From patchwork Thu Jan 30 11:17:44 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Vijayanand Jitta X-Patchwork-Id: 11357735 Return-Path: Received: from mail.kernel.org (pdx-korg-mail-1.web.codeaurora.org [172.30.200.123]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id DFE9B92A for ; Thu, 30 Jan 2020 11:18:35 +0000 (UTC) Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by mail.kernel.org (Postfix) with ESMTP id 9E440215A4 for ; Thu, 30 Jan 2020 11:18:35 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=fail reason="key not found in DNS" (0-bit key) header.d=mg.codeaurora.org header.i=@mg.codeaurora.org header.b="r6Z4bQ/C" DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org 9E440215A4 Authentication-Results: mail.kernel.org; dmarc=none (p=none dis=none) header.from=codeaurora.org Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=owner-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix) id BAA786B0336; Thu, 30 Jan 2020 06:18:34 -0500 (EST) Delivered-To: linux-mm-outgoing@kvack.org Received: by kanga.kvack.org (Postfix, from userid 40) id B80C36B0337; Thu, 30 Jan 2020 06:18:34 -0500 (EST) X-Original-To: int-list-linux-mm@kvack.org X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id ABF106B0339; Thu, 30 Jan 2020 06:18:34 -0500 (EST) X-Original-To: linux-mm@kvack.org X-Delivered-To: linux-mm@kvack.org Received: from forelay.hostedemail.com (smtprelay0123.hostedemail.com [216.40.44.123]) by kanga.kvack.org (Postfix) with ESMTP id 9804A6B0336 for ; Thu, 30 Jan 2020 06:18:34 -0500 (EST) Received: from smtpin02.hostedemail.com (10.5.19.251.rfc1918.com [10.5.19.251]) by forelay03.hostedemail.com (Postfix) with ESMTP id 5132B8248D7C for ; Thu, 30 Jan 2020 11:18:34 +0000 (UTC) X-FDA: 76434052548.02.suit54_105510000b220 X-Spam-Summary: 2,0,0,d06474540647984d,d41d8cd98f00b204,bounce+d06763.be9e4a-linux-mm=kvack.org@mg.codeaurora.org,:cl@linux.com:penberg@kernel.org:rientjes@google.com:iamjoonsoo.kim@lge.com:akpm@linux-foundation.org::linux-kernel@vger.kernel.org:vinmenon@codeaurora.org:kernel-team@android.com:vjitta@codeaurora.org,RULES_HIT:41:355:379:541:800:960:966:973:988:989:1260:1345:1359:1437:1535:1543:1711:1730:1747:1777:1792:2194:2196:2199:2200:2393:2540:2559:2562:2895:2901:3138:3139:3140:3141:3142:3354:3865:3866:3867:3868:3870:3871:3872:4117:4385:5007:6261:6653:7576:7903:8603:8660:10004:11026:11218:11232:11473:11658:11914:12043:12048:12291:12296:12297:12438:12517:12519:12555:12679:12895:13148:13230:14096:14181:14394:14721:21080:21451:21627:21972:21990:30012:30029:30054:30070,0,RBL:104.130.122.26:@mg.codeaurora.org:.lbl8.mailshell.net-62.2.0.100 64.100.201.201,CacheIP:none,Bayesian:0.5,0.5,0.5,Netcheck:none,DomainCache:0,MSF:not bulk,SPF:fs,MSBL:0,DNSBL:neutral,Custom_rules:0:0:0,LFti me:25,LU X-HE-Tag: suit54_105510000b220 X-Filterd-Recvd-Size: 6058 Received: from mail26.static.mailgun.info (mail26.static.mailgun.info [104.130.122.26]) by imf29.hostedemail.com (Postfix) with ESMTP for ; Thu, 30 Jan 2020 11:18:32 +0000 (UTC) DKIM-Signature: a=rsa-sha256; v=1; c=relaxed/relaxed; d=mg.codeaurora.org; q=dns/txt; s=smtp; t=1580383113; h=References: In-Reply-To: Message-Id: Date: Subject: Cc: To: From: Sender; bh=aa+36n0hz5H/cqeSiC1wp8nTMgGYZejOu0SrpL3H1mY=; b=r6Z4bQ/CP020cEAz8XVfyekUMesCVEOW+sPT3eeJVSmn4k1df+KuLJAtZq5xCvyvoVqdAG8z vMY4POmbBDDqjp67Uu57wrYkwCJ9hYoGKY7hVYkuIlmMZ1iZN0R5kBA/hAkPlbcVWJzoeKs7 Bz9IxjtGsGrw8TytE3a01xT0y+k= X-Mailgun-Sending-Ip: 104.130.122.26 X-Mailgun-Sid: WyIwY2Q3OCIsICJsaW51eC1tbUBrdmFjay5vcmciLCAiYmU5ZTRhIl0= Received: from smtp.codeaurora.org (ec2-35-166-182-171.us-west-2.compute.amazonaws.com [35.166.182.171]) by mxa.mailgun.org with ESMTP id 5e32bb85.7f9938e180d8-smtp-out-n01; Thu, 30 Jan 2020 11:18:29 -0000 (UTC) Received: by smtp.codeaurora.org (Postfix, from userid 1001) id 7EB93C447A2; Thu, 30 Jan 2020 11:18:29 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-caf-mail-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-1.0 required=2.0 tests=ALL_TRUSTED,SPF_NONE, URIBL_BLOCKED autolearn=unavailable autolearn_force=no version=3.4.0 Received: from vjitta-linux.qualcomm.com (blr-c-bdr-fw-01_GlobalNAT_AllZones-Outside.qualcomm.com [103.229.19.19]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-SHA256 (128/128 bits)) (No client certificate requested) (Authenticated sender: vjitta) by smtp.codeaurora.org (Postfix) with ESMTPSA id 59F7CC43383; Thu, 30 Jan 2020 11:18:25 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.3.2 smtp.codeaurora.org 59F7CC43383 Authentication-Results: aws-us-west-2-caf-mail-1.web.codeaurora.org; dmarc=none (p=none dis=none) header.from=codeaurora.org Authentication-Results: aws-us-west-2-caf-mail-1.web.codeaurora.org; spf=none smtp.mailfrom=vjitta@codeaurora.org From: vjitta@codeaurora.org To: cl@linux.com, penberg@kernel.org, rientjes@google.com, iamjoonsoo.kim@lge.com, akpm@linux-foundation.org, linux-mm@kvack.org Cc: linux-kernel@vger.kernel.org, vinmenon@codeaurora.org, kernel-team@android.com, Vijayanand Jitta Subject: [PATCH] mm: slub: reinitialize random sequence cache on slab object update Date: Thu, 30 Jan 2020 16:47:44 +0530 Message-Id: <1580383064-16536-1-git-send-email-vjitta@codeaurora.org> X-Mailer: git-send-email 1.9.1 In-Reply-To: <1580379523-32272-1-git-send-email-vjitta@codeaurora.org> References: <1580379523-32272-1-git-send-email-vjitta@codeaurora.org> X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: From: Vijayanand Jitta Random sequence cache is precomputed during slab object creation based up on the object size and no of objects per slab. These could be changed when flags like SLAB_STORE_USER, SLAB_POISON are updated from sysfs. So when shuffle_freelist is called during slab_alloc it uses updated object count to access the precomputed random sequence cache. This could result in incorrect access of the random sequence cache which could further result in slab corruption. Fix this by reinitializing the random sequence cache up on slab object update. A sample panic trace when write to slab_store_user was attempted. Call trace0: exception set_freepointer(inline) shuffle_freelist(inline) new_slab+0x688/0x690 ___slab_alloc+0x548/0x6f8 kmem_cache_alloc+0x3dc/0x418 zs_malloc+0x60/0x578 zram_bvec_rw+0x66c/0xaa0 zram_make_request+0x190/0x2c8 generic_make_request+0x1f8/0x420 submit_bio+0x140/0x1d8 submit_bh_wbc+0x1a0/0x1e0 __block_write_full_page+0x3a0/0x5e8 block_write_full_page+0xec/0x108 blkdev_writepage+0x2c/0x38 __writepage+0x34/0x98 write_cache_pages+0x33c/0x598 generic_writepages+0x54/0x98 blkdev_writepages+0x24/0x30 do_writepages+0x90/0x138 __filemap_fdatawrite_range+0xc0/0x128 file_write_and_wait_range+0x44/0xa0 blkdev_fsync+0x38/0x68 __arm64_sys_fsync+0x6c/0xb8 Signed-off-by: Vijayanand Jitta --- mm/slub.c | 25 +++++++++++++++++++++++++ 1 file changed, 25 insertions(+) diff --git a/mm/slub.c b/mm/slub.c index 0ab92ec..b88dd0f 100644 --- a/mm/slub.c +++ b/mm/slub.c @@ -1533,6 +1533,24 @@ static int init_cache_random_seq(struct kmem_cache *s) return 0; } +/* re-initialize the random sequence cache */ +static int reinit_cache_random_seq(struct kmem_cache *s) +{ + int err; + + if (s->random_seq) { + cache_random_seq_destroy(s); + err = init_cache_random_seq(s); + + if (err) { + pr_err("SLUB: Unable to re-initialize random sequence cache for %s\n", + s->name); + return err; + } + } + + return 0; +} /* Initialize each random sequence freelist per cache */ static void __init init_freelist_randomization(void) { @@ -1607,6 +1625,10 @@ static inline int init_cache_random_seq(struct kmem_cache *s) { return 0; } +static int reinit_cache_random_seq(struct kmem_cache *s) +{ + return 0; +} static inline void init_freelist_randomization(void) { } static inline bool shuffle_freelist(struct kmem_cache *s, struct page *page) { @@ -5192,6 +5214,7 @@ static ssize_t red_zone_store(struct kmem_cache *s, s->flags |= SLAB_RED_ZONE; } calculate_sizes(s, -1); + reinit_cache_random_seq(s); return length; } SLAB_ATTR(red_zone); @@ -5212,6 +5235,7 @@ static ssize_t poison_store(struct kmem_cache *s, s->flags |= SLAB_POISON; } calculate_sizes(s, -1); + reinit_cache_random_seq(s); return length; } SLAB_ATTR(poison); @@ -5233,6 +5257,7 @@ static ssize_t store_user_store(struct kmem_cache *s, s->flags |= SLAB_STORE_USER; } calculate_sizes(s, -1); + reinit_cache_random_seq(s); return length; } SLAB_ATTR(store_user);