE6S NhMEo2VHPMCdDNgIIL1hf+YpeEGJo9E= DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/relaxed; d=suse.cz; s=susede2_ed25519; t=1663588995; h=from:from:reply-to:date:date:message-id:message-id:to:to:cc:cc: mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=ManmE5V1ehdOvXYbh2CMRxzGTWmNKmsd43FJKsh3l20=; b=TmALi3dK3WBwwTO2sNwA/NlA5t5ns94RgxLdvvpKmj0lxfgzn1VK9wkqldIp3Hjhy+pDh6 3DPsgpFMj6M78tAQ== Received: from imap2.suse-dmz.suse.de (imap2.suse-dmz.suse.de [192.168.254.74]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-521) server-digest SHA512) (No client certificate requested) by imap2.suse-dmz.suse.de (Postfix) with ESMTPS id BE6F813ABD; Mon, 19 Sep 2022 12:03:15 +0000 (UTC) Received: from dovecot-director2.suse.de ([192.168.254.65]) by imap2.suse-dmz.suse.de with ESMTPSA id +dPELYNaKGOxHQAAMHmgww (envelope-from ); Mon, 19 Sep 2022 12:03:15 +0000 Message-ID: Date: Mon, 19 Sep 2022 14:03:15 +0200 MIME-Version: 1.0 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:102.0) Gecko/20100101 Thunderbird/102.2.2 Subject: Re: [PATCH] mm/slab_common: fix possiable double free of kmem_cache To: Hyeonggon Yoo <42.hyeyoo@gmail.com> Cc: Feng Tang , Christoph Lameter , Pekka Enberg , David Rientjes , Joonsoo Kim , Roman Gushchin , Andrew Morton , Waiman Long , linux-mm@kvack.org, linux-kernel@vger.kernel.org, kasan-dev@googlegroups.com References: <20220919031241.1358001-1-feng.tang@intel.com> Content-Language: en-US From: Vlastimil Babka In-Reply-To: Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1663588997; a=rsa-sha256; cv=none; b=xK0SfPqdAgRnv53t2akqkwn26bQzgfiyMLJoI4GeUUYxNGl5tFjFOUUVSt0p/fWEucpBRH 4kX9RxVS2JZwYBli1kU/NGfKB2C7CrhFgDQFGvKYjuPeMfwJjs5c5WI8J9EUBpejCuxE09 vVer/8NwPcWBrXr1B11zzhTBWvzHZOo= ARC-Authentication-Results: i=1; imf28.hostedemail.com; dkim=pass header.d=suse.cz header.s=susede2_rsa header.b=1VEiDjt3; dkim=pass header.d=suse.cz header.s=susede2_ed25519 header.b=TmALi3dK; spf=pass (imf28.hostedemail.com: domain of vbabka@suse.cz designates 195.135.220.29 as permitted sender) smtp.mailfrom=vbabka@suse.cz; dmarc=none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1663588997; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references:dkim-signature; bh=ManmE5V1ehdOvXYbh2CMRxzGTWmNKmsd43FJKsh3l20=; b=kYSVrH6fwO13KDsTrtUxdJpRBKATCtWzNwVwBKunAwSLMZkcrn74miW5cD8Iecjnxw1nA5 S/X8JlfjFoif4ZH5WBn0DQvvAwu0hzbJM55Mr1MCa+Z4Zo0rPhjNr/7gkomyjIYvlZOtoj suqmxFWH6nc7JywhEJ9SJrzCoQlg7Nk= Authentication-Results: imf28.hostedemail.com; dkim=pass header.d=suse.cz header.s=susede2_rsa header.b=1VEiDjt3; dkim=pass header.d=suse.cz header.s=susede2_ed25519 header.b=TmALi3dK; spf=pass (imf28.hostedemail.com: domain of vbabka@suse.cz designates 195.135.220.29 as permitted sender) smtp.mailfrom=vbabka@suse.cz; dmarc=none X-Stat-Signature: 4ypxsmkbfdo9ahu41cccq5i3w1xqnbep X-Rspam-User: X-Rspamd-Server: rspam09 X-Rspamd-Queue-Id: 5736AC000A X-HE-Tag: 1663588997-808552 X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: On 9/19/22 13:56, Hyeonggon Yoo wrote: > On Mon, Sep 19, 2022 at 11:12:38AM +0200, Vlastimil Babka wrote: >> On 9/19/22 05:12, Feng Tang wrote: >> > When doing slub_debug test, kfence's 'test_memcache_typesafe_by_rcu' >> > kunit test case cause a use-after-free error: >> > > > If I'm not mistaken, I think the subject should be: > s/double free/use after free/g Well, it's both AFAICS. By the initial use-after-free we can read a wrong s->flags that was modified since we freed for the first time, and it can lead to another kmem_cache_release() which is basically a double free. >> > BUG: KASAN: use-after-free in kobject_del+0x14/0x30 >> > Read of size 8 at addr ffff888007679090 by task kunit_try_catch/261 >> > >> > CPU: 1 PID: 261 Comm: kunit_try_catch Tainted: G B N 6.0.0-rc5-next-20220916 #17 >> > Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014 >> > Call Trace: >> > >> > dump_stack_lvl+0x34/0x48 >> > print_address_description.constprop.0+0x87/0x2a5 >> > print_report+0x103/0x1ed >> > kasan_report+0xb7/0x140 >> > kobject_del+0x14/0x30 >> > kmem_cache_destroy+0x130/0x170 >> > test_exit+0x1a/0x30 >> > kunit_try_run_case+0xad/0xc0 >> > kunit_generic_run_threadfn_adapter+0x26/0x50 >> > kthread+0x17b/0x1b0 >> > >> > >> > The cause is inside kmem_cache_destroy(): >> > >> > kmem_cache_destroy >> > acquire lock/mutex >> > shutdown_cache >> > schedule_work(kmem_cache_release) (if RCU flag set) >> > release lock/mutex >> > kmem_cache_release (if RCU flag set) >> >> ^ not set >> >> I've fixed that up. >> >> > >> > in some certain timing, the scheduled work could be run before >> > the next RCU flag checking which will get a wrong state. >> > >> > Fix it by caching the RCU flag inside protected area, just like 'refcnt' > > Very nice catch, thanks! > > Otherwise (and with Vlastimil's fix): > > Looks good to me. > Reviewed-by: Hyeonggon Yoo <42.hyeyoo@gmail.com> > >> > >> > Signed-off-by: Feng Tang >> >> Thanks! >> >> > --- >> > >> > note: >> > >> > The error only happens on linux-next tree, and not in Linus' tree, >> > which already has Waiman's commit: >> > 0495e337b703 ("mm/slab_common: Deleting kobject in kmem_cache_destroy() >> > without holding slab_mutex/cpu_hotplug_lock") >> >> Actually that commit is already in Linus' rc5 too, so I will send your fix >> this week too. Added a Fixes: 0495e337b703 (...) too. >> >> > mm/slab_common.c | 5 ++++- >> > 1 file changed, 4 insertions(+), 1 deletion(-) >> > >> > diff --git a/mm/slab_common.c b/mm/slab_common.c >> > index 07b948288f84..ccc02573588f 100644 >> > --- a/mm/slab_common.c >> > +++ b/mm/slab_common.c >> > @@ -475,6 +475,7 @@ void slab_kmem_cache_release(struct kmem_cache *s) >> > void kmem_cache_destroy(struct kmem_cache *s) >> > { >> > int refcnt; >> > + bool rcu_set; >> > >> > if (unlikely(!s) || !kasan_check_byte(s)) >> > return; >> > @@ -482,6 +483,8 @@ void kmem_cache_destroy(struct kmem_cache *s) >> > cpus_read_lock(); >> > mutex_lock(&slab_mutex); >> > >> > + rcu_set = s->flags & SLAB_TYPESAFE_BY_RCU; >> > + >> > refcnt = --s->refcount; >> > if (refcnt) >> > goto out_unlock; >> > @@ -492,7 +495,7 @@ void kmem_cache_destroy(struct kmem_cache *s) >> > out_unlock: >> > mutex_unlock(&slab_mutex); >> > cpus_read_unlock(); >> > - if (!refcnt && !(s->flags & SLAB_TYPESAFE_BY_RCU)) >> > + if (!refcnt && !rcu_set) >> > kmem_cache_release(s); >> > } >> > EXPORT_SYMBOL(kmem_cache_destroy); >> >