| Message ID | 20220620222032.3839547-7-paulmck@kernel.org (mailing list archive) |
|---|---|
| State | Accepted |
| Commit | 3872e0a470ffd83e4549181c4611c644b85a581d |
| Headers | show |
| Series | Miscellaneous fixes for v5.20 | expand |
On 6/21/2022 3:50 AM, Paul E. McKenney wrote: > From: Johannes Berg <johannes.berg@intel.com> > > When running KASAN with Tiny RCU (e.g. under ARCH=um, where > a working KASAN patch is now available), we don't get any > information on the original kfree_rcu() (or similar) caller > when a problem is reported, as Tiny RCU doesn't record this. > > Add the recording, which required pulling kvfree_call_rcu() > out of line for the KASAN case since the recording function > (kasan_record_aux_stack_noalloc) is neither exported, nor > can we include kasan.h into rcutiny.h. > > without KASAN, the patch has no size impact (ARCH=um kernel): > text data bss dec hex filename > 6151515 4423154 33148520 43723189 29b29b5 linux > 6151515 4423154 33148520 43723189 29b29b5 linux + patch > > with KASAN, the impact on my build was minimal: > text data bss dec hex filename > 13915539 7388050 33282304 54585893 340ea25 linux > 13911266 7392114 33282304 54585684 340e954 linux + patch > -4273 +4064 +-0 -209 > > Acked-by: Dmitry Vyukov <dvyukov@google.com> > Signed-off-by: Johannes Berg <johannes.berg@intel.com> > Signed-off-by: Paul E. McKenney <paulmck@kernel.org> > --- > include/linux/rcutiny.h | 11 ++++++++++- > kernel/rcu/tiny.c | 14 ++++++++++++++ > 2 files changed, 24 insertions(+), 1 deletion(-) > > diff --git a/include/linux/rcutiny.h b/include/linux/rcutiny.h > index 5fed476f977f6..d84e13f2c3848 100644 > --- a/include/linux/rcutiny.h > +++ b/include/linux/rcutiny.h > @@ -38,7 +38,7 @@ static inline void synchronize_rcu_expedited(void) > */ > extern void kvfree(const void *addr); > > -static inline void kvfree_call_rcu(struct rcu_head *head, rcu_callback_t func) > +static inline void __kvfree_call_rcu(struct rcu_head *head, rcu_callback_t func) > { > if (head) { > call_rcu(head, func); > @@ -51,6 +51,15 @@ static inline void kvfree_call_rcu(struct rcu_head *head, rcu_callback_t func) > kvfree((void *) func); > } > > +#ifdef CONFIG_KASAN_GENERIC > +void kvfree_call_rcu(struct rcu_head *head, rcu_callback_t func); > +#else > +static inline void kvfree_call_rcu(struct rcu_head *head, rcu_callback_t func) > +{ > + __kvfree_call_rcu(head, func); > +} > +#endif > + > void rcu_qs(void); > > static inline void rcu_softirq_qs(void) > diff --git a/kernel/rcu/tiny.c b/kernel/rcu/tiny.c > index 340b3f8b090d4..58ff3721d975c 100644 > --- a/kernel/rcu/tiny.c > +++ b/kernel/rcu/tiny.c > @@ -217,6 +217,20 @@ bool poll_state_synchronize_rcu(unsigned long oldstate) > } > EXPORT_SYMBOL_GPL(poll_state_synchronize_rcu); > > +#ifdef CONFIG_KASAN_GENERIC > +void kvfree_call_rcu(struct rcu_head *head, rcu_callback_t func) > +{ > + if (head) { > + void *ptr = (void *) head - (unsigned long) func; > + > + kasan_record_aux_stack_noalloc(ptr); > + } For the !head case; similar to Tree RCU's kvfree_call_rcu() implementation, we do not need to record 'ptr' (which will be 'func')? Thanks Neeraj > + > + __kvfree_call_rcu(head, func); > +} > +EXPORT_SYMBOL_GPL(kvfree_call_rcu); > +#endif > + > void __init rcu_init(void) > { > open_softirq(RCU_SOFTIRQ, rcu_process_callbacks);
On Tue, Jun 21, 2022 at 12:01:29PM +0530, Neeraj Upadhyay wrote: > > > On 6/21/2022 3:50 AM, Paul E. McKenney wrote: > > From: Johannes Berg <johannes.berg@intel.com> > > > > When running KASAN with Tiny RCU (e.g. under ARCH=um, where > > a working KASAN patch is now available), we don't get any > > information on the original kfree_rcu() (or similar) caller > > when a problem is reported, as Tiny RCU doesn't record this. > > > > Add the recording, which required pulling kvfree_call_rcu() > > out of line for the KASAN case since the recording function > > (kasan_record_aux_stack_noalloc) is neither exported, nor > > can we include kasan.h into rcutiny.h. > > > > without KASAN, the patch has no size impact (ARCH=um kernel): > > text data bss dec hex filename > > 6151515 4423154 33148520 43723189 29b29b5 linux > > 6151515 4423154 33148520 43723189 29b29b5 linux + patch > > > > with KASAN, the impact on my build was minimal: > > text data bss dec hex filename > > 13915539 7388050 33282304 54585893 340ea25 linux > > 13911266 7392114 33282304 54585684 340e954 linux + patch > > -4273 +4064 +-0 -209 > > > > Acked-by: Dmitry Vyukov <dvyukov@google.com> > > Signed-off-by: Johannes Berg <johannes.berg@intel.com> > > Signed-off-by: Paul E. McKenney <paulmck@kernel.org> > > --- > > include/linux/rcutiny.h | 11 ++++++++++- > > kernel/rcu/tiny.c | 14 ++++++++++++++ > > 2 files changed, 24 insertions(+), 1 deletion(-) > > > > diff --git a/include/linux/rcutiny.h b/include/linux/rcutiny.h > > index 5fed476f977f6..d84e13f2c3848 100644 > > --- a/include/linux/rcutiny.h > > +++ b/include/linux/rcutiny.h > > @@ -38,7 +38,7 @@ static inline void synchronize_rcu_expedited(void) > > */ > > extern void kvfree(const void *addr); > > -static inline void kvfree_call_rcu(struct rcu_head *head, rcu_callback_t func) > > +static inline void __kvfree_call_rcu(struct rcu_head *head, rcu_callback_t func) > > { > > if (head) { > > call_rcu(head, func); > > @@ -51,6 +51,15 @@ static inline void kvfree_call_rcu(struct rcu_head *head, rcu_callback_t func) > > kvfree((void *) func); > > } > > +#ifdef CONFIG_KASAN_GENERIC > > +void kvfree_call_rcu(struct rcu_head *head, rcu_callback_t func); > > +#else > > +static inline void kvfree_call_rcu(struct rcu_head *head, rcu_callback_t func) > > +{ > > + __kvfree_call_rcu(head, func); > > +} > > +#endif > > + > > void rcu_qs(void); > > static inline void rcu_softirq_qs(void) > > diff --git a/kernel/rcu/tiny.c b/kernel/rcu/tiny.c > > index 340b3f8b090d4..58ff3721d975c 100644 > > --- a/kernel/rcu/tiny.c > > +++ b/kernel/rcu/tiny.c > > @@ -217,6 +217,20 @@ bool poll_state_synchronize_rcu(unsigned long oldstate) > > } > > EXPORT_SYMBOL_GPL(poll_state_synchronize_rcu); > > +#ifdef CONFIG_KASAN_GENERIC > > +void kvfree_call_rcu(struct rcu_head *head, rcu_callback_t func) > > +{ > > + if (head) { > > + void *ptr = (void *) head - (unsigned long) func; > > + > > + kasan_record_aux_stack_noalloc(ptr); > > + } > > For the !head case; similar to Tree RCU's kvfree_call_rcu() implementation, > we do not need to record 'ptr' (which will be 'func')? My understanding is that we do not need to record in that case because __kvfree_call_rcu() will simply invoke the almost-zero-cost synchronize_rcu() and then invoke kfree(). Johannes, Dmitry, Marco, anything that I am missing? Thanx, Paul > Thanks > Neeraj > > > + > > + __kvfree_call_rcu(head, func); > > +} > > +EXPORT_SYMBOL_GPL(kvfree_call_rcu); > > +#endif > > + > > void __init rcu_init(void) > > { > > open_softirq(RCU_SOFTIRQ, rcu_process_callbacks);
On Tue, 21 Jun 2022 at 21:31, Paul E. McKenney <paulmck@kernel.org> wrote: > > On Tue, Jun 21, 2022 at 12:01:29PM +0530, Neeraj Upadhyay wrote: > > > > > > On 6/21/2022 3:50 AM, Paul E. McKenney wrote: > > > From: Johannes Berg <johannes.berg@intel.com> > > > > > > When running KASAN with Tiny RCU (e.g. under ARCH=um, where > > > a working KASAN patch is now available), we don't get any > > > information on the original kfree_rcu() (or similar) caller > > > when a problem is reported, as Tiny RCU doesn't record this. > > > > > > Add the recording, which required pulling kvfree_call_rcu() > > > out of line for the KASAN case since the recording function > > > (kasan_record_aux_stack_noalloc) is neither exported, nor > > > can we include kasan.h into rcutiny.h. > > > > > > without KASAN, the patch has no size impact (ARCH=um kernel): > > > text data bss dec hex filename > > > 6151515 4423154 33148520 43723189 29b29b5 linux > > > 6151515 4423154 33148520 43723189 29b29b5 linux + patch > > > > > > with KASAN, the impact on my build was minimal: > > > text data bss dec hex filename > > > 13915539 7388050 33282304 54585893 340ea25 linux > > > 13911266 7392114 33282304 54585684 340e954 linux + patch > > > -4273 +4064 +-0 -209 > > > > > > Acked-by: Dmitry Vyukov <dvyukov@google.com> > > > Signed-off-by: Johannes Berg <johannes.berg@intel.com> > > > Signed-off-by: Paul E. McKenney <paulmck@kernel.org> > > > --- > > > include/linux/rcutiny.h | 11 ++++++++++- > > > kernel/rcu/tiny.c | 14 ++++++++++++++ > > > 2 files changed, 24 insertions(+), 1 deletion(-) > > > > > > diff --git a/include/linux/rcutiny.h b/include/linux/rcutiny.h > > > index 5fed476f977f6..d84e13f2c3848 100644 > > > --- a/include/linux/rcutiny.h > > > +++ b/include/linux/rcutiny.h > > > @@ -38,7 +38,7 @@ static inline void synchronize_rcu_expedited(void) > > > */ > > > extern void kvfree(const void *addr); > > > -static inline void kvfree_call_rcu(struct rcu_head *head, rcu_callback_t func) > > > +static inline void __kvfree_call_rcu(struct rcu_head *head, rcu_callback_t func) > > > { > > > if (head) { > > > call_rcu(head, func); > > > @@ -51,6 +51,15 @@ static inline void kvfree_call_rcu(struct rcu_head *head, rcu_callback_t func) > > > kvfree((void *) func); > > > } > > > +#ifdef CONFIG_KASAN_GENERIC > > > +void kvfree_call_rcu(struct rcu_head *head, rcu_callback_t func); > > > +#else > > > +static inline void kvfree_call_rcu(struct rcu_head *head, rcu_callback_t func) > > > +{ > > > + __kvfree_call_rcu(head, func); > > > +} > > > +#endif > > > + > > > void rcu_qs(void); > > > static inline void rcu_softirq_qs(void) > > > diff --git a/kernel/rcu/tiny.c b/kernel/rcu/tiny.c > > > index 340b3f8b090d4..58ff3721d975c 100644 > > > --- a/kernel/rcu/tiny.c > > > +++ b/kernel/rcu/tiny.c > > > @@ -217,6 +217,20 @@ bool poll_state_synchronize_rcu(unsigned long oldstate) > > > } > > > EXPORT_SYMBOL_GPL(poll_state_synchronize_rcu); > > > +#ifdef CONFIG_KASAN_GENERIC > > > +void kvfree_call_rcu(struct rcu_head *head, rcu_callback_t func) > > > +{ > > > + if (head) { > > > + void *ptr = (void *) head - (unsigned long) func; > > > + > > > + kasan_record_aux_stack_noalloc(ptr); > > > + } > > > > For the !head case; similar to Tree RCU's kvfree_call_rcu() implementation, > > we do not need to record 'ptr' (which will be 'func')? > > My understanding is that we do not need to record in that case > because __kvfree_call_rcu() will simply invoke the almost-zero-cost > synchronize_rcu() and then invoke kfree(). > > Johannes, Dmitry, Marco, anything that I am missing? As-is looks sensible - doing kasan_record_aux_stack_noalloc() only makes sense if the actual kfree() is not done with a callstack that will point at the kvfree_call_rcu() caller. Otherwise we're doing redundant work and just polluting the aux stack storage slots. So in the case where kvfree_call_rcu() does synchronize_rcu() and kfree() the kvfree_call_rcu() caller is in the callstack, and would be shown on use-after-free bugs. Thanks, -- Marco
On Tue, Jun 21, 2022 at 11:14:04PM +0200, Marco Elver wrote: > On Tue, 21 Jun 2022 at 21:31, Paul E. McKenney <paulmck@kernel.org> wrote: > > > > On Tue, Jun 21, 2022 at 12:01:29PM +0530, Neeraj Upadhyay wrote: > > > > > > > > > On 6/21/2022 3:50 AM, Paul E. McKenney wrote: > > > > From: Johannes Berg <johannes.berg@intel.com> > > > > > > > > When running KASAN with Tiny RCU (e.g. under ARCH=um, where > > > > a working KASAN patch is now available), we don't get any > > > > information on the original kfree_rcu() (or similar) caller > > > > when a problem is reported, as Tiny RCU doesn't record this. > > > > > > > > Add the recording, which required pulling kvfree_call_rcu() > > > > out of line for the KASAN case since the recording function > > > > (kasan_record_aux_stack_noalloc) is neither exported, nor > > > > can we include kasan.h into rcutiny.h. > > > > > > > > without KASAN, the patch has no size impact (ARCH=um kernel): > > > > text data bss dec hex filename > > > > 6151515 4423154 33148520 43723189 29b29b5 linux > > > > 6151515 4423154 33148520 43723189 29b29b5 linux + patch > > > > > > > > with KASAN, the impact on my build was minimal: > > > > text data bss dec hex filename > > > > 13915539 7388050 33282304 54585893 340ea25 linux > > > > 13911266 7392114 33282304 54585684 340e954 linux + patch > > > > -4273 +4064 +-0 -209 > > > > > > > > Acked-by: Dmitry Vyukov <dvyukov@google.com> > > > > Signed-off-by: Johannes Berg <johannes.berg@intel.com> > > > > Signed-off-by: Paul E. McKenney <paulmck@kernel.org> > > > > --- > > > > include/linux/rcutiny.h | 11 ++++++++++- > > > > kernel/rcu/tiny.c | 14 ++++++++++++++ > > > > 2 files changed, 24 insertions(+), 1 deletion(-) > > > > > > > > diff --git a/include/linux/rcutiny.h b/include/linux/rcutiny.h > > > > index 5fed476f977f6..d84e13f2c3848 100644 > > > > --- a/include/linux/rcutiny.h > > > > +++ b/include/linux/rcutiny.h > > > > @@ -38,7 +38,7 @@ static inline void synchronize_rcu_expedited(void) > > > > */ > > > > extern void kvfree(const void *addr); > > > > -static inline void kvfree_call_rcu(struct rcu_head *head, rcu_callback_t func) > > > > +static inline void __kvfree_call_rcu(struct rcu_head *head, rcu_callback_t func) > > > > { > > > > if (head) { > > > > call_rcu(head, func); > > > > @@ -51,6 +51,15 @@ static inline void kvfree_call_rcu(struct rcu_head *head, rcu_callback_t func) > > > > kvfree((void *) func); > > > > } > > > > +#ifdef CONFIG_KASAN_GENERIC > > > > +void kvfree_call_rcu(struct rcu_head *head, rcu_callback_t func); > > > > +#else > > > > +static inline void kvfree_call_rcu(struct rcu_head *head, rcu_callback_t func) > > > > +{ > > > > + __kvfree_call_rcu(head, func); > > > > +} > > > > +#endif > > > > + > > > > void rcu_qs(void); > > > > static inline void rcu_softirq_qs(void) > > > > diff --git a/kernel/rcu/tiny.c b/kernel/rcu/tiny.c > > > > index 340b3f8b090d4..58ff3721d975c 100644 > > > > --- a/kernel/rcu/tiny.c > > > > +++ b/kernel/rcu/tiny.c > > > > @@ -217,6 +217,20 @@ bool poll_state_synchronize_rcu(unsigned long oldstate) > > > > } > > > > EXPORT_SYMBOL_GPL(poll_state_synchronize_rcu); > > > > +#ifdef CONFIG_KASAN_GENERIC > > > > +void kvfree_call_rcu(struct rcu_head *head, rcu_callback_t func) > > > > +{ > > > > + if (head) { > > > > + void *ptr = (void *) head - (unsigned long) func; > > > > + > > > > + kasan_record_aux_stack_noalloc(ptr); > > > > + } > > > > > > For the !head case; similar to Tree RCU's kvfree_call_rcu() implementation, > > > we do not need to record 'ptr' (which will be 'func')? > > > > My understanding is that we do not need to record in that case > > because __kvfree_call_rcu() will simply invoke the almost-zero-cost > > synchronize_rcu() and then invoke kfree(). > > > > Johannes, Dmitry, Marco, anything that I am missing? > > As-is looks sensible - doing kasan_record_aux_stack_noalloc() only > makes sense if the actual kfree() is not done with a callstack that > will point at the kvfree_call_rcu() caller. Otherwise we're doing > redundant work and just polluting the aux stack storage slots. So in > the case where kvfree_call_rcu() does synchronize_rcu() and kfree() > the kvfree_call_rcu() caller is in the callstack, and would be shown > on use-after-free bugs. Thank you for checking and for confirmation! Thanx, Paul
diff --git a/include/linux/rcutiny.h b/include/linux/rcutiny.h index 5fed476f977f6..d84e13f2c3848 100644 --- a/include/linux/rcutiny.h +++ b/include/linux/rcutiny.h @@ -38,7 +38,7 @@ static inline void synchronize_rcu_expedited(void) */ extern void kvfree(const void *addr); -static inline void kvfree_call_rcu(struct rcu_head *head, rcu_callback_t func) +static inline void __kvfree_call_rcu(struct rcu_head *head, rcu_callback_t func) { if (head) { call_rcu(head, func); @@ -51,6 +51,15 @@ static inline void kvfree_call_rcu(struct rcu_head *head, rcu_callback_t func) kvfree((void *) func); } +#ifdef CONFIG_KASAN_GENERIC +void kvfree_call_rcu(struct rcu_head *head, rcu_callback_t func); +#else +static inline void kvfree_call_rcu(struct rcu_head *head, rcu_callback_t func) +{ + __kvfree_call_rcu(head, func); +} +#endif + void rcu_qs(void); static inline void rcu_softirq_qs(void) diff --git a/kernel/rcu/tiny.c b/kernel/rcu/tiny.c index 340b3f8b090d4..58ff3721d975c 100644 --- a/kernel/rcu/tiny.c +++ b/kernel/rcu/tiny.c @@ -217,6 +217,20 @@ bool poll_state_synchronize_rcu(unsigned long oldstate) } EXPORT_SYMBOL_GPL(poll_state_synchronize_rcu); +#ifdef CONFIG_KASAN_GENERIC +void kvfree_call_rcu(struct rcu_head *head, rcu_callback_t func) +{ + if (head) { + void *ptr = (void *) head - (unsigned long) func; + + kasan_record_aux_stack_noalloc(ptr); + } + + __kvfree_call_rcu(head, func); +} +EXPORT_SYMBOL_GPL(kvfree_call_rcu); +#endif + void __init rcu_init(void) { open_softirq(RCU_SOFTIRQ, rcu_process_callbacks);