| Message ID | 20191205140407.1874-2-dja@axtens.net (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
| Series | [1/3] mm: add apply_to_existing_pages helper | expand |
On 12/5/19 5:04 PM, Daniel Axtens wrote: > kasan_release_vmalloc uses apply_to_page_range to release vmalloc > shadow. Unfortunately, apply_to_page_range can allocate memory to > fill in page table entries, which is not what we want. > > Also, kasan_release_vmalloc is called under free_vmap_area_lock, > so if apply_to_page_range does allocate memory, we get a sleep in > atomic bug: > > BUG: sleeping function called from invalid context at mm/page_alloc.c:4681 > in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 15087, name: > > Call Trace: > __dump_stack lib/dump_stack.c:77 [inline] > dump_stack+0x199/0x216 lib/dump_stack.c:118 > ___might_sleep.cold.97+0x1f5/0x238 kernel/sched/core.c:6800 > __might_sleep+0x95/0x190 kernel/sched/core.c:6753 > prepare_alloc_pages mm/page_alloc.c:4681 [inline] > __alloc_pages_nodemask+0x3cd/0x890 mm/page_alloc.c:4730 > alloc_pages_current+0x10c/0x210 mm/mempolicy.c:2211 > alloc_pages include/linux/gfp.h:532 [inline] > __get_free_pages+0xc/0x40 mm/page_alloc.c:4786 > __pte_alloc_one_kernel include/asm-generic/pgalloc.h:21 [inline] > pte_alloc_one_kernel include/asm-generic/pgalloc.h:33 [inline] > __pte_alloc_kernel+0x1d/0x200 mm/memory.c:459 > apply_to_pte_range mm/memory.c:2031 [inline] > apply_to_pmd_range mm/memory.c:2068 [inline] > apply_to_pud_range mm/memory.c:2088 [inline] > apply_to_p4d_range mm/memory.c:2108 [inline] > apply_to_page_range+0x77d/0xa00 mm/memory.c:2133 > kasan_release_vmalloc+0xa7/0xc0 mm/kasan/common.c:970 > __purge_vmap_area_lazy+0xcbb/0x1f30 mm/vmalloc.c:1313 > try_purge_vmap_area_lazy mm/vmalloc.c:1332 [inline] > free_vmap_area_noflush+0x2ca/0x390 mm/vmalloc.c:1368 > free_unmap_vmap_area mm/vmalloc.c:1381 [inline] > remove_vm_area+0x1cc/0x230 mm/vmalloc.c:2209 > vm_remove_mappings mm/vmalloc.c:2236 [inline] > __vunmap+0x223/0xa20 mm/vmalloc.c:2299 > __vfree+0x3f/0xd0 mm/vmalloc.c:2356 > __vmalloc_area_node mm/vmalloc.c:2507 [inline] > __vmalloc_node_range+0x5d5/0x810 mm/vmalloc.c:2547 > __vmalloc_node mm/vmalloc.c:2607 [inline] > __vmalloc_node_flags mm/vmalloc.c:2621 [inline] > vzalloc+0x6f/0x80 mm/vmalloc.c:2666 > alloc_one_pg_vec_page net/packet/af_packet.c:4233 [inline] > alloc_pg_vec net/packet/af_packet.c:4258 [inline] > packet_set_ring+0xbc0/0x1b50 net/packet/af_packet.c:4342 > packet_setsockopt+0xed7/0x2d90 net/packet/af_packet.c:3695 > __sys_setsockopt+0x29b/0x4d0 net/socket.c:2117 > __do_sys_setsockopt net/socket.c:2133 [inline] > __se_sys_setsockopt net/socket.c:2130 [inline] > __x64_sys_setsockopt+0xbe/0x150 net/socket.c:2130 > do_syscall_64+0xfa/0x780 arch/x86/entry/common.c:294 > entry_SYSCALL_64_after_hwframe+0x49/0xbe > > Switch to using the apply_to_existing_pages helper instead, which > won't allocate memory. > > Fixes: 3c5c3cfb9ef4 ("kasan: support backing vmalloc space with real shadow memory") > Reported-by: Dmitry Vyukov <dvyukov@google.com> > Cc: Andrey Ryabinin <aryabinin@virtuozzo.com> > Signed-off-by: Daniel Axtens <dja@axtens.net> > > --- > > Andrew, if you want to take this, it replaces > "kasan: Don't allocate page tables in kasan_release_vmalloc()" > --- > mm/kasan/common.c | 8 +++++--- > 1 file changed, 5 insertions(+), 3 deletions(-) > Reviewed-by: Andrey Ryabinin <aryabinin@virtuozzo.com>
diff --git a/mm/kasan/common.c b/mm/kasan/common.c index e04e73603dfc..26fd0c13dd28 100644 --- a/mm/kasan/common.c +++ b/mm/kasan/common.c @@ -957,6 +957,7 @@ void kasan_release_vmalloc(unsigned long start, unsigned long end, { void *shadow_start, *shadow_end; unsigned long region_start, region_end; + unsigned long size; region_start = ALIGN(start, PAGE_SIZE * KASAN_SHADOW_SCALE_SIZE); region_end = ALIGN_DOWN(end, PAGE_SIZE * KASAN_SHADOW_SCALE_SIZE); @@ -979,9 +980,10 @@ void kasan_release_vmalloc(unsigned long start, unsigned long end, shadow_end = kasan_mem_to_shadow((void *)region_end); if (shadow_end > shadow_start) { - apply_to_page_range(&init_mm, (unsigned long)shadow_start, - (unsigned long)(shadow_end - shadow_start), - kasan_depopulate_vmalloc_pte, NULL); + size = shadow_end - shadow_start; + apply_to_existing_pages(&init_mm, (unsigned long)shadow_start, + size, kasan_depopulate_vmalloc_pte, + NULL); flush_tlb_kernel_range((unsigned long)shadow_start, (unsigned long)shadow_end); }
kasan_release_vmalloc uses apply_to_page_range to release vmalloc shadow. Unfortunately, apply_to_page_range can allocate memory to fill in page table entries, which is not what we want. Also, kasan_release_vmalloc is called under free_vmap_area_lock, so if apply_to_page_range does allocate memory, we get a sleep in atomic bug: BUG: sleeping function called from invalid context at mm/page_alloc.c:4681 in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 15087, name: Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x199/0x216 lib/dump_stack.c:118 ___might_sleep.cold.97+0x1f5/0x238 kernel/sched/core.c:6800 __might_sleep+0x95/0x190 kernel/sched/core.c:6753 prepare_alloc_pages mm/page_alloc.c:4681 [inline] __alloc_pages_nodemask+0x3cd/0x890 mm/page_alloc.c:4730 alloc_pages_current+0x10c/0x210 mm/mempolicy.c:2211 alloc_pages include/linux/gfp.h:532 [inline] __get_free_pages+0xc/0x40 mm/page_alloc.c:4786 __pte_alloc_one_kernel include/asm-generic/pgalloc.h:21 [inline] pte_alloc_one_kernel include/asm-generic/pgalloc.h:33 [inline] __pte_alloc_kernel+0x1d/0x200 mm/memory.c:459 apply_to_pte_range mm/memory.c:2031 [inline] apply_to_pmd_range mm/memory.c:2068 [inline] apply_to_pud_range mm/memory.c:2088 [inline] apply_to_p4d_range mm/memory.c:2108 [inline] apply_to_page_range+0x77d/0xa00 mm/memory.c:2133 kasan_release_vmalloc+0xa7/0xc0 mm/kasan/common.c:970 __purge_vmap_area_lazy+0xcbb/0x1f30 mm/vmalloc.c:1313 try_purge_vmap_area_lazy mm/vmalloc.c:1332 [inline] free_vmap_area_noflush+0x2ca/0x390 mm/vmalloc.c:1368 free_unmap_vmap_area mm/vmalloc.c:1381 [inline] remove_vm_area+0x1cc/0x230 mm/vmalloc.c:2209 vm_remove_mappings mm/vmalloc.c:2236 [inline] __vunmap+0x223/0xa20 mm/vmalloc.c:2299 __vfree+0x3f/0xd0 mm/vmalloc.c:2356 __vmalloc_area_node mm/vmalloc.c:2507 [inline] __vmalloc_node_range+0x5d5/0x810 mm/vmalloc.c:2547 __vmalloc_node mm/vmalloc.c:2607 [inline] __vmalloc_node_flags mm/vmalloc.c:2621 [inline] vzalloc+0x6f/0x80 mm/vmalloc.c:2666 alloc_one_pg_vec_page net/packet/af_packet.c:4233 [inline] alloc_pg_vec net/packet/af_packet.c:4258 [inline] packet_set_ring+0xbc0/0x1b50 net/packet/af_packet.c:4342 packet_setsockopt+0xed7/0x2d90 net/packet/af_packet.c:3695 __sys_setsockopt+0x29b/0x4d0 net/socket.c:2117 __do_sys_setsockopt net/socket.c:2133 [inline] __se_sys_setsockopt net/socket.c:2130 [inline] __x64_sys_setsockopt+0xbe/0x150 net/socket.c:2130 do_syscall_64+0xfa/0x780 arch/x86/entry/common.c:294 entry_SYSCALL_64_after_hwframe+0x49/0xbe Switch to using the apply_to_existing_pages helper instead, which won't allocate memory. Fixes: 3c5c3cfb9ef4 ("kasan: support backing vmalloc space with real shadow memory") Reported-by: Dmitry Vyukov <dvyukov@google.com> Cc: Andrey Ryabinin <aryabinin@virtuozzo.com> Signed-off-by: Daniel Axtens <dja@axtens.net> --- Andrew, if you want to take this, it replaces "kasan: Don't allocate page tables in kasan_release_vmalloc()" --- mm/kasan/common.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-)