From patchwork Wed Jan 22 16:06:45 2025 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Andrey Ryabinin X-Patchwork-Id: 13947479 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id 3A2F7C02181 for ; Wed, 22 Jan 2025 16:08:06 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id AD2E96B0083; Wed, 22 Jan 2025 11:08:05 -0500 (EST) Received: by kanga.kvack.org (Postfix, from userid 40) id A83376B0085; Wed, 22 Jan 2025 11:08:05 -0500 (EST) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 923B16B0088; Wed, 22 Jan 2025 11:08:05 -0500 (EST) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0016.hostedemail.com [216.40.44.16]) by kanga.kvack.org (Postfix) with ESMTP id 744C56B0083 for ; Wed, 22 Jan 2025 11:08:05 -0500 (EST) Received: from smtpin16.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay08.hostedemail.com (Postfix) with ESMTP id 65D30140418 for ; Wed, 22 Jan 2025 16:08:00 +0000 (UTC) X-FDA: 83035569120.16.3068F0E Received: from mail-lf1-f46.google.com (mail-lf1-f46.google.com [209.85.167.46]) by imf05.hostedemail.com (Postfix) with ESMTP id 3C93810000D for ; Wed, 22 Jan 2025 16:07:57 +0000 (UTC) Authentication-Results: imf05.hostedemail.com; dkim=pass header.d=gmail.com header.s=20230601 header.b=G1BmwebU; spf=pass (imf05.hostedemail.com: domain of ryabinin.a.a@gmail.com designates 209.85.167.46 as permitted sender) smtp.mailfrom=ryabinin.a.a@gmail.com; dmarc=pass (policy=none) header.from=gmail.com ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1737562078; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references:dkim-signature; bh=+BA0Dq1q60oIyJKUAlr4eKLYkxcKes1Z2J5zA+l+Dug=; b=PutkSA9bQx8jubSPj2c8LZGpdBWgkufA0/0bq8OCi4RMFM2ALUL+MAEudQhoUpMZDoBEco OKPPbKnB/EZwqOblOkGJYLc3esKkNKWNG3kub5EE0td9Sl7tPdorCQQ5zQwYLL2DbSViLW 7lS6Dle0o6hRy1cJRBDdZesiG+6aQXU= ARC-Authentication-Results: i=1; imf05.hostedemail.com; dkim=pass header.d=gmail.com header.s=20230601 header.b=G1BmwebU; spf=pass (imf05.hostedemail.com: domain of ryabinin.a.a@gmail.com designates 209.85.167.46 as permitted sender) smtp.mailfrom=ryabinin.a.a@gmail.com; dmarc=pass (policy=none) header.from=gmail.com ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1737562078; a=rsa-sha256; cv=none; b=QuhbXiklaT+brv3f80uwB9+DziMxXGeLwhWNKbRTflMU1CkPIY+pTIaL+iTGKye8jhLooJ KnVv4THJOAiSsH4WyXBUPKRrazaETyJtmTvOu2kPHYVo8pN0OmMOfCN7kRONmm7idvOdDq WusV4dNDN4JNNxBlov6xe4oFyq5/cAU= Received: by mail-lf1-f46.google.com with SMTP id 2adb3069b0e04-54019dfd6f1so977577e87.0 for ; Wed, 22 Jan 2025 08:07:57 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1737562076; x=1738166876; darn=kvack.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=+BA0Dq1q60oIyJKUAlr4eKLYkxcKes1Z2J5zA+l+Dug=; b=G1BmwebUeJWm78CSIhIYSuLdNITYc2wpwHrwFzl4T9WYN9/yoTQLHjNx9gWYhV2JKM ZbJY5szFF61cNqJVcuAeMPhfzhS6/ltQCB8w2kp1L5y2yylPwoUO9JsH2w+3+DVrU4B8 O2BKEpoR4DlBSuiSEKemtuNMq1Bjmg4hicTbS6srSszN2vdLw/pEiYZx2CkK6dDLl73L 5Z0S4W+YfkYIQhWP2ub5kDL9ZIx+m2dkjZkzNUVz1jhjHdx/t8vWLh/sF9dNtXcReTQ7 DrXGvauTpWZr30xBmxhv+583My62PHC8fCbrje7RWGSlTnIe/SN+yHqyShcAYyrbiLhN J3sg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1737562076; x=1738166876; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=+BA0Dq1q60oIyJKUAlr4eKLYkxcKes1Z2J5zA+l+Dug=; b=E4Lc/O+AGZOZseM3ymdQ7D0eBP2A1UhmgivO6MwqBhA4f65Ayec5NsMcTnV+b4cBQ+ dl+nYKmAkXZB0H+Wii/WRlYXNTnSAdxGzh2QbQOQAHxR8fiFnHPr5nlP00w1XvjautEu C3gX4v13a23HfOfaV193ILz+CLEoG9sunu1B3H3wPo7Kl33wc0yu0W8EvN+c06Zj1PMx KpqUM3pbnuzw+OcIQGnLVnCVOLSvc6f9RdFv9Mtly4Mp3k229idDXwk8Wp3YcPSO4afS U0yebtYff/daYN0fNT+hMYBISasVzpbzLc0941biLV2FcyT25NXykHUgRVtDEhFda7mk KLfw== X-Forwarded-Encrypted: i=1; AJvYcCXZZ0wARQbvqebVlTDTzXNcsdbpUhoXA0YsRT7t3E5weuo1lJMP8aNsK9bOwdT3zeIlBW32bVOSng==@kvack.org X-Gm-Message-State: AOJu0YzWvNUzuIdziOEtieD2Op1WSLToo7Juycok8QoyzS9tkU0riJnP rfaKouiibzGZYWXSSZdnAUohF+tHG002DX9wIziptDtW5rrpM/15 X-Gm-Gg: ASbGncudCVTZ68yQE6Z7hzJmh6CiC9H/BOLpGGTuKg8xe4zyIQEdy4k8iVv8DbdPyfI Dds5f7JaMVfRCrp5aNyiY0u5u15cW9s3xuhprgjUM3rw46AMDYfv0QkiqCEqtACyyyygiMrI24Z +rf1DFIHmGRNib6f/laQypOE5lrVPdUHerOFvn7boLxNaq+rtS3qyGEDyYO/H37StLeJoQ9MGtt 5Fcoi/D2N4ku4R/mLIQf6L78ooFK/YTBloMTJUfViCDn/Ur+Bm23pkiTBM6KieZ8dyBm24qQBRX W1EPfA== X-Google-Smtp-Source: AGHT+IGGZpwAJ9lJiPJhXSzYlw+p5ZWyX/qDwlwfOEADUtFjFGOfxHiDxPvmkO/tSicDPCzuqDTAGw== X-Received: by 2002:a05:6512:32c9:b0:542:9807:97b3 with SMTP id 2adb3069b0e04-543bb342b23mr680624e87.4.1737562075993; Wed, 22 Jan 2025 08:07:55 -0800 (PST) Received: from dellarbn.yandex.net ([80.93.240.67]) by smtp.gmail.com with ESMTPSA id 2adb3069b0e04-5439af60c4esm2327409e87.128.2025.01.22.08.07.54 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 22 Jan 2025 08:07:55 -0800 (PST) From: Andrey Ryabinin To: Andrew Morton Cc: kasan-dev@googlegroups.com, io-uring@vger.kernel.org, linux-mm@kvack.org, netdev@vger.kernel.org, linux-kernel@vger.kernel.org, juntong.deng@outlook.com, lizetao1@huawei.com, Andrey Ryabinin , stable@vger.kernel.org, Alexander Potapenko , Andrey Konovalov , Dmitry Vyukov , Vincenzo Frascino , Jens Axboe , Pavel Begunkov , "David S. Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Simon Horman Subject: [PATCH] kasan, mempool: don't store free stacktrace in io_alloc_cache objects. Date: Wed, 22 Jan 2025 17:06:45 +0100 Message-ID: <20250122160645.28926-1-ryabinin.a.a@gmail.com> X-Mailer: git-send-email 2.45.3 In-Reply-To: References: MIME-Version: 1.0 X-Rspamd-Server: rspam05 X-Rspamd-Queue-Id: 3C93810000D X-Stat-Signature: f8nzhowd8mgs9ojmyud1hzx8sgogpb1i X-Rspam-User: X-HE-Tag: 1737562077-289052 X-HE-Meta: U2FsdGVkX18a+Sq6fZr540sIUtOGUyi11kkHKVHb4mdWWnek+k9cZWIeF5LOA86xEYpxxa4cnTfhgqSElc/5i0K834AVOgJjaS/Yjf1VY7idEcb2ycL0a9q+PLo1Q+eAgEhq0jMA9xiGXkKpt6EpILrDIV0oWizPhPSdMZvZZN4ReZYvMbAlTBrTBjm3xhpz0VueR4hRSjZQpb+H4KSNLexnfNc2miGFZEkmcv65wMe46vPPLKdDi7Qlh7s+V9CrIMlWi2hiwzeYlqbBpSgVbrqnaNUVCezMOP9pv+E8r6ZGS0rU+TM97gOMwjVWlj2VhczPV7aDT7GMIQ87aAIiBsA3bRRuEOQhYSP5ihE7xK+dIDUydJbX3AaaC+FMIDZhGmuGEtqLkFs/GeiSgo4+sEifUhpZXuoWnKDNcxxLA7FZKjmtjmRtxlBTGDFc8QsPCuV3X9bonucavl9TjeaqhwIegPO9h9JTgs7Fqnf4q43GqJT3RfJi62TnTtRrMWTZF7z+q0WVBHfaRPk5LW+sCM6qzVV/OMtvT6DyEjDUp1w6bSU+LQ7zGyWYC7Q4f1x80IPnVfP7jfesDGLp0KC2Tyf6lpqHHA3aorng6EGwYZI6cSxqxx+BUJv0+ZrEDAM1jHuyhrX33XkP+TFgNZZAS2QLT/JC3xlHJcMNyihEbsU5fLoPOVD+qqaUUTHro+u2MI9U72j/Bhe2+Gb94PvtJUq75yaQZrvU4XyIpGJvJdjz2pvkhnBFNST45ts4ClZB/g6BFSFUzzUY/r9z9u+Lov9w8wzvD9cJ6U2X2NibxfxrcUs/GQrq9tngyRv0Jmfk62ujscKEjFcclNhFaJ2uCpBR7A48MFKONur3j48vvNHRDBca/BlZkpKouwoEJT+ErxY4MthiomEZoxufAvVjZV6oPQKFXYvuArXAsMaGj+UgJcoenIYlqKTketndo5/Nt8aQwrvEA4kfnRdFW+T B/f7cMfU a3HczagnCkQzsBGyufFZcsDI1LuCgvJlFm/CzrbRBJOCWC2LTdIgZBeC+K02cdbMEX8cc/p8tFclXkD6oIFLm2n7tQ2PCramP0vTh+SIUyc7IDYxaiI6GCcfQf7/RkHIudRfkTDoIchQ5bRUSQNc6WFRaU51fc59DUMuk0q0hNYkPzBuTtFGgFMRzLpoNXC7v/hO/l9YF0apIQJYzOPr1E5Xo0fSXj0G82YlyFgACA4dcjDAMNeMZp2qkDhFZabCkJzRPEmlsacT1G4cpxJhpzByND40oiWG6byuv38lZJHHlblo6VxPuKRChZtIarTuehcWieyuNotnel2bGGnKWGZeYRG45fJ9njkqlWl2/Gv+a1bTXujQno0rwJVt5CRzqHEZWlJSJSm8zGwj4edIO1a3pHyAIwWsNVfBlAwZYpQuSsbn/9e7yDFsnsZSudgc5ldLUBswLwYdjshrdSm+IVf8vo/7Hw6S8uAY5GPehH2+oh9PPUvBx488lLeQusX0jOoBEBxy3Glk1cvh7DL8up+jjGQNOmI6Ee80Y7e3Kz1A92QvlTArhaInwM5W/ILUPkKC6J2xHZoOhj+3fQ4LSkUyeMjQ0ojv3IU+lgex8T42Ihysdlp2iGDCbceDxWeEHCTAYppAuZt7MXiU0fFAu73WfnztUcEXt3nh975bc48GxRfA7GqYcDsJwpsn+MhTZ8B4lMEKbAV8lfuASVi6T23TUrix1FZaW2NaLgseUqbxULIg= X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: List-Subscribe: List-Unsubscribe: Running the testcase liburing/accept-reust.t with CONFIG_KASAN=y and CONFIG_KASAN_EXTRA_INFO=y leads to the following crash: Unable to handle kernel paging request at virtual address 00000c6455008008 ... pc : __kasan_mempool_unpoison_object+0x38/0x170 lr : io_netmsg_cache_free+0x8c/0x180 ... Call trace: __kasan_mempool_unpoison_object+0x38/0x170 (P) io_netmsg_cache_free+0x8c/0x180 io_ring_exit_work+0xd4c/0x13a0 process_one_work+0x52c/0x1000 worker_thread+0x830/0xdc0 kthread+0x2bc/0x348 ret_from_fork+0x10/0x20 Since the commit b556a462eb8d ("kasan: save free stack traces for slab mempools") kasan_mempool_poison_object() stores some info inside an object. It was expected that the object must be reinitialized after kasan_mempool_unpoison_object() call, and this is what happens in the most of use cases. However io_uring code expects that io_alloc_cache_put/get doesn't modify the object, so kasan_mempool_poison_object() end up corrupting it leading to crash later. Add @notrack argument to kasan_mempool_poison_object() call to tell KASAN to avoid storing info in objects for io_uring use case. Reported-by: lizetao Closes: https://lkml.kernel.org/r/ec2a6ca08c614c10853fbb1270296ac4@huawei.com Fixes: b556a462eb8d ("kasan: save free stack traces for slab mempools") Cc: stable@vger.kernel.org Cc: Alexander Potapenko Cc: Andrey Konovalov Cc: Dmitry Vyukov Cc: Vincenzo Frascino Cc: Jens Axboe Cc: Pavel Begunkov Cc: "David S. Miller" Cc: Eric Dumazet Cc: Jakub Kicinski Cc: Paolo Abeni Cc: Simon Horman Signed-off-by: Andrey Ryabinin --- include/linux/kasan.h | 13 +++++++------ io_uring/alloc_cache.h | 2 +- io_uring/net.c | 2 +- io_uring/rw.c | 2 +- mm/kasan/common.c | 11 ++++++----- mm/mempool.c | 2 +- net/core/skbuff.c | 2 +- 7 files changed, 18 insertions(+), 16 deletions(-) diff --git a/include/linux/kasan.h b/include/linux/kasan.h index 890011071f2b..4d0bf4af399d 100644 --- a/include/linux/kasan.h +++ b/include/linux/kasan.h @@ -328,18 +328,19 @@ static __always_inline void kasan_mempool_unpoison_pages(struct page *page, __kasan_mempool_unpoison_pages(page, order, _RET_IP_); } -bool __kasan_mempool_poison_object(void *ptr, unsigned long ip); +bool __kasan_mempool_poison_object(void *ptr, bool notrack, unsigned long ip); /** * kasan_mempool_poison_object - Check and poison a mempool slab allocation. * @ptr: Pointer to the slab allocation. + * @notrack: Don't record stack trace of this call in the object. * * This function is intended for kernel subsystems that cache slab allocations * to reuse them instead of freeing them back to the slab allocator (e.g. * mempool). * * This function poisons a slab allocation and saves a free stack trace for it - * without initializing the allocation's memory and without putting it into the - * quarantine (for the Generic mode). + * (if @notrack == false) without initializing the allocation's memory and + * without putting it into the quarantine (for the Generic mode). * * This function also performs checks to detect double-free and invalid-free * bugs and reports them. The caller can use the return value of this function @@ -354,10 +355,10 @@ bool __kasan_mempool_poison_object(void *ptr, unsigned long ip); * * Return: true if the allocation can be safely reused; false otherwise. */ -static __always_inline bool kasan_mempool_poison_object(void *ptr) +static __always_inline bool kasan_mempool_poison_object(void *ptr, bool notrack) { if (kasan_enabled()) - return __kasan_mempool_poison_object(ptr, _RET_IP_); + return __kasan_mempool_poison_object(ptr, notrack, _RET_IP_); return true; } @@ -456,7 +457,7 @@ static inline bool kasan_mempool_poison_pages(struct page *page, unsigned int or return true; } static inline void kasan_mempool_unpoison_pages(struct page *page, unsigned int order) {} -static inline bool kasan_mempool_poison_object(void *ptr) +static inline bool kasan_mempool_poison_object(void *ptr, bool notrack) { return true; } diff --git a/io_uring/alloc_cache.h b/io_uring/alloc_cache.h index a3a8cfec32ce..dd508dddea33 100644 --- a/io_uring/alloc_cache.h +++ b/io_uring/alloc_cache.h @@ -10,7 +10,7 @@ static inline bool io_alloc_cache_put(struct io_alloc_cache *cache, void *entry) { if (cache->nr_cached < cache->max_cached) { - if (!kasan_mempool_poison_object(entry)) + if (!kasan_mempool_poison_object(entry, true)) return false; cache->entries[cache->nr_cached++] = entry; return true; diff --git a/io_uring/net.c b/io_uring/net.c index 85f55fbc25c9..a954e37c7fd3 100644 --- a/io_uring/net.c +++ b/io_uring/net.c @@ -149,7 +149,7 @@ static void io_netmsg_recycle(struct io_kiocb *req, unsigned int issue_flags) iov = hdr->free_iov; if (io_alloc_cache_put(&req->ctx->netmsg_cache, hdr)) { if (iov) - kasan_mempool_poison_object(iov); + kasan_mempool_poison_object(iov, true); req->async_data = NULL; req->flags &= ~REQ_F_ASYNC_DATA; } diff --git a/io_uring/rw.c b/io_uring/rw.c index a9a2733be842..cba475003ba7 100644 --- a/io_uring/rw.c +++ b/io_uring/rw.c @@ -167,7 +167,7 @@ static void io_rw_recycle(struct io_kiocb *req, unsigned int issue_flags) iov = rw->free_iovec; if (io_alloc_cache_put(&req->ctx->rw_cache, rw)) { if (iov) - kasan_mempool_poison_object(iov); + kasan_mempool_poison_object(iov, true); req->async_data = NULL; req->flags &= ~REQ_F_ASYNC_DATA; } diff --git a/mm/kasan/common.c b/mm/kasan/common.c index ed4873e18c75..e7b54aa9494e 100644 --- a/mm/kasan/common.c +++ b/mm/kasan/common.c @@ -230,7 +230,8 @@ static bool check_slab_allocation(struct kmem_cache *cache, void *object, } static inline void poison_slab_object(struct kmem_cache *cache, void *object, - bool init, bool still_accessible) + bool init, bool still_accessible, + bool notrack) { void *tagged_object = object; @@ -243,7 +244,7 @@ static inline void poison_slab_object(struct kmem_cache *cache, void *object, kasan_poison(object, round_up(cache->object_size, KASAN_GRANULE_SIZE), KASAN_SLAB_FREE, init); - if (kasan_stack_collection_enabled()) + if (kasan_stack_collection_enabled() && !notrack) kasan_save_free_info(cache, tagged_object); } @@ -261,7 +262,7 @@ bool __kasan_slab_free(struct kmem_cache *cache, void *object, bool init, if (!kasan_arch_is_ready() || is_kfence_address(object)) return false; - poison_slab_object(cache, object, init, still_accessible); + poison_slab_object(cache, object, init, still_accessible, true); /* * If the object is put into quarantine, do not let slab put the object @@ -495,7 +496,7 @@ void __kasan_mempool_unpoison_pages(struct page *page, unsigned int order, __kasan_unpoison_pages(page, order, false); } -bool __kasan_mempool_poison_object(void *ptr, unsigned long ip) +bool __kasan_mempool_poison_object(void *ptr, bool notrack, unsigned long ip) { struct folio *folio = virt_to_folio(ptr); struct slab *slab; @@ -519,7 +520,7 @@ bool __kasan_mempool_poison_object(void *ptr, unsigned long ip) if (check_slab_allocation(slab->slab_cache, ptr, ip)) return false; - poison_slab_object(slab->slab_cache, ptr, false, false); + poison_slab_object(slab->slab_cache, ptr, false, false, notrack); return true; } diff --git a/mm/mempool.c b/mm/mempool.c index 3223337135d0..283df5d2b995 100644 --- a/mm/mempool.c +++ b/mm/mempool.c @@ -115,7 +115,7 @@ static inline void poison_element(mempool_t *pool, void *element) static __always_inline bool kasan_poison_element(mempool_t *pool, void *element) { if (pool->alloc == mempool_alloc_slab || pool->alloc == mempool_kmalloc) - return kasan_mempool_poison_object(element); + return kasan_mempool_poison_object(element, false); else if (pool->alloc == mempool_alloc_pages) return kasan_mempool_poison_pages(element, (unsigned long)pool->pool_data); diff --git a/net/core/skbuff.c b/net/core/skbuff.c index a441613a1e6c..c9f58a698bb7 100644 --- a/net/core/skbuff.c +++ b/net/core/skbuff.c @@ -1457,7 +1457,7 @@ static void napi_skb_cache_put(struct sk_buff *skb) struct napi_alloc_cache *nc = this_cpu_ptr(&napi_alloc_cache); u32 i; - if (!kasan_mempool_poison_object(skb)) + if (!kasan_mempool_poison_object(skb, false)) return; local_lock_nested_bh(&napi_alloc_cache.bh_lock);