From patchwork Mon Jan 27 15:03:57 2025 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Andrey Ryabinin X-Patchwork-Id: 13951520 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id 84977C02188 for ; Mon, 27 Jan 2025 15:05:16 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id ED105280168; Mon, 27 Jan 2025 10:05:15 -0500 (EST) Received: by kanga.kvack.org (Postfix, from userid 40) id E8112280165; Mon, 27 Jan 2025 10:05:15 -0500 (EST) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id D2243280168; Mon, 27 Jan 2025 10:05:15 -0500 (EST) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0011.hostedemail.com [216.40.44.11]) by kanga.kvack.org (Postfix) with ESMTP id B8167280165 for ; Mon, 27 Jan 2025 10:05:15 -0500 (EST) Received: from smtpin27.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay08.hostedemail.com (Postfix) with ESMTP id 6B9EF140292 for ; Mon, 27 Jan 2025 15:05:15 +0000 (UTC) X-FDA: 83053554990.27.F12DE1B Received: from mail-lf1-f53.google.com (mail-lf1-f53.google.com [209.85.167.53]) by imf11.hostedemail.com (Postfix) with ESMTP id 6145840014 for ; Mon, 27 Jan 2025 15:05:13 +0000 (UTC) Authentication-Results: imf11.hostedemail.com; dkim=pass header.d=gmail.com header.s=20230601 header.b=MSWebol9; dmarc=pass (policy=none) header.from=gmail.com; spf=pass (imf11.hostedemail.com: domain of ryabinin.a.a@gmail.com designates 209.85.167.53 as permitted sender) smtp.mailfrom=ryabinin.a.a@gmail.com ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1737990313; a=rsa-sha256; cv=none; b=L4WtlXCxraAGTrzWSfGklgS5xa25SaElfVl0kF4He12PvVCssyRXgXrEmRBkagQLlbLgt1 mNUg/AAhU2iJjlliu5ddfJVF2gBpyow6v7gkjD8W+Zf4I34pjxgA6BM7LqVEdsO5fXfec6 MwQnhs1a13H/LyV5C5864N8DtA1i6wM= ARC-Authentication-Results: i=1; imf11.hostedemail.com; dkim=pass header.d=gmail.com header.s=20230601 header.b=MSWebol9; dmarc=pass (policy=none) header.from=gmail.com; spf=pass (imf11.hostedemail.com: domain of ryabinin.a.a@gmail.com designates 209.85.167.53 as permitted sender) smtp.mailfrom=ryabinin.a.a@gmail.com ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1737990313; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references:dkim-signature; bh=a99Cj+rOUzLKKfU2RGwugGZfMRB43qPpEZQgebXePjs=; b=CjAL9137afA6XqTF4GPAvd1VRKFOExJNDM0eV55ftHHyI3fL38oQxYCpZX+DRRZkzTGYn+ 1ikKEYrHi/0qBIBBghYJ/e4JnVkNLN0kdV0jU8qYIIYQ0ce8hM5mPRqwfLmmUva3XTk1JW edG07kxwqIaSD5Cm94cmOS2yoTUI708= Received: by mail-lf1-f53.google.com with SMTP id 2adb3069b0e04-53e38838026so656511e87.3 for ; Mon, 27 Jan 2025 07:05:12 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1737990312; x=1738595112; darn=kvack.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=a99Cj+rOUzLKKfU2RGwugGZfMRB43qPpEZQgebXePjs=; b=MSWebol91C+ZKWgKf/iRVoxH7pP51MoGgPqr/AIEgYi7cudle554ahUYp8HkZZzcX6 cpzEZYGhaQjt6ZWE36UhCuOrHa1vRTMIPH5EXA6RztGiToscL+44KfCRGH+7GrOAI/G8 j0Y3kh4p5WAd82hcGyp+CFT9W07AFiqz3J93AAFSmKzQQa64MMTeHJ3yFzXZQsTarb4H EYphA+y8mClxRTg4DQxJBhMwfESYnv0mlkIec7A7rM9vGj8QnMUrABZAy9QH66fUE22q J9kam9B26446kaGlcciMmrycuCusVo0AFanxcely8CS6Z/Qr1ffkQnu0JNnHf6YG9464 Tw6g== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1737990312; x=1738595112; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=a99Cj+rOUzLKKfU2RGwugGZfMRB43qPpEZQgebXePjs=; b=GcGhINPg2o2++lbU5cqIikgi8ssOxSXMzBvuklsMNyrS9MlkzRomjculljpFK/cugK 5zoxvtobrpRMCekja+nCgHAcek21mGQq/NDqX2Ney25NOcnJ0vgdqZOYBOfF1b8TUQ2t HQUv1McdSqt/Fz6jyx3yarhI2PQyV4kYAaMJrZcSPCOpeMO6hZf0mElj0Czg9WTkoE6D lm4pF9DWB7/qBvBRnuhbRGsaLDvPFHJJppuHWJr7BQI5zRi3JgK5GGzellVJ0NLd0gTA F4pMhAm5G4ZwL064a0Jm0msaLjrggH1SeslPCFCeq61JWAzNMP7QymSum2rQKE5U3+4I OBag== X-Forwarded-Encrypted: i=1; AJvYcCVDgt858LxSLeXBFYjsNre4ozhqrbGQYNdmdQuwgX4WqrbTUHymnp+vJFTHz1JEKrwc4OOKRHkruw==@kvack.org X-Gm-Message-State: AOJu0YzU0JkaHrE3AXK2UVbCZfkhzmpJsUDN/ifLF7Y8/7nuutMP4OqW zSsHrHmb9XcxwdC6dlmpVU3FVx9CcUNapBCui++Xi5r1/NIQfx3d X-Gm-Gg: ASbGncsDnsNFsww2kqsVigp08A+Prd+SX2wTQbrm9lh2fz7SqC/adTWKECtwhKW/JYe qPnkEIF7DMf9oupfGWjVaOy3MMf6/I27EeW8iNlx62Hs9ntPWH/5UaaR5q9Qg9eNqafkEPWqJ7H ePnnAvOTL/j6tQXYuwYj7joZVXh8aS5EstCBCtTVdZX2bvcbx5PgXn8HJEgs9Kw20CLJtKzVdxI p+R3zgPR255VhqdCcTD051ew/5x1qP4uCAiC5UMWvrmSNyyunmX7BhVDblbSWC2PDxr1ln74Z5y anxKDiYQj9pGVNYMk7M8SdU1hJw= X-Google-Smtp-Source: AGHT+IHeIZIN8oQR3WZy6k1X7FnNxiCnPJubuJR42xuKYwGelkaQbvxKLzFF0Y0dYY2Ot+nJGIpTnA== X-Received: by 2002:ac2:4c4f:0:b0:542:297e:86c with SMTP id 2adb3069b0e04-543bb2ecf6emr3097051e87.0.1737990311100; Mon, 27 Jan 2025 07:05:11 -0800 (PST) Received: from dellarbn.yandex.net ([80.93.240.68]) by smtp.gmail.com with ESMTPSA id 2adb3069b0e04-543c83684c6sm1321436e87.107.2025.01.27.07.05.09 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 27 Jan 2025 07:05:10 -0800 (PST) From: Andrey Ryabinin To: Andrew Morton Cc: kasan-dev@googlegroups.com, io-uring@vger.kernel.org, linux-mm@kvack.org, netdev@vger.kernel.org, linux-kernel@vger.kernel.org, juntong.deng@outlook.com, lizetao1@huawei.com, Andrey Ryabinin , stable@vger.kernel.org, Alexander Potapenko , Andrey Konovalov , Dmitry Vyukov , Vincenzo Frascino , Jens Axboe , Pavel Begunkov , "David S. Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Simon Horman Subject: [PATCH v2] kasan, mempool: don't store free stacktrace in io_alloc_cache objects. Date: Mon, 27 Jan 2025 16:03:57 +0100 Message-ID: <20250127150357.13565-1-ryabinin.a.a@gmail.com> X-Mailer: git-send-email 2.45.3 In-Reply-To: <20250122160645.28926-1-ryabinin.a.a@gmail.com> References: <20250122160645.28926-1-ryabinin.a.a@gmail.com> MIME-Version: 1.0 X-Rspam-User: X-Rspamd-Queue-Id: 6145840014 X-Rspamd-Server: rspam10 X-Stat-Signature: k3ni9rjh6dm8x1jzm7dwham9s7m15w8t X-HE-Tag: 1737990313-712174 X-HE-Meta: U2FsdGVkX18g8pOMXALYEokWBRofv8jboGBo21Y99955TSzS9fL4E0I/43herhko9ng2vUPxT63Q0xGpKYtpD8kbwI7962+6wKkPNBJwQ2qIvZ0vN0jMeg7ZEkxZ5HJ4dTToj9Lp7Nad6dNsz7Hz8wXNjanJtSmTyEugHzlOKbQp9JX1ys61gkmiEQL/lgYzjPMw1NdKaKkpT8FkGP5Khsitxc9nPQAaEX9R9+mfHNfcKJfPZ1wPJs/WZuuUUc3YDuQdKqZOHKR7hc6KDJ4JNLfe0+WVS6JpbXbGmmaN/ScP/t5UcGjeBuJdIu718pNCh7vt9nYqnPOeqpug4TX5u3ZjkXl8XOVDNklnNcAWl+6DE2WhDGt0aaIAyKFOHAQ/EQdzjoYg+/IdfYl8NTFtnC4+EaFsLdswg/8MV6Jtyiayrc0zYG3Kb6aujZbASvEDaRnQdXp0iCd+8tVpOffHmDEKoIyiql1Epi0alQszvHZt62LsSelJDqEPjLbO95z2WI2F+qbYB/+yszn12HEnPXG3vVMRBq/GBfx0tmdcLveLtu8wEIR40a12oQbUFAAb6rMF/8hQeSWQJUxIIg5uPM0/77xIIbiIlRC4eHIFhJ8FmVnAwo1fAenWjsgZaGrEbgWk/H7kux/3dFZVxFKNnl9W/K0rtKFlE0BKbm6zZrV2qOMQua+xfct2tOZa8naKJv/L9rK/Px8D1wjhadLduTqyNii/QXB3uoeq3f2nreLiYqDNPIU+NNvusLFihtaA347YjreKEoL4s7b+Bq3Wc1r7rdCAi7UzcgExorkDaC3bKp86cugzxsmVrjbgq5QzWy9cLKHdYWBZIBVh43H7J+mmHCGZXP5Nt9OZgn/O285/doQTrGijnDl0rtXXiV9GVlxyZoxzbhKNpm6OGKX9uoGXCBXZUoF55dY2+lfb7FgFn35fF0OGdXfRyV/dMRnDszpEQCiZ7sDR1owL0fy 1O+XX/Lk kd6J1UBIKgNxiwJvFFpEXTcJlRJqkzTn3rLn0Nj6Jx8QejSxGe0vStd9shI9TN7lPn/AmeYsijsSZSxUZ+WINaxgWK6g4QUSzYDw2QMRTJctofvRoPe50a2B4iJ3JWcio3Xf/4jQYB21cNp3oCKHWJrL+DVZOSZJNf/19/l7SI3ASYVZNYDsEg0nwyXTxsaCQ+z6U14bCDTd7WiSB1+3gihC3ZQu0wrjDwN1yj+yKsc0UXh4N7v4tF7gO+OsCsYPTknLQFwyt8KCBvq64D1X5eW3NQf1SqV8DqzIRd8RjJm37XlzSLjXsSKf+PCzROcKBpzZsMkWAVEFOVduOclF0vahbJPJ7vUuBKcAp3L9QAUPYD0lXfB5sSSf0OBz3OkbULPKdeZuNXkqE/iMAA0+Xj3PS0TyvKsBGaBtR/MP2sn6drRBWiDItRtHRcT0vO5NcN4sw1JYK9woB0Y60TjDdMdgD/EmRc3HLd0nCfUsJ7f3zqzdv8dQKDpYQyaw8sMmt+gzLHn8Z/YRhf5qRNIF8JdV3MMCuNgZddI+C90wOUjFFBILYo0ZqwoSVI1Ux5udxMHNrGGR9tTj59Xf0qUl+W3wvS5T/9n8VAYlJE8OQd2/6jryMcX/U7tjxhiarSYTvoLzTXQP764Y0omF7OulDIGtIG7vpCq2ty06RvyDewTnjj4IoKEbgIj1ts6gCnzzzkhanVqABo7aCpsaiX83BfMkU58NznzAKOEdnsM8GQ3UB05c= X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: List-Subscribe: List-Unsubscribe: Running the testcase liburing/accept-reust.t with CONFIG_KASAN=y and CONFIG_KASAN_EXTRA_INFO=y leads to the following crash: Unable to handle kernel paging request at virtual address 00000c6455008008 ... pc : __kasan_mempool_unpoison_object+0x38/0x170 lr : io_netmsg_cache_free+0x8c/0x180 ... Call trace: __kasan_mempool_unpoison_object+0x38/0x170 (P) io_netmsg_cache_free+0x8c/0x180 io_ring_exit_work+0xd4c/0x13a0 process_one_work+0x52c/0x1000 worker_thread+0x830/0xdc0 kthread+0x2bc/0x348 ret_from_fork+0x10/0x20 Since the commit b556a462eb8d ("kasan: save free stack traces for slab mempools") kasan_mempool_poison_object() stores some info inside an object. It was expected that the object must be reinitialized after kasan_mempool_unpoison_object() call, and this is what happens in the most of use cases. However io_uring code expects that io_alloc_cache_put/get doesn't modify the object, so kasan_mempool_poison_object() end up corrupting it leading to crash later. Add @notrack argument to kasan_mempool_poison_object() call to tell KASAN to avoid storing info in objects for io_uring use case. Reported-by: lizetao Closes: https://lkml.kernel.org/r/ec2a6ca08c614c10853fbb1270296ac4@huawei.com Fixes: b556a462eb8d ("kasan: save free stack traces for slab mempools") Cc: stable@vger.kernel.org Cc: Alexander Potapenko Cc: Andrey Konovalov Cc: Dmitry Vyukov Cc: Vincenzo Frascino Cc: Jens Axboe Cc: Pavel Begunkov Cc: "David S. Miller" Cc: Eric Dumazet Cc: Jakub Kicinski Cc: Paolo Abeni Cc: Simon Horman Signed-off-by: Andrey Ryabinin Reviewed-by: Andrey Konovalov --- - Changes since v1: s/true/false @notrack in __kasan_slab_free() per @andreyknvl include/linux/kasan.h | 13 +++++++------ io_uring/alloc_cache.h | 2 +- io_uring/net.c | 2 +- io_uring/rw.c | 2 +- mm/kasan/common.c | 11 ++++++----- mm/mempool.c | 2 +- net/core/skbuff.c | 2 +- 7 files changed, 18 insertions(+), 16 deletions(-) diff --git a/include/linux/kasan.h b/include/linux/kasan.h index 890011071f2b..4d0bf4af399d 100644 --- a/include/linux/kasan.h +++ b/include/linux/kasan.h @@ -328,18 +328,19 @@ static __always_inline void kasan_mempool_unpoison_pages(struct page *page, __kasan_mempool_unpoison_pages(page, order, _RET_IP_); } -bool __kasan_mempool_poison_object(void *ptr, unsigned long ip); +bool __kasan_mempool_poison_object(void *ptr, bool notrack, unsigned long ip); /** * kasan_mempool_poison_object - Check and poison a mempool slab allocation. * @ptr: Pointer to the slab allocation. + * @notrack: Don't record stack trace of this call in the object. * * This function is intended for kernel subsystems that cache slab allocations * to reuse them instead of freeing them back to the slab allocator (e.g. * mempool). * * This function poisons a slab allocation and saves a free stack trace for it - * without initializing the allocation's memory and without putting it into the - * quarantine (for the Generic mode). + * (if @notrack == false) without initializing the allocation's memory and + * without putting it into the quarantine (for the Generic mode). * * This function also performs checks to detect double-free and invalid-free * bugs and reports them. The caller can use the return value of this function @@ -354,10 +355,10 @@ bool __kasan_mempool_poison_object(void *ptr, unsigned long ip); * * Return: true if the allocation can be safely reused; false otherwise. */ -static __always_inline bool kasan_mempool_poison_object(void *ptr) +static __always_inline bool kasan_mempool_poison_object(void *ptr, bool notrack) { if (kasan_enabled()) - return __kasan_mempool_poison_object(ptr, _RET_IP_); + return __kasan_mempool_poison_object(ptr, notrack, _RET_IP_); return true; } @@ -456,7 +457,7 @@ static inline bool kasan_mempool_poison_pages(struct page *page, unsigned int or return true; } static inline void kasan_mempool_unpoison_pages(struct page *page, unsigned int order) {} -static inline bool kasan_mempool_poison_object(void *ptr) +static inline bool kasan_mempool_poison_object(void *ptr, bool notrack) { return true; } diff --git a/io_uring/alloc_cache.h b/io_uring/alloc_cache.h index a3a8cfec32ce..dd508dddea33 100644 --- a/io_uring/alloc_cache.h +++ b/io_uring/alloc_cache.h @@ -10,7 +10,7 @@ static inline bool io_alloc_cache_put(struct io_alloc_cache *cache, void *entry) { if (cache->nr_cached < cache->max_cached) { - if (!kasan_mempool_poison_object(entry)) + if (!kasan_mempool_poison_object(entry, true)) return false; cache->entries[cache->nr_cached++] = entry; return true; diff --git a/io_uring/net.c b/io_uring/net.c index 85f55fbc25c9..a954e37c7fd3 100644 --- a/io_uring/net.c +++ b/io_uring/net.c @@ -149,7 +149,7 @@ static void io_netmsg_recycle(struct io_kiocb *req, unsigned int issue_flags) iov = hdr->free_iov; if (io_alloc_cache_put(&req->ctx->netmsg_cache, hdr)) { if (iov) - kasan_mempool_poison_object(iov); + kasan_mempool_poison_object(iov, true); req->async_data = NULL; req->flags &= ~REQ_F_ASYNC_DATA; } diff --git a/io_uring/rw.c b/io_uring/rw.c index a9a2733be842..cba475003ba7 100644 --- a/io_uring/rw.c +++ b/io_uring/rw.c @@ -167,7 +167,7 @@ static void io_rw_recycle(struct io_kiocb *req, unsigned int issue_flags) iov = rw->free_iovec; if (io_alloc_cache_put(&req->ctx->rw_cache, rw)) { if (iov) - kasan_mempool_poison_object(iov); + kasan_mempool_poison_object(iov, true); req->async_data = NULL; req->flags &= ~REQ_F_ASYNC_DATA; } diff --git a/mm/kasan/common.c b/mm/kasan/common.c index ed4873e18c75..f08752dcd50b 100644 --- a/mm/kasan/common.c +++ b/mm/kasan/common.c @@ -230,7 +230,8 @@ static bool check_slab_allocation(struct kmem_cache *cache, void *object, } static inline void poison_slab_object(struct kmem_cache *cache, void *object, - bool init, bool still_accessible) + bool init, bool still_accessible, + bool notrack) { void *tagged_object = object; @@ -243,7 +244,7 @@ static inline void poison_slab_object(struct kmem_cache *cache, void *object, kasan_poison(object, round_up(cache->object_size, KASAN_GRANULE_SIZE), KASAN_SLAB_FREE, init); - if (kasan_stack_collection_enabled()) + if (kasan_stack_collection_enabled() && !notrack) kasan_save_free_info(cache, tagged_object); } @@ -261,7 +262,7 @@ bool __kasan_slab_free(struct kmem_cache *cache, void *object, bool init, if (!kasan_arch_is_ready() || is_kfence_address(object)) return false; - poison_slab_object(cache, object, init, still_accessible); + poison_slab_object(cache, object, init, still_accessible, false); /* * If the object is put into quarantine, do not let slab put the object @@ -495,7 +496,7 @@ void __kasan_mempool_unpoison_pages(struct page *page, unsigned int order, __kasan_unpoison_pages(page, order, false); } -bool __kasan_mempool_poison_object(void *ptr, unsigned long ip) +bool __kasan_mempool_poison_object(void *ptr, bool notrack, unsigned long ip) { struct folio *folio = virt_to_folio(ptr); struct slab *slab; @@ -519,7 +520,7 @@ bool __kasan_mempool_poison_object(void *ptr, unsigned long ip) if (check_slab_allocation(slab->slab_cache, ptr, ip)) return false; - poison_slab_object(slab->slab_cache, ptr, false, false); + poison_slab_object(slab->slab_cache, ptr, false, false, notrack); return true; } diff --git a/mm/mempool.c b/mm/mempool.c index 3223337135d0..283df5d2b995 100644 --- a/mm/mempool.c +++ b/mm/mempool.c @@ -115,7 +115,7 @@ static inline void poison_element(mempool_t *pool, void *element) static __always_inline bool kasan_poison_element(mempool_t *pool, void *element) { if (pool->alloc == mempool_alloc_slab || pool->alloc == mempool_kmalloc) - return kasan_mempool_poison_object(element); + return kasan_mempool_poison_object(element, false); else if (pool->alloc == mempool_alloc_pages) return kasan_mempool_poison_pages(element, (unsigned long)pool->pool_data); diff --git a/net/core/skbuff.c b/net/core/skbuff.c index a441613a1e6c..c9f58a698bb7 100644 --- a/net/core/skbuff.c +++ b/net/core/skbuff.c @@ -1457,7 +1457,7 @@ static void napi_skb_cache_put(struct sk_buff *skb) struct napi_alloc_cache *nc = this_cpu_ptr(&napi_alloc_cache); u32 i; - if (!kasan_mempool_poison_object(skb)) + if (!kasan_mempool_poison_object(skb, false)) return; local_lock_nested_bh(&napi_alloc_cache.bh_lock);