diff mbox

mm/kasan: Don't vfree() nonexistent vm_area.

Message ID dabee6ab-3a7a-51cd-3b86-5468718e0390@virtuozzo.com (mailing list archive)
State New, archived
Headers show

Commit Message

Andrey Ryabinin May 23, 2018, 12:33 p.m. UTC 
On 05/23/2018 12:03 AM, Andrew Morton wrote:
> On Tue, 22 May 2018 19:44:06 +0300 Andrey Ryabinin <aryabinin@virtuozzo.com> wrote:
> 
>>> Obviously we can't call vfree() to free memory that wasn't allocated via
>>> vmalloc(). Use find_vm_area() to see if we can call vfree().
>>>
>>> Unfortunately it's a bit tricky to properly unmap and free shadow allocated
>>> during boot, so we'll have to keep it. If memory will come online again
>>> that shadow will be reused.
>>>
>>> Fixes: fa69b5989bb0 ("mm/kasan: add support for memory hotplug")
>>> Reported-by: Paul Menzel <pmenzel+linux-kasan-dev@molgen.mpg.de>
>>> Signed-off-by: Andrey Ryabinin <aryabinin@virtuozzo.com>
>>> Cc: <stable@vger.kernel.org>
>>> ---
>>
>> This seems stuck in -mm. Andrew, can we proceed?
> 
> OK.
> 
> Should there be a code comment explaining the situation that Matthew
> asked about?  It's rather obscure.
> 

Ok. Here is my attempt to improve the situation. If something is still not clear,
I'm open to suggestions.



From: Andrey Ryabinin <aryabinin@virtuozzo.com>
Subject: [PATCH] mm-kasan-dont-vfree-nonexistent-vm_area-fix

Improve comments.

Signed-off-by: Andrey Ryabinin <aryabinin@virtuozzo.com>
---
 mm/kasan/kasan.c | 15 +++++++++++----
 1 file changed, 11 insertions(+), 4 deletions(-)

Comments

kernel test robot May 26, 2018, 3:31 a.m. UTC | #1 
Hi Andrey,

I love your patch! Yet something to improve:

[auto build test ERROR on mmotm/master]
[cannot apply to v4.17-rc6]
[if your patch is applied to the wrong git tree, please drop us a note to help improve the system]

url:    https://github.com/0day-ci/linux/commits/Andrey-Ryabinin/mm-kasan-dont-vfree-nonexistent-vm_area-fix/20180526-093255
base:   git://git.cmpxchg.org/linux-mmotm.git master
config: sparc-allyesconfig (attached as .config)
compiler: sparc64-linux-gnu-gcc (Debian 7.2.0-11) 7.2.0
reproduce:
        wget https://raw.githubusercontent.com/intel/lkp-tests/master/sbin/make.cross -O ~/bin/make.cross
        chmod +x ~/bin/make.cross
        # save the attached .config to linux build tree
        make.cross ARCH=sparc 

All errors (new ones prefixed by >>):

   fs/autofs/inode.o: In function `autofs_new_ino':
   inode.c:(.text+0x220): multiple definition of `autofs_new_ino'
   fs/autofs/inode.o:inode.c:(.text+0x220): first defined here
   fs/autofs/inode.o: In function `autofs_clean_ino':
   inode.c:(.text+0x280): multiple definition of `autofs_clean_ino'
   fs/autofs/inode.o:inode.c:(.text+0x280): first defined here
   fs/autofs/inode.o: In function `autofs_free_ino':
   inode.c:(.text+0x2c0): multiple definition of `autofs_free_ino'
   fs/autofs/inode.o:inode.c:(.text+0x2c0): first defined here
   fs/autofs/inode.o: In function `autofs_kill_sb':
   inode.c:(.text+0x2e0): multiple definition of `autofs_kill_sb'
   fs/autofs/inode.o:inode.c:(.text+0x2e0): first defined here
   fs/autofs/inode.o: In function `autofs_get_inode':
   inode.c:(.text+0x360): multiple definition of `autofs_get_inode'
   fs/autofs/inode.o:inode.c:(.text+0x360): first defined here
   fs/autofs/inode.o: In function `autofs_fill_super':
   inode.c:(.text+0x440): multiple definition of `autofs_fill_super'
   fs/autofs/inode.o:inode.c:(.text+0x440): first defined here
   fs/autofs/root.o: In function `is_autofs_dentry':
   root.c:(.text+0x1860): multiple definition of `is_autofs_dentry'
   fs/autofs/root.o:root.c:(.text+0x1860): first defined here
   fs/autofs/root.o:(.rodata+0x100): multiple definition of `autofs_dentry_operations'
   fs/autofs/root.o:(.rodata+0x100): first defined here
   fs/autofs/root.o:(.rodata+0x180): multiple definition of `autofs_dir_inode_operations'
   fs/autofs/root.o:(.rodata+0x180): first defined here
   fs/autofs/root.o:(.rodata+0x240): multiple definition of `autofs_dir_operations'
   fs/autofs/root.o:(.rodata+0x240): first defined here
   fs/autofs/root.o:(.rodata+0x338): multiple definition of `autofs_root_operations'
   fs/autofs/root.o:(.rodata+0x338): first defined here
   fs/autofs/symlink.o:(.rodata+0x0): multiple definition of `autofs_symlink_inode_operations'
   fs/autofs/symlink.o:(.rodata+0x0): first defined here
   fs/autofs/waitq.o: In function `autofs_catatonic_mode':
>> waitq.c:(.text+0x80): multiple definition of `autofs_catatonic_mode'
   fs/autofs/waitq.o:waitq.c:(.text+0x80): first defined here
   fs/autofs/waitq.o: In function `autofs_wait_release':
>> waitq.c:(.text+0x180): multiple definition of `autofs_wait_release'
   fs/autofs/waitq.o:waitq.c:(.text+0x180): first defined here
   fs/autofs/waitq.o: In function `autofs_wait':
>> waitq.c:(.text+0x520): multiple definition of `autofs_wait'
   fs/autofs/waitq.o:waitq.c:(.text+0x520): first defined here
   fs/autofs/expire.o: In function `autofs_expire_direct':
   expire.c:(.text+0x7a0): multiple definition of `autofs_expire_direct'
   fs/autofs/expire.o:expire.c:(.text+0x7a0): first defined here
   fs/autofs/expire.o: In function `autofs_expire_indirect':
   expire.c:(.text+0x8e0): multiple definition of `autofs_expire_indirect'
   fs/autofs/expire.o:expire.c:(.text+0x8e0): first defined here
   fs/autofs/expire.o: In function `autofs_expire_wait':
   expire.c:(.text+0xba0): multiple definition of `autofs_expire_wait'
   fs/autofs/expire.o:expire.c:(.text+0xba0): first defined here
   fs/autofs/expire.o: In function `autofs_expire_run':
   expire.c:(.text+0xce0): multiple definition of `autofs_expire_run'
   fs/autofs/expire.o:expire.c:(.text+0xce0): first defined here
   fs/autofs/expire.o: In function `autofs_do_expire_multi':
   expire.c:(.text+0xde0): multiple definition of `autofs_do_expire_multi'
   fs/autofs/expire.o:expire.c:(.text+0xde0): first defined here
   fs/autofs/expire.o: In function `autofs_expire_multi':
   expire.c:(.text+0xea0): multiple definition of `autofs_expire_multi'
   fs/autofs/expire.o:expire.c:(.text+0xea0): first defined here
   fs/autofs/dev-ioctl.o: In function `autofs_dev_ioctl_init':
   dev-ioctl.c:(.init.text+0x0): multiple definition of `autofs_dev_ioctl_init'
   fs/autofs/dev-ioctl.o:dev-ioctl.c:(.init.text+0x0): first defined here
   fs/autofs/dev-ioctl.o: In function `autofs_dev_ioctl_exit':
   dev-ioctl.c:(.text+0xbc0): multiple definition of `autofs_dev_ioctl_exit'
   fs/autofs/dev-ioctl.o:dev-ioctl.c:(.text+0xbc0): first defined here

---
0-DAY kernel test infrastructure                Open Source Technology Center
https://lists.01.org/pipermail/kbuild-all                   Intel Corporation
Andrew Morton May 26, 2018, 3:48 a.m. UTC | #2 
On Sat, 26 May 2018 11:31:35 +0800 kbuild test robot <lkp@intel.com> wrote:

> Hi Andrey,
> 
> I love your patch! Yet something to improve:
> 
> [auto build test ERROR on mmotm/master]
> [cannot apply to v4.17-rc6]
> [if your patch is applied to the wrong git tree, please drop us a note to help improve the system]
> 
> url:    https://github.com/0day-ci/linux/commits/Andrey-Ryabinin/mm-kasan-dont-vfree-nonexistent-vm_area-fix/20180526-093255
> base:   git://git.cmpxchg.org/linux-mmotm.git master
> config: sparc-allyesconfig (attached as .config)
> compiler: sparc64-linux-gnu-gcc (Debian 7.2.0-11) 7.2.0
> reproduce:
>         wget https://raw.githubusercontent.com/intel/lkp-tests/master/sbin/make.cross -O ~/bin/make.cross
>         chmod +x ~/bin/make.cross
>         # save the attached .config to linux build tree
>         make.cross ARCH=sparc 
> 
> All errors (new ones prefixed by >>):
> 
>    fs/autofs/inode.o: In function `autofs_new_ino':
>    inode.c:(.text+0x220): multiple definition of `autofs_new_ino'
>    fs/autofs/inode.o:inode.c:(.text+0x220): first defined here
>    fs/autofs/inode.o: In function `autofs_clean_ino':
>    inode.c:(.text+0x280): multiple definition of `autofs_clean_ino'
>    fs/autofs/inode.o:inode.c:(.text+0x280): first defined here

There's bot breakage here - clearly that patch didn't cause this error.

Ian, this autofs glitch may still not be fixed.
Ian Kent May 28, 2018, 4:13 a.m. UTC | #3 
On Fri, 2018-05-25 at 20:48 -0700, Andrew Morton wrote:
> On Sat, 26 May 2018 11:31:35 +0800 kbuild test robot <lkp@intel.com> wrote:
> 
> > Hi Andrey,
> > 
> > I love your patch! Yet something to improve:
> > 
> > [auto build test ERROR on mmotm/master]
> > [cannot apply to v4.17-rc6]
> > [if your patch is applied to the wrong git tree, please drop us a note to
> > help improve the system]
> > 
> > url:    https://github.com/0day-ci/linux/commits/Andrey-Ryabinin/mm-kasan-do
> > nt-vfree-nonexistent-vm_area-fix/20180526-093255
> > base:   git://git.cmpxchg.org/linux-mmotm.git master
> > config: sparc-allyesconfig (attached as .config)
> > compiler: sparc64-linux-gnu-gcc (Debian 7.2.0-11) 7.2.0
> > reproduce:
> >         wget https://raw.githubusercontent.com/intel/lkp-tests/master/sbin/m
> > ake.cross -O ~/bin/make.cross
> >         chmod +x ~/bin/make.cross
> >         # save the attached .config to linux build tree
> >         make.cross ARCH=sparc 
> > 
> > All errors (new ones prefixed by >>):
> > 
> >    fs/autofs/inode.o: In function `autofs_new_ino':
> >    inode.c:(.text+0x220): multiple definition of `autofs_new_ino'
> >    fs/autofs/inode.o:inode.c:(.text+0x220): first defined here
> >    fs/autofs/inode.o: In function `autofs_clean_ino':
> >    inode.c:(.text+0x280): multiple definition of `autofs_clean_ino'
> >    fs/autofs/inode.o:inode.c:(.text+0x280): first defined here
> 
> There's bot breakage here - clearly that patch didn't cause this error.
> 
> Ian, this autofs glitch may still not be fixed.

Yes, autofs-make-autofs4-Kconfig-depend-on-AUTOFS_FS.patch should have
fixed that.

I tied a bunch of .config combinations and I was unable to find any that
lead to both CONFIG_AUTOFS_FS and CONFIG_AUTOFS4_FS being defined.

I must be missing something else, I'll investigate.

Ian
Ian Kent May 28, 2018, 4:39 a.m. UTC | #4 
On Mon, 2018-05-28 at 12:13 +0800, Ian Kent wrote:
> On Fri, 2018-05-25 at 20:48 -0700, Andrew Morton wrote:
> > On Sat, 26 May 2018 11:31:35 +0800 kbuild test robot <lkp@intel.com> wrote:
> > 
> > > Hi Andrey,
> > > 
> > > I love your patch! Yet something to improve:
> > > 
> > > [auto build test ERROR on mmotm/master]
> > > [cannot apply to v4.17-rc6]
> > > [if your patch is applied to the wrong git tree, please drop us a note to
> > > help improve the system]
> > > 
> > > url:    https://github.com/0day-ci/linux/commits/Andrey-Ryabinin/mm-kasan-
> > > do
> > > nt-vfree-nonexistent-vm_area-fix/20180526-093255
> > > base:   git://git.cmpxchg.org/linux-mmotm.git master
> > > config: sparc-allyesconfig (attached as .config)
> > > compiler: sparc64-linux-gnu-gcc (Debian 7.2.0-11) 7.2.0
> > > reproduce:
> > >         wget https://raw.githubusercontent.com/intel/lkp-tests/master/sbin
> > > /m
> > > ake.cross -O ~/bin/make.cross
> > >         chmod +x ~/bin/make.cross
> > >         # save the attached .config to linux build tree
> > >         make.cross ARCH=sparc 
> > > 
> > > All errors (new ones prefixed by >>):
> > > 
> > >    fs/autofs/inode.o: In function `autofs_new_ino':
> > >    inode.c:(.text+0x220): multiple definition of `autofs_new_ino'
> > >    fs/autofs/inode.o:inode.c:(.text+0x220): first defined here
> > >    fs/autofs/inode.o: In function `autofs_clean_ino':
> > >    inode.c:(.text+0x280): multiple definition of `autofs_clean_ino'
> > >    fs/autofs/inode.o:inode.c:(.text+0x280): first defined here
> > 
> > There's bot breakage here - clearly that patch didn't cause this error.
> > 
> > Ian, this autofs glitch may still not be fixed.
> 
> Yes, autofs-make-autofs4-Kconfig-depend-on-AUTOFS_FS.patch should have
> fixed that.
> 
> I tied a bunch of .config combinations and I was unable to find any that
> lead to both CONFIG_AUTOFS_FS and CONFIG_AUTOFS4_FS being defined.

Oh, autofs-make-autofs4-Kconfig-depend-on-AUTOFS_FS.patch was sent as
a follow up patch which means it's still possible to have both
CONFIG_AUTOFS_FS and CONFIG_AUTOFS4_FS set between 
autofs-create-autofs-Kconfig-and-Makefile.patch and the above patch.

Perhaps all that's needed is to fold the follow up patch into
autofs-create-autofs-Kconfig-and-Makefile.patch to close that
possibility.

I'll check that can be done without problem.

> 
> I must be missing something else, I'll investigate.

And I'll check if there's anything else I'm missing.

Sorry for the inconvenience.

> 
> Ian
kernel test robot May 30, 2018, 11:53 a.m. UTC | #5 
Hi Andrey,

I love your patch! Yet something to improve:

[auto build test ERROR on mmotm/master]
[cannot apply to v4.17-rc7 next-20180529]
[if your patch is applied to the wrong git tree, please drop us a note to help improve the system]

url:    https://github.com/0day-ci/linux/commits/Andrey-Ryabinin/mm-kasan-dont-vfree-nonexistent-vm_area-fix/20180526-093255
base:   git://git.cmpxchg.org/linux-mmotm.git master
config: i386-allyesconfig (attached as .config)
compiler: gcc-7 (Debian 7.3.0-16) 7.3.0
reproduce:
        # save the attached .config to linux build tree
        make ARCH=i386 

All errors (new ones prefixed by >>):

   fs/autofs/inode.o: In function `autofs_new_ino':
>> inode.c:(.text+0x170): multiple definition of `autofs_new_ino'
   fs/autofs/inode.o:inode.c:(.text+0x170): first defined here
   fs/autofs/inode.o: In function `autofs_clean_ino':
>> inode.c:(.text+0x1c0): multiple definition of `autofs_clean_ino'
   fs/autofs/inode.o:inode.c:(.text+0x1c0): first defined here
   fs/autofs/inode.o: In function `autofs_free_ino':
>> inode.c:(.text+0x1f0): multiple definition of `autofs_free_ino'
   fs/autofs/inode.o:inode.c:(.text+0x1f0): first defined here
   fs/autofs/inode.o: In function `autofs_kill_sb':
>> inode.c:(.text+0x200): multiple definition of `autofs_kill_sb'
   fs/autofs/inode.o:inode.c:(.text+0x200): first defined here
   fs/autofs/inode.o: In function `autofs_get_inode':
>> inode.c:(.text+0x250): multiple definition of `autofs_get_inode'
   fs/autofs/inode.o:inode.c:(.text+0x250): first defined here
   fs/autofs/inode.o: In function `autofs_fill_super':
>> inode.c:(.text+0x300): multiple definition of `autofs_fill_super'
   fs/autofs/inode.o:inode.c:(.text+0x300): first defined here
   fs/autofs/root.o: In function `is_autofs_dentry':
>> root.c:(.text+0x1170): multiple definition of `is_autofs_dentry'
   fs/autofs/root.o:root.c:(.text+0x1170): first defined here
>> fs/autofs/root.o:(.rodata+0x0): multiple definition of `autofs_dentry_operations'
   fs/autofs/root.o:(.rodata+0x0): first defined here
>> fs/autofs/root.o:(.rodata+0x40): multiple definition of `autofs_dir_inode_operations'
   fs/autofs/root.o:(.rodata+0x40): first defined here
>> fs/autofs/root.o:(.rodata+0xc0): multiple definition of `autofs_dir_operations'
   fs/autofs/root.o:(.rodata+0xc0): first defined here
>> fs/autofs/root.o:(.rodata+0x140): multiple definition of `autofs_root_operations'
   fs/autofs/root.o:(.rodata+0x140): first defined here
>> fs/autofs/symlink.o:(.rodata+0x0): multiple definition of `autofs_symlink_inode_operations'
   fs/autofs/symlink.o:(.rodata+0x0): first defined here
   fs/autofs/waitq.o: In function `autofs_catatonic_mode':
>> waitq.c:(.text+0x60): multiple definition of `autofs_catatonic_mode'
   fs/autofs/waitq.o:waitq.c:(.text+0x60): first defined here
   fs/autofs/waitq.o: In function `autofs_wait_release':
>> waitq.c:(.text+0x110): multiple definition of `autofs_wait_release'
   fs/autofs/waitq.o:waitq.c:(.text+0x110): first defined here
   fs/autofs/waitq.o: In function `autofs_wait':
>> waitq.c:(.text+0x520): multiple definition of `autofs_wait'
   fs/autofs/waitq.o:waitq.c:(.text+0x520): first defined here
   fs/autofs/expire.o: In function `autofs_expire_direct':
   expire.c:(.text+0x4d0): multiple definition of `autofs_expire_direct'
   fs/autofs/expire.o:expire.c:(.text+0x4d0): first defined here
   fs/autofs/expire.o: In function `autofs_expire_indirect':
   expire.c:(.text+0x5c0): multiple definition of `autofs_expire_indirect'
   fs/autofs/expire.o:expire.c:(.text+0x5c0): first defined here
   fs/autofs/expire.o: In function `autofs_expire_wait':
   expire.c:(.text+0x840): multiple definition of `autofs_expire_wait'
   fs/autofs/expire.o:expire.c:(.text+0x840): first defined here
   fs/autofs/expire.o: In function `autofs_expire_run':
   expire.c:(.text+0x910): multiple definition of `autofs_expire_run'
   fs/autofs/expire.o:expire.c:(.text+0x910): first defined here
   fs/autofs/expire.o: In function `autofs_do_expire_multi':
   expire.c:(.text+0xa30): multiple definition of `autofs_do_expire_multi'
   fs/autofs/expire.o:expire.c:(.text+0xa30): first defined here
   fs/autofs/expire.o: In function `autofs_expire_multi':
   expire.c:(.text+0xb00): multiple definition of `autofs_expire_multi'
   fs/autofs/expire.o:expire.c:(.text+0xb00): first defined here
   fs/autofs/dev-ioctl.o: In function `autofs_dev_ioctl_init':
   dev-ioctl.c:(.init.text+0x0): multiple definition of `autofs_dev_ioctl_init'
   fs/autofs/dev-ioctl.o:dev-ioctl.c:(.init.text+0x0): first defined here
   fs/autofs/dev-ioctl.o: In function `autofs_dev_ioctl_exit':
   dev-ioctl.c:(.text+0xac0): multiple definition of `autofs_dev_ioctl_exit'
   fs/autofs/dev-ioctl.o:dev-ioctl.c:(.text+0xac0): first defined here

---
0-DAY kernel test infrastructure                Open Source Technology Center
https://lists.01.org/pipermail/kbuild-all                   Intel Corporation
diff mbox

Patch

diff --git a/mm/kasan/kasan.c b/mm/kasan/kasan.c
index 135ce2838c89..ea44dd0bc4e7 100644
--- a/mm/kasan/kasan.c
+++ b/mm/kasan/kasan.c
@@ -812,7 +812,7 @@  static bool shadow_mapped(unsigned long addr)
 	/*
 	 * We can't use pud_large() or pud_huge(), the first one
 	 * is arch-specific, the last one depend on HUGETLB_PAGE.
-	 * So let's abuse pud_bad(), if bud is bad it's has to
+	 * So let's abuse pud_bad(), if pud is bad than it's bad
 	 * because it's huge.
 	 */
 	if (pud_bad(*pud))
@@ -871,9 +871,16 @@  static int __meminit kasan_mem_notifier(struct notifier_block *nb,
 		struct vm_struct *vm;
 
 		/*
-		 * Only hot-added memory have vm_area. Freeing shadow
-		 * mapped during boot would be tricky, so we'll just
-		 * have to keep it.
+		 * shadow_start was either mapped during boot by kasan_init()
+		 * or during memory online by __vmalloc_node_range().
+		 * In the latter case we can use vfree() to free shadow.
+		 * Non-NULL result of the find_vm_area() will tell us if
+		 * that was the second case.
+		 *
+		 * Currently it's not possible to free shadow mapped
+		 * during boot by kasan_init(). It's because the code
+		 * to do that hasn't been written yet. So we'll just
+		 * leak the memory.
 		 */
 		vm = find_vm_area((void *)shadow_start);
 		if (vm)