From: Andrey Ryabinin <aryabinin@virtuozzo.com>
To: <linux-kernel@vger.kernel.org>
Cc: Mark Rutland <mark.rutland@arm.com>,
Alexander Potapenko <glider@google.com>,
Andrey Konovalov <adech.fo@gmail.com>,
Dmitriy Vyukov <dvyukov@google.com>, <will.deacon@arm.com>,
<catalin.marinas@arm.com>,
Andrew Morton <akpm@linux-foundation.org>,
<kasan-dev@googlegroups.com>, Ingo Molnar <mingo@kernel.org>,
Peter Zijlstra <peterz@infradead.org>,
Thomas Gleixner <tglx@linutronix.de>,
Andrey Ryabinin <aryabinin@virtuozzo.com>
Subject: [PATCH 2/2] kasan: unpoison stack of idle task on cpu online
Date: Wed, 2 Mar 2016 16:51:59 +0300 [thread overview]
Message-ID: <1456926719-13102-2-git-send-email-aryabinin@virtuozzo.com> (raw)
In-Reply-To: <1456926719-13102-1-git-send-email-aryabinin@virtuozzo.com>
KASAN poisons stack redzones on function's entrance and unpoisons prior
return. So when cpu goes offline the stack of idle task left poisoned.
When cpu goes back online it re-enters the kernel via another path and
starts using idle task's stack. Hence it's possible to hit stale poison
values which results in false-positive KASAN splats.
This patch registers cpu hotplug notifier which unpoisons idle task's
stack prior to onlining cpu.
Signed-off-by: Andrey Ryabinin <aryabinin@virtuozzo.com>
---
include/linux/sched.h | 6 ++++++
kernel/smpboot.h | 2 --
mm/kasan/kasan.c | 33 +++++++++++++++++++++++++++------
3 files changed, 33 insertions(+), 8 deletions(-)
diff --git a/include/linux/sched.h b/include/linux/sched.h
index a10494a..18e526d 100644
--- a/include/linux/sched.h
+++ b/include/linux/sched.h
@@ -337,6 +337,12 @@ extern asmlinkage void schedule_tail(struct task_struct *prev);
extern void init_idle(struct task_struct *idle, int cpu);
extern void init_idle_bootup_task(struct task_struct *idle);
+#ifdef CONFIG_GENERIC_SMP_IDLE_THREAD
+extern struct task_struct *idle_thread_get(unsigned int cpu);
+#else
+static inline struct task_struct *idle_thread_get(unsigned int cpu) { return NULL; }
+#endif
+
extern cpumask_var_t cpu_isolated_map;
extern int runqueue_is_locked(int cpu);
diff --git a/kernel/smpboot.h b/kernel/smpboot.h
index 72415a0..eebf9ec 100644
--- a/kernel/smpboot.h
+++ b/kernel/smpboot.h
@@ -4,11 +4,9 @@
struct task_struct;
#ifdef CONFIG_GENERIC_SMP_IDLE_THREAD
-struct task_struct *idle_thread_get(unsigned int cpu);
void idle_thread_set_boot_cpu(void);
void idle_threads_init(void);
#else
-static inline struct task_struct *idle_thread_get(unsigned int cpu) { return NULL; }
static inline void idle_thread_set_boot_cpu(void) { }
static inline void idle_threads_init(void) { }
#endif
diff --git a/mm/kasan/kasan.c b/mm/kasan/kasan.c
index bc0a8d8..c4ffd82 100644
--- a/mm/kasan/kasan.c
+++ b/mm/kasan/kasan.c
@@ -16,6 +16,7 @@
#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
#define DISABLE_BRANCH_PROFILING
+#include <linux/cpu.h>
#include <linux/export.h>
#include <linux/init.h>
#include <linux/kernel.h>
@@ -537,16 +538,36 @@ static int kasan_mem_notifier(struct notifier_block *nb,
{
return (action == MEM_GOING_ONLINE) ? NOTIFY_BAD : NOTIFY_OK;
}
+#endif
+
+static int kasan_cpu_callback(struct notifier_block *nfb,
+ unsigned long action, void *hcpu)
+{
+ unsigned int cpu = (unsigned long)hcpu;
+
+ if ((action == CPU_UP_PREPARE) || (action == CPU_UP_PREPARE_FROZEN)) {
+ struct task_struct *tidle = idle_thread_get(cpu);
+ kasan_unpoison_shadow(task_stack_page(tidle), THREAD_SIZE);
+ }
+ return NOTIFY_OK;
+}
-static int __init kasan_memhotplug_init(void)
+static struct notifier_block kasan_cpu_notifier =
{
- pr_err("WARNING: KASAN doesn't support memory hot-add\n");
- pr_err("Memory hot-add will be disabled\n");
+ .notifier_call = kasan_cpu_callback,
+};
- hotplug_memory_notifier(kasan_mem_notifier, 0);
+static int __init kasan_notifiers_init(void)
+{
+ if (IS_ENABLED(CONFIG_MEMORY_HOTPLUG)) {
+ pr_err("WARNING: KASAN doesn't support memory hot-add\n");
+ pr_err("Memory hot-add will be disabled\n");
+ hotplug_memory_notifier(kasan_mem_notifier, 0);
+ }
+
+ register_hotcpu_notifier(&kasan_cpu_notifier);
return 0;
}
-module_init(kasan_memhotplug_init);
-#endif
+module_init(kasan_notifiers_init);
--
2.4.10
next prev parent reply other threads:[~2016-03-02 13:52 UTC|newest]
Thread overview: 13+ messages / expand[flat|nested] mbox.gz Atom feed top
2016-02-26 12:38 [PATCH v1] kasan, arm64: Unpoison dirty stack frames when resuming from suspend Alexander Potapenko
2016-02-26 13:53 ` Mark Rutland
2016-02-26 17:28 ` Alexander Potapenko
2016-03-01 19:37 ` Mark Rutland
2016-03-01 19:42 ` Mark Rutland
2016-03-01 20:05 ` [PATCH] sched/kasan: clear stale stack poison kbuild test robot
2016-03-02 12:53 ` [PATCH v1] kasan, arm64: Unpoison dirty stack frames when resuming from suspend Andrey Ryabinin
2016-03-02 13:51 ` [PATCH 1/2] cpu, idle: move init_idle() out of idle_thread_get() Andrey Ryabinin
2016-03-02 13:51 ` Andrey Ryabinin [this message]
2016-03-02 14:50 ` [PATCH 2/2] kasan: unpoison stack of idle task on cpu online Mark Rutland
2016-03-02 15:27 ` Andrey Ryabinin
2016-03-02 15:43 ` Mark Rutland
2016-02-27 1:05 ` [PATCH v1] kasan, arm64: Unpoison dirty stack frames when resuming from suspend kbuild test robot
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1456926719-13102-2-git-send-email-aryabinin@virtuozzo.com \
--to=aryabinin@virtuozzo.com \
--cc=adech.fo@gmail.com \
--cc=akpm@linux-foundation.org \
--cc=catalin.marinas@arm.com \
--cc=dvyukov@google.com \
--cc=glider@google.com \
--cc=kasan-dev@googlegroups.com \
--cc=linux-kernel@vger.kernel.org \
--cc=mark.rutland@arm.com \
--cc=mingo@kernel.org \
--cc=peterz@infradead.org \
--cc=tglx@linutronix.de \
--cc=will.deacon@arm.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).