From patchwork Mon Jan 4 13:07:49 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Marco Elver X-Patchwork-Id: 11996715 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-16.6 required=3.0 tests=BAYES_00, DKIM_ADSP_CUSTOM_MED,DKIM_INVALID,DKIM_SIGNED,HEADER_FROM_DIFFERENT_DOMAINS, INCLUDES_CR_TRAILER,INCLUDES_PATCH,MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS, URIBL_BLOCKED,USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 385FFC433E0 for ; Mon, 4 Jan 2021 13:08:46 +0000 (UTC) Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by mail.kernel.org (Postfix) with ESMTP id A658C221E5 for ; Mon, 4 Jan 2021 13:08:45 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org A658C221E5 Authentication-Results: mail.kernel.org; dmarc=fail (p=reject dis=none) header.from=google.com Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=owner-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix) id D250F6B009C; Mon, 4 Jan 2021 08:08:44 -0500 (EST) Received: by kanga.kvack.org (Postfix, from userid 40) id CFBBA6B009F; Mon, 4 Jan 2021 08:08:44 -0500 (EST) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id BEAE46B00A1; Mon, 4 Jan 2021 08:08:44 -0500 (EST) X-Delivered-To: linux-mm@kvack.org Received: from forelay.hostedemail.com (smtprelay0138.hostedemail.com [216.40.44.138]) by kanga.kvack.org (Postfix) with ESMTP id AA35C6B009C for ; Mon, 4 Jan 2021 08:08:44 -0500 (EST) Received: from smtpin08.hostedemail.com (10.5.19.251.rfc1918.com [10.5.19.251]) by forelay04.hostedemail.com (Postfix) with ESMTP id 6F1011EE6 for ; Mon, 4 Jan 2021 13:08:44 +0000 (UTC) X-FDA: 77668122168.08.art99_0806105274d0 Received: from filter.hostedemail.com (10.5.16.251.rfc1918.com [10.5.16.251]) by smtpin08.hostedemail.com (Postfix) with ESMTP id 54D471819E772 for ; Mon, 4 Jan 2021 13:08:44 +0000 (UTC) X-HE-Tag: art99_0806105274d0 X-Filterd-Recvd-Size: 5804 Received: from mail-wm1-f74.google.com (mail-wm1-f74.google.com [209.85.128.74]) by imf08.hostedemail.com (Postfix) with ESMTP for ; Mon, 4 Jan 2021 13:08:43 +0000 (UTC) Received: by mail-wm1-f74.google.com with SMTP id f187so10563166wme.3 for ; Mon, 04 Jan 2021 05:08:43 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=sender:date:message-id:mime-version:subject:from:to:cc; bh=4L00xbr85BzSZDrQcVSi8abHo1VhpZjBCyy/C5zqGwE=; b=nH8T7gQCERdM9wRKWX4DEAqrp0kptl5k5BnEQzdeMjx7oO0rXj/NE+cZSF/mCPc0pm zP6bmbTpvSQv2KbJuWGSmH9z+iwcDcJ6FEDYFFAx+JO/982XbnoOzT8SXid50w1xtj4m TNaAol/5IOv2oyce8VJ4Dj6Z01z+YifW0eT4r+aPP6N2v8WbghgIJO8qxIxGTD1wjcWh sOZufFgCoxqZT9jC8vXPJQh7gBq2Cg2c1styvvRkGBZzJT4+c3WQdnxjN+qdFvBKuzqU XGFGYYXQaTLR6oOSYr6h38nrRfpxdE/0nD87NpMYlvADYGHz7R2HlugfFomf8ehhqDYr 8hYg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:sender:date:message-id:mime-version:subject:from :to:cc; bh=4L00xbr85BzSZDrQcVSi8abHo1VhpZjBCyy/C5zqGwE=; b=twq2Rw9cT2i4a2Jw35ZBVE02FOkFahVWM9j9HlqImLnsokHY38HF6rbs0ooMJts2gw 20gJ0AQ4VET9pM4wkq2+oxgO2Sdia0lZwgs97hlBtwHK4awK7IF4filSJrp60Mo/HYw6 6j22b0cU2o5eBCsXsO+pqyCfC7dFI+zQIJXXBU19GSn89y6oRrjZdt/rOj7FNDS+63j+ 2G7WPX4HUFSQ1l47vhHTkNnAbLj67xBq8Sh2AHJMzMW9opjcF0rBjTf3HL5WWpH8LOh1 qNcuodSykCKXoqP+mOgOzzV+tgTNwe59ADQiCh/IbLwaOufNnJ4zjSpuKSYlGPqpjjTa VFXQ== X-Gm-Message-State: AOAM533GWjXLFPgGv8URvVh85zyF7IBY1xG61MuQ6iN9IbvtcwZs/Bv7 qhabncPftg6zChiMONWb13bCdxJVWg== X-Google-Smtp-Source: ABdhPJwxp4QH8WQfBjJFX4ZDH9oYpUgEvBSxgpJLt62QKw9i4luO/TOxsk2Q7b93KQIs+K8QDf5eAsvS0Q== X-Received: from elver.muc.corp.google.com ([2a00:79e0:15:13:f693:9fff:fef4:2449]) (user=elver job=sendgmr) by 2002:a5d:69c2:: with SMTP id s2mr78387688wrw.36.1609765722195; Mon, 04 Jan 2021 05:08:42 -0800 (PST) Date: Mon, 4 Jan 2021 14:07:49 +0100 Message-Id: <20210104130749.1768991-1-elver@google.com> Mime-Version: 1.0 X-Mailer: git-send-email 2.29.2.729.g45daf8777d-goog Subject: [PATCH mm] kfence: fix potential deadlock due to wake_up() From: Marco Elver To: elver@google.com, akpm@linux-foundation.org Cc: glider@google.com, dvyukov@google.com, jannh@google.com, mark.rutland@arm.com, linux-kernel@vger.kernel.org, linux-mm@kvack.org, kasan-dev@googlegroups.com, syzbot+8983d6d4f7df556be565@syzkaller.appspotmail.com, Hillf Danton X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: Lockdep reports that we may deadlock when calling wake_up() in __kfence_alloc(), because we may already hold base->lock. This can happen if debug objects are enabled: ... __kfence_alloc+0xa0/0xbc0 mm/kfence/core.c:710 kfence_alloc include/linux/kfence.h:108 [inline] ... kmem_cache_zalloc include/linux/slab.h:672 [inline] fill_pool+0x264/0x5c0 lib/debugobjects.c:171 __debug_object_init+0x7a/0xd10 lib/debugobjects.c:560 debug_object_init lib/debugobjects.c:615 [inline] debug_object_activate+0x32c/0x3e0 lib/debugobjects.c:701 debug_timer_activate kernel/time/timer.c:727 [inline] __mod_timer+0x77d/0xe30 kernel/time/timer.c:1048 ... Therefore, switch to an open-coded wait loop. The difference to before is that the waiter wakes up and rechecks the condition after 1 jiffy; however, given the infrequency of kfence allocations, the difference is insignificant. Link: https://lkml.kernel.org/r/000000000000c0645805b7f982e4@google.com Reported-by: syzbot+8983d6d4f7df556be565@syzkaller.appspotmail.com Suggested-by: Hillf Danton Signed-off-by: Marco Elver --- mm/kfence/core.c | 15 ++++++++++----- 1 file changed, 10 insertions(+), 5 deletions(-) diff --git a/mm/kfence/core.c b/mm/kfence/core.c index 933b197b8634..f0816d5f5913 100644 --- a/mm/kfence/core.c +++ b/mm/kfence/core.c @@ -94,9 +94,6 @@ DEFINE_STATIC_KEY_FALSE(kfence_allocation_key); /* Gates the allocation, ensuring only one succeeds in a given period. */ static atomic_t allocation_gate = ATOMIC_INIT(1); -/* Wait queue to wake up allocation-gate timer task. */ -static DECLARE_WAIT_QUEUE_HEAD(allocation_wait); - /* Statistics counters for debugfs. */ enum kfence_counter_id { KFENCE_COUNTER_ALLOCATED, @@ -586,6 +583,8 @@ late_initcall(kfence_debugfs_init); static struct delayed_work kfence_timer; static void toggle_allocation_gate(struct work_struct *work) { + unsigned long end_wait; + if (!READ_ONCE(kfence_enabled)) return; @@ -596,7 +595,14 @@ static void toggle_allocation_gate(struct work_struct *work) * Await an allocation. Timeout after 1 second, in case the kernel stops * doing allocations, to avoid stalling this worker task for too long. */ - wait_event_timeout(allocation_wait, atomic_read(&allocation_gate) != 0, HZ); + end_wait = jiffies + HZ; + do { + set_current_state(TASK_UNINTERRUPTIBLE); + if (atomic_read(&allocation_gate) != 0) + break; + schedule_timeout(1); + } while (time_before(jiffies, end_wait)); + __set_current_state(TASK_RUNNING); /* Disable static key and reset timer. */ static_branch_disable(&kfence_allocation_key); @@ -707,7 +713,6 @@ void *__kfence_alloc(struct kmem_cache *s, size_t size, gfp_t flags) */ if (atomic_read(&allocation_gate) || atomic_inc_return(&allocation_gate) > 1) return NULL; - wake_up(&allocation_wait); if (!READ_ONCE(kfence_enabled)) return NULL;