* [PATCH mm/stable] mm: fix vrealloc()'s KASAN poisoning logic
@ 2024-11-26 0:52 Andrii Nakryiko
2024-11-28 0:58 ` Andrew Morton
0 siblings, 1 reply; 6+ messages in thread
From: Andrii Nakryiko @ 2024-11-26 0:52 UTC (permalink / raw)
To: linux-mm, akpm, urezki, hch
Cc: vbabka, dakr, mhocko, linux-kernel, bpf, ast, Andrii Nakryiko
When vrealloc() reuses already allocated vmap_area, we need to
re-annotate poisoned and unpoisoned portions of underlying memory
according to the new size.
Note, hard-coding KASAN_VMALLOC_PROT_NORMAL might not be exactly
correct, but KASAN flag logic is pretty involved and spread out
throughout __vmalloc_node_range_noprof(), so I'm using the bare minimum
flag here and leaving the rest to mm people to refactor this logic and
reuse it here.
Fixes: 3ddc2fefe6f3 ("mm: vmalloc: implement vrealloc()")
Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
---
mm/vmalloc.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/mm/vmalloc.c b/mm/vmalloc.c
index 7ed39d104201..f009b21705c1 100644
--- a/mm/vmalloc.c
+++ b/mm/vmalloc.c
@@ -4093,7 +4093,8 @@ void *vrealloc_noprof(const void *p, size_t size, gfp_t flags)
/* Zero out spare memory. */
if (want_init_on_alloc(flags))
memset((void *)p + size, 0, old_size - size);
-
+ kasan_poison_vmalloc(p + size, old_size - size);
+ kasan_unpoison_vmalloc(p, size, KASAN_VMALLOC_PROT_NORMAL);
return (void *)p;
}
--
2.43.5
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH mm/stable] mm: fix vrealloc()'s KASAN poisoning logic
2024-11-26 0:52 [PATCH mm/stable] mm: fix vrealloc()'s KASAN poisoning logic Andrii Nakryiko
@ 2024-11-28 0:58 ` Andrew Morton
2024-11-28 6:15 ` Andrii Nakryiko
0 siblings, 1 reply; 6+ messages in thread
From: Andrew Morton @ 2024-11-28 0:58 UTC (permalink / raw)
To: Andrii Nakryiko
Cc: linux-mm, urezki, hch, vbabka, dakr, mhocko, linux-kernel, bpf, ast
On Mon, 25 Nov 2024 16:52:06 -0800 Andrii Nakryiko <andrii@kernel.org> wrote:
> When vrealloc() reuses already allocated vmap_area, we need to
> re-annotate poisoned and unpoisoned portions of underlying memory
> according to the new size.
What are the consequences of this oversight?
When fixing a flaw, please always remember to describe the visible
effects of that flaw.
> Note, hard-coding KASAN_VMALLOC_PROT_NORMAL might not be exactly
> correct, but KASAN flag logic is pretty involved and spread out
> throughout __vmalloc_node_range_noprof(), so I'm using the bare minimum
> flag here and leaving the rest to mm people to refactor this logic and
> reuse it here.
>
> Fixes: 3ddc2fefe6f3 ("mm: vmalloc: implement vrealloc()")
Because a cc:stable might be appropriate here. But without knowing the
effects, it's hard to determine this.
> --- a/mm/vmalloc.c
> +++ b/mm/vmalloc.c
> @@ -4093,7 +4093,8 @@ void *vrealloc_noprof(const void *p, size_t size, gfp_t flags)
> /* Zero out spare memory. */
> if (want_init_on_alloc(flags))
> memset((void *)p + size, 0, old_size - size);
> -
> + kasan_poison_vmalloc(p + size, old_size - size);
> + kasan_unpoison_vmalloc(p, size, KASAN_VMALLOC_PROT_NORMAL);
> return (void *)p;
> }
>
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH mm/stable] mm: fix vrealloc()'s KASAN poisoning logic
2024-11-28 0:58 ` Andrew Morton
@ 2024-11-28 6:15 ` Andrii Nakryiko
2024-12-04 17:01 ` Alexei Starovoitov
0 siblings, 1 reply; 6+ messages in thread
From: Andrii Nakryiko @ 2024-11-28 6:15 UTC (permalink / raw)
To: Andrew Morton
Cc: Andrii Nakryiko, linux-mm, urezki, hch, vbabka, dakr, mhocko,
linux-kernel, bpf, ast
On Wed, Nov 27, 2024 at 4:58 PM Andrew Morton <akpm@linux-foundation.org> wrote:
>
> On Mon, 25 Nov 2024 16:52:06 -0800 Andrii Nakryiko <andrii@kernel.org> wrote:
>
> > When vrealloc() reuses already allocated vmap_area, we need to
> > re-annotate poisoned and unpoisoned portions of underlying memory
> > according to the new size.
>
> What are the consequences of this oversight?
>
> When fixing a flaw, please always remember to describe the visible
> effects of that flaw.
>
See [0] for false KASAN splat. I should have left a link to that, sorry.
[0] https://lore.kernel.org/bpf/67450f9b.050a0220.21d33d.0004.GAE@google.com/
> > Note, hard-coding KASAN_VMALLOC_PROT_NORMAL might not be exactly
> > correct, but KASAN flag logic is pretty involved and spread out
> > throughout __vmalloc_node_range_noprof(), so I'm using the bare minimum
> > flag here and leaving the rest to mm people to refactor this logic and
> > reuse it here.
> >
> > Fixes: 3ddc2fefe6f3 ("mm: vmalloc: implement vrealloc()")
>
> Because a cc:stable might be appropriate here. But without knowing the
> effects, it's hard to determine this.
This is KASAN-related, so the effect is a KASAN mis-reporting issue
where there is none.
>
> > --- a/mm/vmalloc.c
> > +++ b/mm/vmalloc.c
> > @@ -4093,7 +4093,8 @@ void *vrealloc_noprof(const void *p, size_t size, gfp_t flags)
> > /* Zero out spare memory. */
> > if (want_init_on_alloc(flags))
> > memset((void *)p + size, 0, old_size - size);
> > -
> > + kasan_poison_vmalloc(p + size, old_size - size);
> > + kasan_unpoison_vmalloc(p, size, KASAN_VMALLOC_PROT_NORMAL);
> > return (void *)p;
> > }
> >
>
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH mm/stable] mm: fix vrealloc()'s KASAN poisoning logic
2024-11-28 6:15 ` Andrii Nakryiko
@ 2024-12-04 17:01 ` Alexei Starovoitov
2024-12-04 21:50 ` Andrew Morton
0 siblings, 1 reply; 6+ messages in thread
From: Alexei Starovoitov @ 2024-12-04 17:01 UTC (permalink / raw)
To: Andrii Nakryiko
Cc: Andrew Morton, Andrii Nakryiko, linux-mm, Uladzislau Rezki,
Christoph Hellwig, Vlastimil Babka, dakr, Michal Hocko, LKML,
bpf, Alexei Starovoitov
Andrew,
What is the status of this urgent fix ?
vrealloc() is broken with kasan atm.
On Wed, Nov 27, 2024 at 10:16 PM Andrii Nakryiko
<andrii.nakryiko@gmail.com> wrote:
>
> On Wed, Nov 27, 2024 at 4:58 PM Andrew Morton <akpm@linux-foundation.org> wrote:
> >
> > On Mon, 25 Nov 2024 16:52:06 -0800 Andrii Nakryiko <andrii@kernel.org> wrote:
> >
> > > When vrealloc() reuses already allocated vmap_area, we need to
> > > re-annotate poisoned and unpoisoned portions of underlying memory
> > > according to the new size.
> >
> > What are the consequences of this oversight?
> >
> > When fixing a flaw, please always remember to describe the visible
> > effects of that flaw.
> >
>
> See [0] for false KASAN splat. I should have left a link to that, sorry.
>
> [0] https://lore.kernel.org/bpf/67450f9b.050a0220.21d33d.0004.GAE@google.com/
>
> > > Note, hard-coding KASAN_VMALLOC_PROT_NORMAL might not be exactly
> > > correct, but KASAN flag logic is pretty involved and spread out
> > > throughout __vmalloc_node_range_noprof(), so I'm using the bare minimum
> > > flag here and leaving the rest to mm people to refactor this logic and
> > > reuse it here.
> > >
> > > Fixes: 3ddc2fefe6f3 ("mm: vmalloc: implement vrealloc()")
> >
> > Because a cc:stable might be appropriate here. But without knowing the
> > effects, it's hard to determine this.
>
> This is KASAN-related, so the effect is a KASAN mis-reporting issue
> where there is none.
>
> >
> > > --- a/mm/vmalloc.c
> > > +++ b/mm/vmalloc.c
> > > @@ -4093,7 +4093,8 @@ void *vrealloc_noprof(const void *p, size_t size, gfp_t flags)
> > > /* Zero out spare memory. */
> > > if (want_init_on_alloc(flags))
> > > memset((void *)p + size, 0, old_size - size);
> > > -
> > > + kasan_poison_vmalloc(p + size, old_size - size);
> > > + kasan_unpoison_vmalloc(p, size, KASAN_VMALLOC_PROT_NORMAL);
> > > return (void *)p;
> > > }
> > >
> >
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH mm/stable] mm: fix vrealloc()'s KASAN poisoning logic
2024-12-04 17:01 ` Alexei Starovoitov
@ 2024-12-04 21:50 ` Andrew Morton
2024-12-04 22:18 ` Alexei Starovoitov
0 siblings, 1 reply; 6+ messages in thread
From: Andrew Morton @ 2024-12-04 21:50 UTC (permalink / raw)
To: Alexei Starovoitov
Cc: Andrii Nakryiko, Andrii Nakryiko, linux-mm, Uladzislau Rezki,
Christoph Hellwig, Vlastimil Babka, dakr, Michal Hocko, LKML,
bpf, Alexei Starovoitov
On Wed, 4 Dec 2024 09:01:06 -0800 Alexei Starovoitov <alexei.starovoitov@gmail.com> wrote:
> Andrew,
>
> What is the status of this urgent fix ?
>
In mm-hotfixes for an upstream maerge later this week.
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH mm/stable] mm: fix vrealloc()'s KASAN poisoning logic
2024-12-04 21:50 ` Andrew Morton
@ 2024-12-04 22:18 ` Alexei Starovoitov
0 siblings, 0 replies; 6+ messages in thread
From: Alexei Starovoitov @ 2024-12-04 22:18 UTC (permalink / raw)
To: Andrew Morton
Cc: Andrii Nakryiko, Andrii Nakryiko, linux-mm, Uladzislau Rezki,
Christoph Hellwig, Vlastimil Babka, dakr, Michal Hocko, LKML,
bpf, Alexei Starovoitov
On Wed, Dec 4, 2024 at 1:50 PM Andrew Morton <akpm@linux-foundation.org> wrote:
>
> On Wed, 4 Dec 2024 09:01:06 -0800 Alexei Starovoitov <alexei.starovoitov@gmail.com> wrote:
>
> > Andrew,
> >
> > What is the status of this urgent fix ?
> >
>
> In mm-hotfixes for an upstream maerge later this week.
Awesome. Thanks!
^ permalink raw reply [flat|nested] 6+ messages in thread
end of thread, other threads:[~2024-12-04 22:19 UTC | newest]
Thread overview: 6+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2024-11-26 0:52 [PATCH mm/stable] mm: fix vrealloc()'s KASAN poisoning logic Andrii Nakryiko
2024-11-28 0:58 ` Andrew Morton
2024-11-28 6:15 ` Andrii Nakryiko
2024-12-04 17:01 ` Alexei Starovoitov
2024-12-04 21:50 ` Andrew Morton
2024-12-04 22:18 ` Alexei Starovoitov
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox