From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id 8ECDAC3DA61 for ; Wed, 24 Jul 2024 20:34:58 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id 2A4FC6B0099; Wed, 24 Jul 2024 16:34:58 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id 22D4E6B009A; Wed, 24 Jul 2024 16:34:58 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 0A7D46B009B; Wed, 24 Jul 2024 16:34:58 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0017.hostedemail.com [216.40.44.17]) by kanga.kvack.org (Postfix) with ESMTP id D76C16B0099 for ; Wed, 24 Jul 2024 16:34:57 -0400 (EDT) Received: from smtpin12.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay01.hostedemail.com (Postfix) with ESMTP id 695FA1C1E8D for ; Wed, 24 Jul 2024 20:34:57 +0000 (UTC) X-FDA: 82375800234.12.C43D473 Received: from mail-lj1-f173.google.com (mail-lj1-f173.google.com [209.85.208.173]) by imf01.hostedemail.com (Postfix) with ESMTP id 4BCEC40009 for ; Wed, 24 Jul 2024 20:34:55 +0000 (UTC) Authentication-Results: imf01.hostedemail.com; dkim=pass header.d=gmail.com header.s=20230601 header.b=jrc9lM9U; spf=pass (imf01.hostedemail.com: domain of urezki@gmail.com designates 209.85.208.173 as permitted sender) smtp.mailfrom=urezki@gmail.com; dmarc=pass (policy=none) header.from=gmail.com ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1721853271; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type:content-transfer-encoding: in-reply-to:in-reply-to:references:references:dkim-signature; bh=aL/MHX8ocQL08cfxr5CF34T2UZUbJ//sYdQZ9GO2OEw=; b=v8qp1SbuaGDU6gVK1iXaouvOb7a/t0RSOhiSGZrJ0+s6e9n53bXqKmIQmKue13yI8P5PS3 n4UocmEd7cGclmzw5zlR+fnxgTsjO038Kc2iS4JYck3vejsGnuv7hZChmpm8mQ+n6NleQj 17ppJePWPcBZn0xhcnUxKP4aMJ26Ezc= ARC-Authentication-Results: i=1; imf01.hostedemail.com; dkim=pass header.d=gmail.com header.s=20230601 header.b=jrc9lM9U; spf=pass (imf01.hostedemail.com: domain of urezki@gmail.com designates 209.85.208.173 as permitted sender) smtp.mailfrom=urezki@gmail.com; dmarc=pass (policy=none) header.from=gmail.com ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1721853271; a=rsa-sha256; cv=none; b=w5ikUyQedK1IiAvryh5xC78DE/WBivmj5U6zNbAFDtOh6u6wrZlbwsffr5BdDIQcVNxSBx BChMCk3Gq5Cg36wFeYl6WO8+GRkj8CWQJSLD4owATpG0n8a43pwuhcvvR6F6J5KcicIt5W g40jj0FGyzRaw5L6dJl0UL9FNibEClc= Received: by mail-lj1-f173.google.com with SMTP id 38308e7fff4ca-2ef2c56d9dcso2562761fa.2 for ; Wed, 24 Jul 2024 13:34:54 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1721853294; x=1722458094; darn=kvack.org; h=in-reply-to:content-disposition:mime-version:references:message-id :subject:cc:to:date:from:from:to:cc:subject:date:message-id:reply-to; bh=aL/MHX8ocQL08cfxr5CF34T2UZUbJ//sYdQZ9GO2OEw=; b=jrc9lM9UDwJjmjCbtILpsqzAM3s4SzX1UcwHTkvseQ8yBC0RvOjU5AbxY2BP9WwnHF Sv2SeEsfLOHKA9v+lbVRSDCl6BzsJZYmNG1PlFVje/DoEUU6korqt8xo+KmUBNJjqmcG dQ69osnyEL8uLD4jwn0+Qe0lf2F2eqWNFoARjq1FCG75ZjNpZY1PXG6KVkPNpjMxqQLW 2q/fljOFIfjJRQlQ/xj+u1lH2CfYah4aDd02QRRRVv6E/dqqA9/vG5F5NDHLNmuAx9lJ uawA9i/qvJtlU/GSgHWe8o7nsNcUdEOqXzxE6anaPKaNwlRqWuSVOrzKaKMpeeGRBteY 5Zgw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1721853294; x=1722458094; h=in-reply-to:content-disposition:mime-version:references:message-id :subject:cc:to:date:from:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=aL/MHX8ocQL08cfxr5CF34T2UZUbJ//sYdQZ9GO2OEw=; b=ltGF/BjNRPHRXxbboa7vra5N4Li+wiol+rD60n/wBBM9bJmpEnqTAOHz2wdsso7V80 qANAqar4uigqsXFyqA3QwL/2BDx/97IEP8S5zlcNl2QqKQczc6q2D3RvY2mvJ7gcWDkr EGhwOxPTkk/OpTm0vMdIqMp147Kv/l1fm1ICzgxf6vSRk06mv5a7c0ts5/IRSsf5ppFg 0gImQi8wn1By1qUgl2zbtbgwQurhqZN69XhRG6qL+zshg+I3Cy8kgVyVgLxN1PCNQV3G uZeyvSLiFkam9YGMmz/Wn/SA8kHErgh9/fo1I1YFB1VVQnGkD1nAcMuzsggzUlbDCwpJ pWzg== X-Forwarded-Encrypted: i=1; AJvYcCVgbnt/83VBc1R0twi+c7Ncb0S4DSpnKUPCl6K6WjMFs9cYJgSO91+MjSxJ+Es820Mk3vZuwlfGa75e3f8OTrICi1k= X-Gm-Message-State: AOJu0YzqsfAu2MVn2JQG984twcbTVkOwOjGt1tKdSn16UOOrmn5vgEx1 RK+brylJgHXxHQuM/v+cDeatJrjHx9onNhbFHmgq+Pmeh9WnSu6S X-Google-Smtp-Source: AGHT+IFG5lRYCwoSvnRY6wNKxXZH0lbrp+Tjw6qO7pTZqDNUY+OTWeybDV7POpqFx4DMPDMXL672yQ== X-Received: by 2002:a2e:95d7:0:b0:2ef:17f7:6e1d with SMTP id 38308e7fff4ca-2f039edeaddmr6439291fa.4.1721853293083; Wed, 24 Jul 2024 13:34:53 -0700 (PDT) Received: from pc638.lan (84-217-131-213.customers.ownit.se. [84.217.131.213]) by smtp.gmail.com with ESMTPSA id 38308e7fff4ca-2f03cf0e356sm105591fa.27.2024.07.24.13.34.52 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 24 Jul 2024 13:34:52 -0700 (PDT) From: Uladzislau Rezki X-Google-Original-From: Uladzislau Rezki Date: Wed, 24 Jul 2024 22:34:51 +0200 To: Adrian Huang Cc: Adrian Huang , ahuang12@lenovo.com, akpm@linux-foundation.org, hch@infradead.org, linux-kernel@vger.kernel.org, linux-mm@kvack.org, peterz@infradead.org, sunjw10@lenovo.com Subject: Re: [PATCH 1/1] mm/vmalloc: Add preempt point in purge_vmap_node() when enabling kasan Message-ID: References: <20240724124624.27673-1-ahuang12@lenovo.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: X-Rspamd-Server: rspam11 X-Rspamd-Queue-Id: 4BCEC40009 X-Stat-Signature: kqzpue7q553aedbe5645yfwkzmrsegrg X-Rspam-User: X-HE-Tag: 1721853295-361911 X-HE-Meta: U2FsdGVkX19sdFWvMtJzCFuC0egdhkw/kO0tAD+tkKp6X9rwcj0GvPR65DCf1aVvKnJ9+fDjf1XUJ+Gc/8RL9OhvVJoEtPm0YAIl1wFmDJdGKZquAiZ9UBkkAFtpxsf13tyU3FIUmYI0ZwrQeBxlrCZWVgniUu7LuGfkvIsKf4Qz+vsJj6phhufkXQv7k0Leq4Rm/s6Kn21r7VJocRmXQ3Dqq7zjlvdL05A4guGuOxnVqWTjhckJ7H/4so1dImeLfQ519uEjMVpxXAIo92KQnAGkrIXHmCrtQieACTN9XGIrfVA63+FM+v54iAwrtCRx2swjcI1ksj08PEFub1jAqKRw+cJJBUlOMPRbyOz6TdnplfcpCfbFcWqtEay61NJuCTQfA7SvmTUzhWk1ZwmtR+B9sHrVFns4PvluZg/6G6WtpU/0Kk1yB4AvO9jQgjenQ0NT/kr4uidrRkbnAyq2TZXlVooLosOFg5XdX7Y1JUanDT1hEbCgdpSAXcSxCgB3FEwBWsYji8EgB3VSiuJHKtXdpO0LBkf09ZzkbBoaLarFReEQNUk/FrjVyO3eeA6qjh6Xj5a66JGvS7GHpjO4KG62RUY7Mj4XyPj8JXKzJWXzH4/nzHwBd6eEsdU7/xzZMreyxY+8cI/6lITpjkydMN5SaXj50hvIgCZbElqnvelVtY0xcY+qUR8IzaSxShEQdyU0GRHradCS0tCNZPePRuPiNPGA9uHUtvIhcgdzHmFt/ovjwpInuXdJHrbLfRnrbTIVrqttdJPDKqdpV4aSd9IcAHWsJclQcLKQlFc91v4TE46TKKLXxKItD3T4jXnfm9iYwbfXmQt3jMU1t7hWlfdi5PbGNUivdv0LSgaFbRSbFBdgCq55pa/RWXyLdiiygrcU5g7ThvdnilIk/G9vLqzEAG1YlXMNygqJJMU8GMitEAcV4lFx9+daANfX5+5oYKv/ojhkz41Z25fZ0Qh F9LHNotK XlBl8ryvzNCR5Gr+NN/OErj3Gq02bcCTTxqVAxmq2j1BaX/7v2jJPWl5PzS/vPtMjcsnHMssE0eQ0vMoycwnVy82qiNtLW68mTFNZK32TB1YZ97rABNJff4MPe9dbnGBCIAA2xzsVTPl4v7n59FTHaqwDu58EokbWuq8zviJEQwbYnBZ1bJ0GqkhgWQeadKbMRFhh712p0xblpj3LlE4Id22pH++WThRUXmLupQGsEM193nWOfiQGuLgxEHzdr3iNB0k4gYEqNj1PdoBs603Ym2+QlB/7D0lodMJHBgqkuAsaBwBkYphusv2vnk7aC0/gM2ZOMDESzkYydcJvIA+W6Cs22bzOBXFsmV9ZCmhpt+Eggf4AhXErdMWp3rvznroiBsVnB8tbeVqE3sl+xHFjXUIsPg== X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: List-Subscribe: List-Unsubscribe: On Wed, Jul 24, 2024 at 09:27:46PM +0200, Uladzislau Rezki wrote: > On Wed, Jul 24, 2024 at 05:09:59PM +0200, Uladzislau Rezki wrote: > > On Wed, Jul 24, 2024 at 04:32:37PM +0200, Uladzislau Rezki wrote: > > > On Wed, Jul 24, 2024 at 08:46:24PM +0800, Adrian Huang wrote: > > > > > It works great and does not generate the soft-lock-up splat :) > > > > > See below some comments: > > > > > > > > Great. Thanks for the confirmation. > > > > > > > > > > > > > > > > >> + kasan_release_vmalloc(start, end, start, end, KASAN_VMALLOC_TLB_FLUSH); > > > > >> + > > > > >> > > > > > Do we need it here? We just did the TLB flush for en entire range in the > > > > > __purge_vmap_area_lazy(). So, it is two times invoked and looks odd to me. > > > > > > > > > > Am i missing something? > > > > > > > > 1. The TLB flush for the entire range in __purge_vmap_area_lazy() is for > > > > the vmalloc virtual address (VMALLOC_START->VMALLOC_END). > > > > > > > > 2. The TLB flush in purge_vmap_node() is for the KASAN shadow virtual address > > > > (the shadow offset 'CONFIG_KASAN_SHADOW_OFFSET' is defined in .config). > > > > > > > Correct. It deals with a shadow region! > > > > > > > > > > > BTW, I found my first patch has the potential risk. We need to flush TLB of > > > > the KASAN shadow virtual address firstly. Please see the following patch for > > > > detail. (I put the comment in the following patch). The following patch > > > > also works well on my 256-core machine. > > > > > > > I noticed that and it would be my second question :) > > > > > > > > > > > If you're ok with the patch, I'll submit it for upstream review. And, may I > > > > have your tag(s): tested-by/reviewed-by? (If possible, could you please have > > > > a test for the following patch). > > > > > > > I am OK. I will test and get back soon. > > > > > > > Thanks. > > > > > > > > --- > > > > diff --git a/include/linux/kasan.h b/include/linux/kasan.h > > > > index 70d6a8f6e25d..ddbf42a1a7b7 100644 > > > > --- a/include/linux/kasan.h > > > > +++ b/include/linux/kasan.h > > > > @@ -55,6 +55,9 @@ extern p4d_t kasan_early_shadow_p4d[MAX_PTRS_PER_P4D]; > > > > int kasan_populate_early_shadow(const void *shadow_start, > > > > const void *shadow_end); > > > > > > > > +#define KASAN_VMALLOC_PAGE_RANGE 0x1 /* Apply exsiting page range */ > > > > +#define KASAN_VMALLOC_TLB_FLUSH 0x2 /* TLB flush */ > > > > + > > > > #ifndef kasan_mem_to_shadow > > > > static inline void *kasan_mem_to_shadow(const void *addr) > > > > { > > > > @@ -511,7 +514,8 @@ void kasan_populate_early_vm_area_shadow(void *start, unsigned long size); > > > > int kasan_populate_vmalloc(unsigned long addr, unsigned long size); > > > > void kasan_release_vmalloc(unsigned long start, unsigned long end, > > > > unsigned long free_region_start, > > > > - unsigned long free_region_end); > > > > + unsigned long free_region_end, > > > > + unsigned long flags); > > > > > > > > #else /* CONFIG_KASAN_GENERIC || CONFIG_KASAN_SW_TAGS */ > > > > > > > > @@ -526,7 +530,8 @@ static inline int kasan_populate_vmalloc(unsigned long start, > > > > static inline void kasan_release_vmalloc(unsigned long start, > > > > unsigned long end, > > > > unsigned long free_region_start, > > > > - unsigned long free_region_end) { } > > > > + unsigned long free_region_end, > > > > + unsigned long flags) { } > > > > > > > > #endif /* CONFIG_KASAN_GENERIC || CONFIG_KASAN_SW_TAGS */ > > > > > > > > @@ -561,7 +566,8 @@ static inline int kasan_populate_vmalloc(unsigned long start, > > > > static inline void kasan_release_vmalloc(unsigned long start, > > > > unsigned long end, > > > > unsigned long free_region_start, > > > > - unsigned long free_region_end) { } > > > > + unsigned long free_region_end, > > > > + unsigned long flags) { } > > > > > > > > static inline void *kasan_unpoison_vmalloc(const void *start, > > > > unsigned long size, > > > > diff --git a/mm/kasan/shadow.c b/mm/kasan/shadow.c > > > > index d6210ca48dda..88d1c9dcb507 100644 > > > > --- a/mm/kasan/shadow.c > > > > +++ b/mm/kasan/shadow.c > > > > @@ -489,7 +489,8 @@ static int kasan_depopulate_vmalloc_pte(pte_t *ptep, unsigned long addr, > > > > */ > > > > void kasan_release_vmalloc(unsigned long start, unsigned long end, > > > > unsigned long free_region_start, > > > > - unsigned long free_region_end) > > > > + unsigned long free_region_end, > > > > + unsigned long flags) > > > > { > > > > void *shadow_start, *shadow_end; > > > > unsigned long region_start, region_end; > > > > @@ -522,12 +523,17 @@ void kasan_release_vmalloc(unsigned long start, unsigned long end, > > > > __memset(shadow_start, KASAN_SHADOW_INIT, shadow_end - shadow_start); > > > > return; > > > > } > > > > - apply_to_existing_page_range(&init_mm, > > > > + > > > > + > > > > + if (flags & KASAN_VMALLOC_PAGE_RANGE) > > > > + apply_to_existing_page_range(&init_mm, > > > > (unsigned long)shadow_start, > > > > size, kasan_depopulate_vmalloc_pte, > > > > NULL); > > > > - flush_tlb_kernel_range((unsigned long)shadow_start, > > > > - (unsigned long)shadow_end); > > > > + > > > > + if (flags & KASAN_VMALLOC_TLB_FLUSH) > > > > + flush_tlb_kernel_range((unsigned long)shadow_start, > > > > + (unsigned long)shadow_end); > > > > } > > > > } > > > > > > > > diff --git a/mm/vmalloc.c b/mm/vmalloc.c > > > > index e34ea860153f..12cdc92cdb83 100644 > > > > --- a/mm/vmalloc.c > > > > +++ b/mm/vmalloc.c > > > > @@ -2193,8 +2193,22 @@ static void purge_vmap_node(struct work_struct *work) > > > > struct vmap_area *va, *n_va; > > > > LIST_HEAD(local_list); > > remove the space. > > > > > > > > + unsigned long start; > > > > + unsigned long end; > > > > + > > > > vn->nr_purged = 0; > > > > > > > > + start = list_first_entry(&vn->purge_list, struct vmap_area, list)->va_start; > > no need to have an extra space. > > > > + > > > > + end = list_last_entry(&vn->purge_list, struct vmap_area, list)->va_end; > > > > + > > > > + /* > > > > + * Since node_pool_add_va() returns vmap_area(s) to its pool, the > > > > + * returned vmap_area(s) might be grabbed immediately via node_alloc() > > > > + * by other core. We need to flush TLB firstly. > > > > + */ > > > > + kasan_release_vmalloc(start, end, start, end, KASAN_VMALLOC_TLB_FLUSH); > > > > + > > > > list_for_each_entry_safe(va, n_va, &vn->purge_list, list) { > > > > unsigned long nr = (va->va_end - va->va_start) >> PAGE_SHIFT; > > > > unsigned long orig_start = va->va_start; > > > > @@ -2205,7 +2219,8 @@ static void purge_vmap_node(struct work_struct *work) > > > > > > > > if (is_vmalloc_or_module_addr((void *)orig_start)) > > > > kasan_release_vmalloc(orig_start, orig_end, > > > > - va->va_start, va->va_end); > > > > + va->va_start, va->va_end, > > > > + KASAN_VMALLOC_PAGE_RANGE); > > > > > orig_start and orig_end are unnecessary now. But it can be removed by > > an extra patch! > > > > > > > > > > atomic_long_sub(nr, &vmap_lazy_nr); > > > > vn->nr_purged++; > > > > @@ -4726,7 +4741,8 @@ struct vm_struct **pcpu_get_vm_areas(const unsigned long *offsets, > > > > &free_vmap_area_list); > > > > if (va) > > > > kasan_release_vmalloc(orig_start, orig_end, > > > > - va->va_start, va->va_end); > > > > + va->va_start, va->va_end, > > > > + KASAN_VMALLOC_PAGE_RANGE | KASAN_VMALLOC_TLB_FLUSH); > > > > vas[area] = NULL; > > > > } > > > > > > > > @@ -4776,7 +4792,8 @@ struct vm_struct **pcpu_get_vm_areas(const unsigned long *offsets, > > > > &free_vmap_area_list); > > > > if (va) > > > > kasan_release_vmalloc(orig_start, orig_end, > > > > - va->va_start, va->va_end); > > > > + va->va_start, va->va_end, > > > > + KASAN_VMALLOC_PAGE_RANGE | KASAN_VMALLOC_TLB_FLUSH); > > > > vas[area] = NULL; > > > > kfree(vms[area]); > > > > } > > Reviewed-by: Uladzislau Rezki (Sony) > > Tested-by: Uladzislau Rezki (Sony) > > > I get: BUG: KASAN: vmalloc-out-of-bounds in long_busy_list_alloc_test+0x195/0x1c0 [test_vmalloc] > > [15579.900340] ================================================================== > [15579.900412] BUG: KASAN: vmalloc-out-of-bounds in long_busy_list_alloc_test+0x195/0x1c0 [test_vmalloc] > [15579.900459] Write of size 1 at addr ffffc901c0578000 by task vmalloc_test/2/49374 > > [15579.900506] CPU: 199 PID: 49374 Comm: vmalloc_test/2 Kdump: loaded Not tainted 6.10.0-rc5-00019-g4236f0255ea8-dirty #3450 > [15579.900554] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.2-debian-1.16.2-1 04/01/2014 > [15579.900595] Call Trace: > [15579.900611] > [15579.900635] dump_stack_lvl+0x53/0x70 > [15579.900670] print_address_description.constprop.0+0x2c/0x3a0 > [15579.900701] ? long_busy_list_alloc_test+0x195/0x1c0 [test_vmalloc] > [15579.900732] print_report+0xb9/0x2b0 > [15579.900752] ? kasan_addr_to_slab+0xd/0xb0 > [15579.900776] ? long_busy_list_alloc_test+0x195/0x1c0 [test_vmalloc] > [15579.900806] kasan_report+0xd3/0x110 > [15579.900828] ? long_busy_list_alloc_test+0x195/0x1c0 [test_vmalloc] > [15579.900860] long_busy_list_alloc_test+0x195/0x1c0 [test_vmalloc] > [15579.900890] ? ktime_get+0xa1/0x170 > [15579.900910] ? __pfx_long_busy_list_alloc_test+0x10/0x10 [test_vmalloc] > [15579.900943] test_func+0x232/0x510 [test_vmalloc] > [15579.900970] ? __pfx_test_func+0x10/0x10 [test_vmalloc] > [15579.900998] ? __kthread_parkme+0x82/0x140 > [15579.901022] ? __pfx_test_func+0x10/0x10 [test_vmalloc] > [15579.901049] kthread+0x2a5/0x370 > [15579.901069] ? __pfx_kthread+0x10/0x10 > [15579.901091] ret_from_fork+0x34/0x70 > [15579.901113] ? __pfx_kthread+0x10/0x10 > [15579.901135] ret_from_fork_asm+0x1a/0x30 > [15579.901161] > > [15579.901189] The buggy address belongs to the virtual mapping at > [ffffc901c0578000, ffffc901c05dd000) created by: > long_busy_list_alloc_test+0x8e/0x1c0 [test_vmalloc] > > [15579.901281] The buggy address belongs to the physical page: > [15579.901309] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x50611a > [15579.901312] flags: 0x17ffffc0000000(node=0|zone=2|lastcpupid=0x1fffff) > [15579.901317] raw: 0017ffffc0000000 0000000000000000 dead000000000122 0000000000000000 > [15579.901320] raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000 > [15579.901321] page dumped because: kasan: bad access detected > > [15579.901335] Memory state around the buggy address: > [15579.901359] ffffc901c0577f00: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 > [15579.901391] ffffc901c0577f80: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 > [15579.901423] >ffffc901c0578000: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 > [15579.901455] ^ > [15579.901474] ffffc901c0578080: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 > [15579.901506] ffffc901c0578100: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 > [15579.901538] ================================================================== > [15579.902332] Disabling lock debugging due to kernel taint > > after applying this patch. Let me check tomorrow if it is a real BUG or > it is a side-effect of the patch. > You can trigger that BUG by running a vmalloc test-squite: sudo ./test_vmalloc.sh run_test_mask=7 nr_threads=15 Reworked a bit your patch to solve a false-positive above splat: diff --git a/include/linux/kasan.h b/include/linux/kasan.h index 70d6a8f6e25d..ddbf42a1a7b7 100644 --- a/include/linux/kasan.h +++ b/include/linux/kasan.h @@ -55,6 +55,9 @@ extern p4d_t kasan_early_shadow_p4d[MAX_PTRS_PER_P4D]; int kasan_populate_early_shadow(const void *shadow_start, const void *shadow_end); +#define KASAN_VMALLOC_PAGE_RANGE 0x1 /* Apply exsiting page range */ +#define KASAN_VMALLOC_TLB_FLUSH 0x2 /* TLB flush */ + #ifndef kasan_mem_to_shadow static inline void *kasan_mem_to_shadow(const void *addr) { @@ -511,7 +514,8 @@ void kasan_populate_early_vm_area_shadow(void *start, unsigned long size); int kasan_populate_vmalloc(unsigned long addr, unsigned long size); void kasan_release_vmalloc(unsigned long start, unsigned long end, unsigned long free_region_start, - unsigned long free_region_end); + unsigned long free_region_end, + unsigned long flags); #else /* CONFIG_KASAN_GENERIC || CONFIG_KASAN_SW_TAGS */ @@ -526,7 +530,8 @@ static inline int kasan_populate_vmalloc(unsigned long start, static inline void kasan_release_vmalloc(unsigned long start, unsigned long end, unsigned long free_region_start, - unsigned long free_region_end) { } + unsigned long free_region_end, + unsigned long flags) { } #endif /* CONFIG_KASAN_GENERIC || CONFIG_KASAN_SW_TAGS */ @@ -561,7 +566,8 @@ static inline int kasan_populate_vmalloc(unsigned long start, static inline void kasan_release_vmalloc(unsigned long start, unsigned long end, unsigned long free_region_start, - unsigned long free_region_end) { } + unsigned long free_region_end, + unsigned long flags) { } static inline void *kasan_unpoison_vmalloc(const void *start, unsigned long size, diff --git a/mm/kasan/shadow.c b/mm/kasan/shadow.c index d6210ca48dda..88d1c9dcb507 100644 --- a/mm/kasan/shadow.c +++ b/mm/kasan/shadow.c @@ -489,7 +489,8 @@ static int kasan_depopulate_vmalloc_pte(pte_t *ptep, unsigned long addr, */ void kasan_release_vmalloc(unsigned long start, unsigned long end, unsigned long free_region_start, - unsigned long free_region_end) + unsigned long free_region_end, + unsigned long flags) { void *shadow_start, *shadow_end; unsigned long region_start, region_end; @@ -522,12 +523,17 @@ void kasan_release_vmalloc(unsigned long start, unsigned long end, __memset(shadow_start, KASAN_SHADOW_INIT, shadow_end - shadow_start); return; } - apply_to_existing_page_range(&init_mm, + + + if (flags & KASAN_VMALLOC_PAGE_RANGE) + apply_to_existing_page_range(&init_mm, (unsigned long)shadow_start, size, kasan_depopulate_vmalloc_pte, NULL); - flush_tlb_kernel_range((unsigned long)shadow_start, - (unsigned long)shadow_end); + + if (flags & KASAN_VMALLOC_TLB_FLUSH) + flush_tlb_kernel_range((unsigned long)shadow_start, + (unsigned long)shadow_end); } } diff --git a/mm/vmalloc.c b/mm/vmalloc.c index 03b82fb8ecd3..ed5eb02de545 100644 --- a/mm/vmalloc.c +++ b/mm/vmalloc.c @@ -2186,6 +2186,25 @@ decay_va_pool_node(struct vmap_node *vn, bool full_decay) reclaim_list_global(&decay_list); } +static void +kasan_release_vmalloc_node(struct vmap_node *vn) +{ + struct vmap_area *va; + unsigned long start, end; + + start = list_first_entry(&vn->purge_list, struct vmap_area, list)->va_start; + end = list_last_entry(&vn->purge_list, struct vmap_area, list)->va_end; + + list_for_each_entry(va, &vn->purge_list, list) { + if (is_vmalloc_or_module_addr((void *) va->va_start)) + kasan_release_vmalloc(va->va_start, va->va_end, + va->va_start, va->va_end, + KASAN_VMALLOC_PAGE_RANGE); + } + + kasan_release_vmalloc(start, end, start, end, KASAN_VMALLOC_TLB_FLUSH); +} + static void purge_vmap_node(struct work_struct *work) { struct vmap_node *vn = container_of(work, @@ -2193,20 +2212,17 @@ static void purge_vmap_node(struct work_struct *work) struct vmap_area *va, *n_va; LIST_HEAD(local_list); + if (kasan_enabled()) + kasan_release_vmalloc_node(vn); + vn->nr_purged = 0; list_for_each_entry_safe(va, n_va, &vn->purge_list, list) { unsigned long nr = (va->va_end - va->va_start) >> PAGE_SHIFT; - unsigned long orig_start = va->va_start; - unsigned long orig_end = va->va_end; unsigned int vn_id = decode_vn_id(va->flags); list_del_init(&va->list); - if (is_vmalloc_or_module_addr((void *)orig_start)) - kasan_release_vmalloc(orig_start, orig_end, - va->va_start, va->va_end); - atomic_long_sub(nr, &vmap_lazy_nr); vn->nr_purged++; @@ -4717,7 +4733,8 @@ struct vm_struct **pcpu_get_vm_areas(const unsigned long *offsets, &free_vmap_area_list); if (va) kasan_release_vmalloc(orig_start, orig_end, - va->va_start, va->va_end); + va->va_start, va->va_end, + KASAN_VMALLOC_PAGE_RANGE | KASAN_VMALLOC_TLB_FLUSH); vas[area] = NULL; } @@ -4767,7 +4784,8 @@ struct vm_struct **pcpu_get_vm_areas(const unsigned long *offsets, &free_vmap_area_list); if (va) kasan_release_vmalloc(orig_start, orig_end, - va->va_start, va->va_end); + va->va_start, va->va_end, + KASAN_VMALLOC_PAGE_RANGE | KASAN_VMALLOC_TLB_FLUSH); vas[area] = NULL; kfree(vms[area]); } -- Uladzislau Rezki