From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id 75CA9C3ABC3 for ; Tue, 13 May 2025 15:21:14 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id D22336B0092; Tue, 13 May 2025 11:21:12 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id CCDCF6B00CB; Tue, 13 May 2025 11:21:12 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id AF99B6B00CC; Tue, 13 May 2025 11:21:12 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0010.hostedemail.com [216.40.44.10]) by kanga.kvack.org (Postfix) with ESMTP id 889D16B0092 for ; Tue, 13 May 2025 11:21:12 -0400 (EDT) Received: from smtpin06.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay07.hostedemail.com (Postfix) with ESMTP id D2763160E3B for ; Tue, 13 May 2025 15:21:12 +0000 (UTC) X-FDA: 83438247984.06.1B05A6A Received: from mx0a-001b2d01.pphosted.com (mx0a-001b2d01.pphosted.com [148.163.156.1]) by imf11.hostedemail.com (Postfix) with ESMTP id 490604000D for ; Tue, 13 May 2025 15:21:10 +0000 (UTC) Authentication-Results: imf11.hostedemail.com; dkim=pass header.d=ibm.com header.s=pp1 header.b="M/I+POFJ"; spf=pass (imf11.hostedemail.com: domain of agordeev@linux.ibm.com designates 148.163.156.1 as permitted sender) smtp.mailfrom=agordeev@linux.ibm.com; dmarc=pass (policy=none) header.from=ibm.com ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1747149670; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references:dkim-signature; bh=ILGFWDUIQKBMmAXxVAtqVwS5FzKw9CfdLlMdgo1kVVk=; b=eIZkOecx7BwqoK8CESLh33yypbZ4vF4DnWjEXvbhvmj5weO2eM1VDDzSLJ1mNmsLyUm40J 25USKi4VlkCRhXxJB6hQDiAXJhkdLpGqCifEwBE4hg6abIonv/kmo2JH1/css0sO7nPp6t G+8bPeApYDWTkEQeHg8TtotPFAzDRAk= ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1747149670; a=rsa-sha256; cv=none; b=KRPudmjXKSPIHDFjUo6Q54Fxo4tF+dbkSYCOOuMy8h+cHXnbhjcMSnNlqVve37GfoRJJzI tWRTXmxh2VrtHvPk82zOhR6/uDxUwKDHr7okadqkuiBaWSNShGMMHD+lGTa70r+addZKfO 4BaFBD08VP3mHrQTsA11MLt70Q7SCus= ARC-Authentication-Results: i=1; imf11.hostedemail.com; dkim=pass header.d=ibm.com header.s=pp1 header.b="M/I+POFJ"; spf=pass (imf11.hostedemail.com: domain of agordeev@linux.ibm.com designates 148.163.156.1 as permitted sender) smtp.mailfrom=agordeev@linux.ibm.com; dmarc=pass (policy=none) header.from=ibm.com Received: from pps.filterd (m0353729.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.2/8.18.1.2) with ESMTP id 54DFKC6p020981; Tue, 13 May 2025 15:21:07 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=pp1; bh=ILGFWDUIQKBMmAXxV AtqVwS5FzKw9CfdLlMdgo1kVVk=; b=M/I+POFJRCF5uR52Dig7RZfzFC8DzMxhB q+VI5hjXMLKEfj045XFt0+95RvaD8evg6ywQD7o7p6AqaGQy3R+3CBQ0q5y7zlB0 xSdrE/I768sKn200O4TnkoLrDpURUKGifwztCSPzyaQOw/RQR8rEIsY1Z/nL4mBR EQDLocjCSbq9rJHQjCHbmLFjs/wS/bgCvmtGOD7FSpo+ou29M5xyRtNTYITPxoxl RCl9PcMCN6ZCVj5HRGWRVlwpDeNr2E+nbN5MeX26NfFOOL3HhjuTNdtQzyv9h0xn cLcQPoHEkuMBki63vMEUuy4+j6DAGqoKr/pa+9ojWose5ruLOBcXA== Received: from pps.reinject (localhost [127.0.0.1]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 46m0pttmf1-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Tue, 13 May 2025 15:21:07 +0000 (GMT) Received: from m0353729.ppops.net (m0353729.ppops.net [127.0.0.1]) by pps.reinject (8.18.0.8/8.18.0.8) with ESMTP id 54DFL6WT016777; Tue, 13 May 2025 15:21:06 GMT Received: from ppma21.wdc07v.mail.ibm.com (5b.69.3da9.ip4.static.sl-reverse.com [169.61.105.91]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 46m0pttmev-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Tue, 13 May 2025 15:21:06 +0000 (GMT) Received: from pps.filterd (ppma21.wdc07v.mail.ibm.com [127.0.0.1]) by ppma21.wdc07v.mail.ibm.com (8.18.1.2/8.18.1.2) with ESMTP id 54DE9NfK025954; Tue, 13 May 2025 15:21:05 GMT Received: from smtprelay03.fra02v.mail.ibm.com ([9.218.2.224]) by ppma21.wdc07v.mail.ibm.com (PPS) with ESMTPS id 46jj4nupwp-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Tue, 13 May 2025 15:21:05 +0000 Received: from smtpav03.fra02v.mail.ibm.com (smtpav03.fra02v.mail.ibm.com [10.20.54.102]) by smtprelay03.fra02v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 54DFL3ah51118378 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Tue, 13 May 2025 15:21:03 GMT Received: from smtpav03.fra02v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 49BFD20078; Tue, 13 May 2025 15:21:03 +0000 (GMT) Received: from smtpav03.fra02v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 331ED20076; Tue, 13 May 2025 15:21:03 +0000 (GMT) Received: from tuxmaker.boeblingen.de.ibm.com (unknown [9.152.85.9]) by smtpav03.fra02v.mail.ibm.com (Postfix) with ESMTPS; Tue, 13 May 2025 15:21:03 +0000 (GMT) Received: by tuxmaker.boeblingen.de.ibm.com (Postfix, from userid 55669) id CF8B4E0EFD; Tue, 13 May 2025 17:21:02 +0200 (CEST) From: Alexander Gordeev To: Andrew Morton , Andrey Ryabinin , Daniel Axtens , Harry Yoo Cc: linux-kernel@vger.kernel.org, linux-mm@kvack.org, kasan-dev@googlegroups.com, linux-s390@vger.kernel.org, stable@vger.kernel.org Subject: [PATCH v8 1/1] kasan: Avoid sleepable page allocation from atomic context Date: Tue, 13 May 2025 17:21:02 +0200 Message-ID: X-Mailer: git-send-email 2.45.2 In-Reply-To: References: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-TM-AS-GCONF: 00 X-Proofpoint-GUID: UqQRHO515bbCYcDRPiSEVSyMWO-5F8iv X-Proofpoint-ORIG-GUID: oNfo_Ese7GAuY-_mIhjDeBHy8zqakdki X-Proofpoint-Spam-Details-Enc: AW1haW4tMjUwNTEzMDE0NCBTYWx0ZWRfX+CxMMO4F33wt 1aw858zPJzzSviQX7FZ/cdGQi8STMM2fsjQ3bkDxhxq5WsD4MaG22L1F6EpIex00WaXaZ1qp7GO stWV17yE5mhwHR8nva80BWHqyBXmYrzfgOroBV8l+IOKk0VSTxPxYLt+ONDFGN8GA9IWqxJZH8d hjliNkOOxhCWouI7CpjP2CcSneawNBEMXKsgPOqoOOdn1qe034UvNufW5g8AaFcyyA6v1PheEEf hFB6Nw5koUNx85QDLR4MCg2kKh1o3yo+KBuJcD/S20xIlfy0ub2B7z9Jw+KigsfyK5ul0wvoJlJ 8F9SHwwC0D9Js75eKKzEWTeYKBLvILAP5NKv2Pa+9/6RjZk0JUbjJ68Ouy1Tp86hRCW99SySNyh munKWfSBngjYFfNLq/dkbxqK3wBdJQELhILKzUIQ9onKs+CHKKPLtKZ3G44kQWDPvIrkNaCg X-Authority-Analysis: v=2.4 cv=Bv+dwZX5 c=1 sm=1 tr=0 ts=68236363 cx=c_pps a=GFwsV6G8L6GxiO2Y/PsHdQ==:117 a=GFwsV6G8L6GxiO2Y/PsHdQ==:17 a=dt9VzEwgFbYA:10 a=pGLkceISAAAA:8 a=VwQbUJbxAAAA:8 a=yPCof4ZbAAAA:8 a=VnNF1IyMAAAA:8 a=JPUNfvWgwyJmovPnq6kA:9 X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1099,Hydra:6.0.736,FMLib:17.12.80.40 definitions=2025-05-13_03,2025-05-09_01,2025-02-21_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 priorityscore=1501 phishscore=0 malwarescore=0 suspectscore=0 mlxlogscore=843 lowpriorityscore=0 bulkscore=0 spamscore=0 mlxscore=0 adultscore=0 clxscore=1015 impostorscore=0 classifier=spam authscore=0 authtc=n/a authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.19.0-2504070000 definitions=main-2505130144 X-Rspamd-Server: rspam08 X-Rspamd-Queue-Id: 490604000D X-Stat-Signature: 89x3xiutfkrtu3tnkhpfxaztbrayz53i X-Rspam-User: X-HE-Tag: 1747149670-110193 X-HE-Meta: U2FsdGVkX1/OQ4paYDksHMUmCFxLNoZ8j2rqOEAA91xgvvptDynxTpO7napIc8OgN8p0PldtRoLxahdXe5p3I8XWC3A63ZXiwvkrpMArGQd01Qp987H0wNOEP9787aorebKuG8LWFEGzQGptH6aTXckrnBWJk5ZQL9qKjHM/ocmJSwKnz6xgdWg6OANujZKQPalYlnjIOq84E2ghbkS5STuHEof4wKlsPxV0aOnUh2E6b5Y2fhQhH9coZ++INIexPDsOuv79ml1hJaXxK2ZaxiCZyQqzzGH4Z0YjdihaDrA0foiZe4GWvvAVXinMiJIads6NVMLnZHDmu1tLufyBe4ulg/OtMJpRcT1Bez4Jhf5etCWFR0C7bRhN1DqnIfa4n8stCO9P5aio1nQDDS/z+O6s/GOmGc3N5hm65vUtqJ9jLjsYQ8jY7ABtBcOKmxPBuMswUU/VWtdtFBZlNRZ0GxIY5C/DHey/7RJF+pBZZfR8MNfOOjkWm6ZDU/zuXtTRpjstMRsQQx8F+5PMW2Gs75+n9+dOWsy/bh41qTDzBhyAxDJ7tDijX/Csxp7fz0h4uKwL7WRNMWJ2mNva6s4Zlfda98lEz5IRDXVTpWmh7wm7bAL2DZ8n17QVoChNoEfd3U/na2yIEX3FL1eRGMEeW7UU4Qw6UxIasF2rM7ZfVQ3z7PzdWz4uNdPo6hBvTddGjTbgAdjF1gvVTJ4u1jC0Ebe/sIihktTYSf9fkGWClyXfsy+0helcXOp6D6ttVDEDZnlscPfCQzA+JKV+S0TBAtQJ4ZTkCHDOLIYeo5VvU6gkDhZ2uOkB5XGEcoTkeEEI/iSlzb6nx6v1NgVJz49HGpUvClmWE4T4iMETD5plCcQqb4h4QGnXWDCKEIrSBzZumr1oqMv4YoUciDvm8wcVvTOrrqASmwEb5gq+6K4lH2kiwrPsdvzTBsWJmGowOiOL2eq6QsNU4bLcD7GB12W rvxOSEwD WwSCBvwUZHIWkYV7laBMOqZyuZgWbMsadHD7OojMLbElXg6mZzrFxIlwAB9LkPgXWdGhjFI0UL2Tg/h6Kk9z7PpqkF67JxibRhMt0DxGf9vKudsKTZkiUlx1NQ9SbWeOgdkZbspuL84knzfEuDU/iBvOSDM6OgBky86lY1dGpUhkfGrcBYn8bljb09UGwWNIREDYKK5/UOgoBjWjn+t1iCb4c+RR+rCFH2S7Nwpr3uYZaG5RvpoU6hiirfYdakctcGJ8yZDsJZe6nNIs8c3egXSBRaXC14eJy995kBf9gmrQaDWx9TKFR4nOJNX/4SsjdFvRWnWFsB354GhLTFbxtUpaymQ== X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: List-Subscribe: List-Unsubscribe: apply_to_pte_range() enters the lazy MMU mode and then invokes kasan_populate_vmalloc_pte() callback on each page table walk iteration. However, the callback can go into sleep when trying to allocate a single page, e.g. if an architecutre disables preemption on lazy MMU mode enter. On s390 if make arch_enter_lazy_mmu_mode() -> preempt_enable() and arch_leave_lazy_mmu_mode() -> preempt_disable(), such crash occurs: [ 0.663336] BUG: sleeping function called from invalid context at ./include/linux/sched/mm.h:321 [ 0.663348] in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 2, name: kthreadd [ 0.663358] preempt_count: 1, expected: 0 [ 0.663366] RCU nest depth: 0, expected: 0 [ 0.663375] no locks held by kthreadd/2. [ 0.663383] Preemption disabled at: [ 0.663386] [<0002f3284cbb4eda>] apply_to_pte_range+0xfa/0x4a0 [ 0.663405] CPU: 0 UID: 0 PID: 2 Comm: kthreadd Not tainted 6.15.0-rc5-gcc-kasan-00043-gd76bb1ebb558-dirty #162 PREEMPT [ 0.663408] Hardware name: IBM 3931 A01 701 (KVM/Linux) [ 0.663409] Call Trace: [ 0.663410] [<0002f3284c385f58>] dump_stack_lvl+0xe8/0x140 [ 0.663413] [<0002f3284c507b9e>] __might_resched+0x66e/0x700 [ 0.663415] [<0002f3284cc4f6c0>] __alloc_frozen_pages_noprof+0x370/0x4b0 [ 0.663419] [<0002f3284ccc73c0>] alloc_pages_mpol+0x1a0/0x4a0 [ 0.663421] [<0002f3284ccc8518>] alloc_frozen_pages_noprof+0x88/0xc0 [ 0.663424] [<0002f3284ccc8572>] alloc_pages_noprof+0x22/0x120 [ 0.663427] [<0002f3284cc341ac>] get_free_pages_noprof+0x2c/0xc0 [ 0.663429] [<0002f3284cceba70>] kasan_populate_vmalloc_pte+0x50/0x120 [ 0.663433] [<0002f3284cbb4ef8>] apply_to_pte_range+0x118/0x4a0 [ 0.663435] [<0002f3284cbc7c14>] apply_to_pmd_range+0x194/0x3e0 [ 0.663437] [<0002f3284cbc99be>] __apply_to_page_range+0x2fe/0x7a0 [ 0.663440] [<0002f3284cbc9e88>] apply_to_page_range+0x28/0x40 [ 0.663442] [<0002f3284ccebf12>] kasan_populate_vmalloc+0x82/0xa0 [ 0.663445] [<0002f3284cc1578c>] alloc_vmap_area+0x34c/0xc10 [ 0.663448] [<0002f3284cc1c2a6>] __get_vm_area_node+0x186/0x2a0 [ 0.663451] [<0002f3284cc1e696>] __vmalloc_node_range_noprof+0x116/0x310 [ 0.663454] [<0002f3284cc1d950>] __vmalloc_node_noprof+0xd0/0x110 [ 0.663457] [<0002f3284c454b88>] alloc_thread_stack_node+0xf8/0x330 [ 0.663460] [<0002f3284c458d56>] dup_task_struct+0x66/0x4d0 [ 0.663463] [<0002f3284c45be90>] copy_process+0x280/0x4b90 [ 0.663465] [<0002f3284c460940>] kernel_clone+0xd0/0x4b0 [ 0.663467] [<0002f3284c46115e>] kernel_thread+0xbe/0xe0 [ 0.663469] [<0002f3284c4e440e>] kthreadd+0x50e/0x7f0 [ 0.663472] [<0002f3284c38c04a>] __ret_from_fork+0x8a/0xf0 [ 0.663475] [<0002f3284ed57ff2>] ret_from_fork+0xa/0x38 Instead of allocating single pages per-PTE, bulk-allocate the shadow memory prior to applying kasan_populate_vmalloc_pte() callback on a page range. Suggested-by: Andrey Ryabinin Cc: stable@vger.kernel.org Fixes: 3c5c3cfb9ef4 ("kasan: support backing vmalloc space with real shadow memory") Reviewed-by: Harry Yoo Signed-off-by: Alexander Gordeev --- mm/kasan/shadow.c | 77 ++++++++++++++++++++++++++++++++++++++--------- 1 file changed, 63 insertions(+), 14 deletions(-) diff --git a/mm/kasan/shadow.c b/mm/kasan/shadow.c index 88d1c9dcb507..8212a7007b02 100644 --- a/mm/kasan/shadow.c +++ b/mm/kasan/shadow.c @@ -292,33 +292,84 @@ void __init __weak kasan_populate_early_vm_area_shadow(void *start, { } +struct vmalloc_populate_data { + unsigned long start; + struct page **pages; +}; + static int kasan_populate_vmalloc_pte(pte_t *ptep, unsigned long addr, - void *unused) + void *_data) { - unsigned long page; + struct vmalloc_populate_data *data = _data; + struct page *page; pte_t pte; + int index; if (likely(!pte_none(ptep_get(ptep)))) return 0; - page = __get_free_page(GFP_KERNEL); - if (!page) - return -ENOMEM; - - __memset((void *)page, KASAN_VMALLOC_INVALID, PAGE_SIZE); - pte = pfn_pte(PFN_DOWN(__pa(page)), PAGE_KERNEL); + index = PFN_DOWN(addr - data->start); + page = data->pages[index]; + __memset(page_to_virt(page), KASAN_VMALLOC_INVALID, PAGE_SIZE); + pte = pfn_pte(page_to_pfn(page), PAGE_KERNEL); spin_lock(&init_mm.page_table_lock); if (likely(pte_none(ptep_get(ptep)))) { set_pte_at(&init_mm, addr, ptep, pte); - page = 0; + data->pages[index] = NULL; } spin_unlock(&init_mm.page_table_lock); - if (page) - free_page(page); + return 0; } +static inline void free_pages_bulk(struct page **pages, int nr_pages) +{ + int i; + + for (i = 0; i < nr_pages; i++) { + if (pages[i]) { + __free_pages(pages[i], 0); + pages[i] = NULL; + } + } +} + +static int __kasan_populate_vmalloc(unsigned long start, unsigned long end) +{ + unsigned long nr_populated, nr_pages, nr_total = PFN_UP(end - start); + struct vmalloc_populate_data data; + int ret = 0; + + data.pages = (struct page **)__get_free_page(GFP_KERNEL | __GFP_ZERO); + if (!data.pages) + return -ENOMEM; + + while (nr_total) { + nr_pages = min(nr_total, PAGE_SIZE / sizeof(data.pages[0])); + nr_populated = alloc_pages_bulk(GFP_KERNEL, nr_pages, data.pages); + if (nr_populated != nr_pages) { + free_pages_bulk(data.pages, nr_populated); + ret = -ENOMEM; + break; + } + + data.start = start; + ret = apply_to_page_range(&init_mm, start, nr_pages * PAGE_SIZE, + kasan_populate_vmalloc_pte, &data); + free_pages_bulk(data.pages, nr_pages); + if (ret) + break; + + start += nr_pages * PAGE_SIZE; + nr_total -= nr_pages; + } + + free_page((unsigned long)data.pages); + + return ret; +} + int kasan_populate_vmalloc(unsigned long addr, unsigned long size) { unsigned long shadow_start, shadow_end; @@ -348,9 +399,7 @@ int kasan_populate_vmalloc(unsigned long addr, unsigned long size) shadow_start = PAGE_ALIGN_DOWN(shadow_start); shadow_end = PAGE_ALIGN(shadow_end); - ret = apply_to_page_range(&init_mm, shadow_start, - shadow_end - shadow_start, - kasan_populate_vmalloc_pte, NULL); + ret = __kasan_populate_vmalloc(shadow_start, shadow_end); if (ret) return ret; -- 2.45.2