From nobody Sun Dec 28 00:44:41 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id E15EFC4167D for ; Thu, 14 Dec 2023 00:48:06 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1442911AbjLNAr6 (ORCPT ); Wed, 13 Dec 2023 19:47:58 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:47902 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S234083AbjLNArz (ORCPT ); Wed, 13 Dec 2023 19:47:55 -0500 Received: from out-188.mta1.migadu.com (out-188.mta1.migadu.com [95.215.58.188]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 0CC4FA3 for ; Wed, 13 Dec 2023 16:48:01 -0800 (PST) X-Report-Abuse: Please report any abuse attempt to abuse@migadu.com and include these headers. DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linux.dev; s=key1; t=1702514879; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=nejB0rN/5EGuA3SQQpabp67CuxIikS5y1NrnTFuMISI=; b=NsLzL58tlPR9ugxKAnRyMd8DrRr+SxvUinNtJYzd6v9CkqeQBI6h1vLxoqNrpoCC29ye9N snkjrMQ3Lu297rvZMIzUP/4NoNDeq3Szl+q2xjymcO6Gf9ebqHjZLk5pBsolFcBwIiCaFX W97yEg6DpDpdzNXtnmn6OJ6I/lrlXyI= From: andrey.konovalov@linux.dev To: Andrew Morton Cc: Andrey Konovalov , Marco Elver , Alexander Potapenko , Dmitry Vyukov , Vlastimil Babka , kasan-dev@googlegroups.com, Evgenii Stepanov , Tetsuo Handa , linux-mm@kvack.org, linux-kernel@vger.kernel.org, Andrey Konovalov Subject: [PATCH -v2 mm 1/4] lib/stackdepot: add printk_deferred_enter/exit guards Date: Thu, 14 Dec 2023 01:47:51 +0100 Message-Id: In-Reply-To: References: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Migadu-Flow: FLOW_OUT Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Andrey Konovalov Stack depot functions can be called from various contexts that do allocations, including with console locks taken. At the same time, stack depot functions might print WARNING's or refcount-related failures. This can cause a deadlock on console locks. Add printk_deferred_enter/exit guards to stack depot to avoid this. Reported-by: Tetsuo Handa Closes: https://lore.kernel.org/all/000000000000f56750060b9ad216@google.com/ Fixes: 108be8def46e ("lib/stackdepot: allow users to evict stack traces") Fixes: cd11016e5f52 ("mm, kasan: stackdepot implementation. Enable stackdep= ot for SLAB") Reviewed-by: Marco Elver Signed-off-by: Andrey Konovalov --- lib/stackdepot.c | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/lib/stackdepot.c b/lib/stackdepot.c index 870cce2f4cbd..a0be5d05c7f0 100644 --- a/lib/stackdepot.c +++ b/lib/stackdepot.c @@ -506,12 +506,14 @@ depot_stack_handle_t stack_depot_save_flags(unsigned = long *entries, bucket =3D &stack_table[hash & stack_hash_mask]; =20 read_lock_irqsave(&pool_rwlock, flags); + printk_deferred_enter(); =20 /* Fast path: look the stack trace up without full locking. */ found =3D find_stack(bucket, entries, nr_entries, hash); if (found) { if (depot_flags & STACK_DEPOT_FLAG_GET) refcount_inc(&found->count); + printk_deferred_exit(); read_unlock_irqrestore(&pool_rwlock, flags); goto exit; } @@ -520,6 +522,7 @@ depot_stack_handle_t stack_depot_save_flags(unsigned lo= ng *entries, if (new_pool_required) need_alloc =3D true; =20 + printk_deferred_exit(); read_unlock_irqrestore(&pool_rwlock, flags); =20 /* @@ -541,6 +544,7 @@ depot_stack_handle_t stack_depot_save_flags(unsigned lo= ng *entries, } =20 write_lock_irqsave(&pool_rwlock, flags); + printk_deferred_enter(); =20 found =3D find_stack(bucket, entries, nr_entries, hash); if (!found) { @@ -562,6 +566,7 @@ depot_stack_handle_t stack_depot_save_flags(unsigned lo= ng *entries, depot_keep_new_pool(&prealloc); } =20 + printk_deferred_exit(); write_unlock_irqrestore(&pool_rwlock, flags); exit: if (prealloc) { @@ -600,9 +605,11 @@ unsigned int stack_depot_fetch(depot_stack_handle_t ha= ndle, return 0; =20 read_lock_irqsave(&pool_rwlock, flags); + printk_deferred_enter(); =20 stack =3D depot_fetch_stack(handle); =20 + printk_deferred_exit(); read_unlock_irqrestore(&pool_rwlock, flags); =20 *entries =3D stack->entries; @@ -619,6 +626,7 @@ void stack_depot_put(depot_stack_handle_t handle) return; =20 write_lock_irqsave(&pool_rwlock, flags); + printk_deferred_enter(); =20 stack =3D depot_fetch_stack(handle); if (WARN_ON(!stack)) @@ -633,6 +641,7 @@ void stack_depot_put(depot_stack_handle_t handle) } =20 out: + printk_deferred_exit(); write_unlock_irqrestore(&pool_rwlock, flags); } EXPORT_SYMBOL_GPL(stack_depot_put); --=20 2.25.1 From nobody Sun Dec 28 00:44:41 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 80277C4167B for ; Thu, 14 Dec 2023 00:48:09 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1442918AbjLNAsB (ORCPT ); Wed, 13 Dec 2023 19:48:01 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:47910 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S234109AbjLNArz (ORCPT ); Wed, 13 Dec 2023 19:47:55 -0500 Received: from out-176.mta1.migadu.com (out-176.mta1.migadu.com [95.215.58.176]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 1510E9A for ; Wed, 13 Dec 2023 16:48:02 -0800 (PST) X-Report-Abuse: Please report any abuse attempt to abuse@migadu.com and include these headers. DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linux.dev; s=key1; t=1702514880; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=8YssiUYIuDBfUgViHa8UWZbb+o2fPyHhfOU9iGYPOo4=; b=ukeh5H64ggk42fU3s6NTf9eHd2GIMqqgZ/CqDcfXQdJSfR4jhY5GxkoRPyps3uU323JLgZ TniRsk/5uPbcuJZvJRywDrgPNugzxiX76SI4CJMOmkh/ZLwplUIxY/5qcBKDt2czbq/Gkx jFr5MxIf7T+y9Q0QrUq8z27yYq8OoyQ= From: andrey.konovalov@linux.dev To: Andrew Morton Cc: Andrey Konovalov , Marco Elver , Alexander Potapenko , Dmitry Vyukov , Vlastimil Babka , kasan-dev@googlegroups.com, Evgenii Stepanov , Tetsuo Handa , linux-mm@kvack.org, linux-kernel@vger.kernel.org, Andrey Konovalov , syzbot+186b55175d8360728234@syzkaller.appspotmail.com Subject: [PATCH -v2 mm 2/4] kasan: handle concurrent kasan_record_aux_stack calls Date: Thu, 14 Dec 2023 01:47:52 +0100 Message-Id: <88fc85e2a8cca03f2bfcae76100d1a3d54eac840.1702514411.git.andreyknvl@google.com> In-Reply-To: References: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Migadu-Flow: FLOW_OUT Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Andrey Konovalov kasan_record_aux_stack can be called concurrently on the same object. This might lead to a race condition when rotating the saved aux stack trace handles, which in turns leads to incorrect accounting of stack depot handles and refcount underflows in the stack depot code. Fix by introducing a spinlock to protect the aux stack trace handles in kasan_record_aux_stack. Reported-by: Tetsuo Handa Reported-by: syzbot+186b55175d8360728234@syzkaller.appspotmail.com Closes: https://lore.kernel.org/all/000000000000784b1c060b0074a2@google.com/ Fixes: 773688a6cb24 ("kasan: use stack_depot_put for Generic mode") Signed-off-by: Andrey Konovalov --- Changes v1->v2: - Use per-object spinlock instead of a global one. --- mm/kasan/generic.c | 32 +++++++++++++++++++++++++++++--- mm/kasan/kasan.h | 2 ++ 2 files changed, 31 insertions(+), 3 deletions(-) diff --git a/mm/kasan/generic.c b/mm/kasan/generic.c index 54e20b2bc3e1..b9d41d6c70fd 100644 --- a/mm/kasan/generic.c +++ b/mm/kasan/generic.c @@ -25,6 +25,7 @@ #include #include #include +#include #include #include #include @@ -471,8 +472,18 @@ void kasan_init_object_meta(struct kmem_cache *cache, = const void *object) struct kasan_free_meta *free_meta; =20 alloc_meta =3D kasan_get_alloc_meta(cache, object); - if (alloc_meta) + if (alloc_meta) { __memset(alloc_meta, 0, sizeof(*alloc_meta)); + + /* + * Temporarily disable KASAN bug reporting to allow instrumented + * spin_lock_init to access aux_lock, which resides inside of a + * redzone. + */ + kasan_disable_current(); + spin_lock_init(&alloc_meta->aux_lock); + kasan_enable_current(); + } free_meta =3D kasan_get_free_meta(cache, object); if (free_meta) __memset(free_meta, 0, sizeof(*free_meta)); @@ -502,6 +513,8 @@ static void __kasan_record_aux_stack(void *addr, depot_= flags_t depot_flags) struct kmem_cache *cache; struct kasan_alloc_meta *alloc_meta; void *object; + depot_stack_handle_t new_handle, old_handle; + unsigned long flags; =20 if (is_kfence_address(addr) || !slab) return; @@ -512,9 +525,22 @@ static void __kasan_record_aux_stack(void *addr, depot= _flags_t depot_flags) if (!alloc_meta) return; =20 - stack_depot_put(alloc_meta->aux_stack[1]); + new_handle =3D kasan_save_stack(0, depot_flags); + + /* + * Temporarily disable KASAN bug reporting to allow instrumented + * spinlock functions to access aux_lock, which resides inside of a + * redzone. + */ + kasan_disable_current(); + spin_lock_irqsave(&alloc_meta->aux_lock, flags); + old_handle =3D alloc_meta->aux_stack[1]; alloc_meta->aux_stack[1] =3D alloc_meta->aux_stack[0]; - alloc_meta->aux_stack[0] =3D kasan_save_stack(0, depot_flags); + alloc_meta->aux_stack[0] =3D new_handle; + spin_unlock_irqrestore(&alloc_meta->aux_lock, flags); + kasan_enable_current(); + + stack_depot_put(old_handle); } =20 void kasan_record_aux_stack(void *addr) diff --git a/mm/kasan/kasan.h b/mm/kasan/kasan.h index 5e298e3ac909..8b4125fecdc7 100644 --- a/mm/kasan/kasan.h +++ b/mm/kasan/kasan.h @@ -6,6 +6,7 @@ #include #include #include +#include #include =20 #if defined(CONFIG_KASAN_SW_TAGS) || defined(CONFIG_KASAN_HW_TAGS) @@ -249,6 +250,7 @@ struct kasan_global { struct kasan_alloc_meta { struct kasan_track alloc_track; /* Free track is stored in kasan_free_meta. */ + spinlock_t aux_lock; depot_stack_handle_t aux_stack[2]; }; =20 --=20 2.25.1 From nobody Sun Dec 28 00:44:41 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 05088C4332F for ; Thu, 14 Dec 2023 00:48:12 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1442924AbjLNAsD (ORCPT ); Wed, 13 Dec 2023 19:48:03 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:47924 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1442894AbjLNAr4 (ORCPT ); Wed, 13 Dec 2023 19:47:56 -0500 Received: from out-181.mta1.migadu.com (out-181.mta1.migadu.com [IPv6:2001:41d0:203:375::b5]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id DF5BBA3 for ; Wed, 13 Dec 2023 16:48:02 -0800 (PST) X-Report-Abuse: Please report any abuse attempt to abuse@migadu.com and include these headers. DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linux.dev; s=key1; t=1702514881; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=fOHzqh8IZvvUQEcAVUngjlYsg+ArhHiPZJoDS72WUGY=; b=mE3jhmI4IuQyy9Oj7FbJ4UWoTg80r8UlyLdLcotJ2d/EbCumZB6ZIk/usRDEldWY+o2Do0 taeItiOWOIa0q4b6vqwJB8QO9mSeuaXO84ASNC46APW3IbCNy6spdT/VnDOv9ZjJh/7OiI jNBCabIu/dOKWGrgx7tbKL2hH4yxYFI= From: andrey.konovalov@linux.dev To: Andrew Morton Cc: Andrey Konovalov , Marco Elver , Alexander Potapenko , Dmitry Vyukov , Vlastimil Babka , kasan-dev@googlegroups.com, Evgenii Stepanov , Tetsuo Handa , linux-mm@kvack.org, linux-kernel@vger.kernel.org, Andrey Konovalov Subject: [PATCH -v2 mm 3/4] kasan: memset free track in qlink_free Date: Thu, 14 Dec 2023 01:47:53 +0100 Message-Id: <39bbc4d0bc72dfaf02f9dc63ee6f25a8f3a1719c.1702514411.git.andreyknvl@google.com> In-Reply-To: References: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Migadu-Flow: FLOW_OUT Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Andrey Konovalov Instead of only zeroing out the stack depot handle when evicting the free stack trace in qlink_free, zero out the whole track. Do this just to produce a similar effect for alloc and free meta. The other fields of the free track besides the stack trace handle are considered invalid at this point anyway, so no harm in zeroing them out. Fixes: 773688a6cb24 ("kasan: use stack_depot_put for Generic mode") Reviewed-by: Marco Elver Signed-off-by: Andrey Konovalov --- mm/kasan/quarantine.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/mm/kasan/quarantine.c b/mm/kasan/quarantine.c index 265ca2bbe2dd..782e045da911 100644 --- a/mm/kasan/quarantine.c +++ b/mm/kasan/quarantine.c @@ -157,7 +157,7 @@ static void qlink_free(struct qlist_node *qlink, struct= kmem_cache *cache) if (free_meta && *(u8 *)kasan_mem_to_shadow(object) =3D=3D KASAN_SLAB_FREETRACK) { stack_depot_put(free_meta->free_track.stack); - free_meta->free_track.stack =3D 0; + __memset(&free_meta->free_track, 0, sizeof(free_meta->free_track)); } =20 /* --=20 2.25.1 From nobody Sun Dec 28 00:44:41 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 85EA2C4167B for ; Thu, 14 Dec 2023 00:48:13 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1442931AbjLNAsF (ORCPT ); Wed, 13 Dec 2023 19:48:05 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:47936 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1442898AbjLNAr5 (ORCPT ); Wed, 13 Dec 2023 19:47:57 -0500 Received: from out-170.mta1.migadu.com (out-170.mta1.migadu.com [95.215.58.170]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 8B54A9A for ; Wed, 13 Dec 2023 16:48:03 -0800 (PST) X-Report-Abuse: Please report any abuse attempt to abuse@migadu.com and include these headers. DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linux.dev; s=key1; t=1702514881; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=nCFM+nFcyoFd/gCQWZCb7EKvVZ+qSBSDeoPEA8Jfh0A=; b=chtz44aTYYSc5cpdlXhKLUKTZ86AJYhUci1b1n4MvFn6OsB2ibs7ZQcAic22uNrBAd8YVr Eaf1Gto/kQeCtiRuJu5GHpZr6mJXhZ9iHzXRU8IBsCW4j6J1IghuG97ROmbXrolwlXm6SD iEGh8YGKXQ0g7vJ2SGCdtWFc78uL3S4= From: andrey.konovalov@linux.dev To: Andrew Morton Cc: Andrey Konovalov , Marco Elver , Alexander Potapenko , Dmitry Vyukov , Vlastimil Babka , kasan-dev@googlegroups.com, Evgenii Stepanov , Tetsuo Handa , linux-mm@kvack.org, linux-kernel@vger.kernel.org, Andrey Konovalov Subject: [PATCH -v2 mm 4/4] lib/stackdepot: fix comment in include/linux/stackdepot.h Date: Thu, 14 Dec 2023 01:47:54 +0100 Message-Id: <4123304d92b1ca3831113be5be7771fd225cddf9.1702514411.git.andreyknvl@google.com> In-Reply-To: References: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Migadu-Flow: FLOW_OUT Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Andrey Konovalov As stack traces can now be evicted from the stack depot, remove the comment saying that they are never removed. Fixes: 108be8def46e ("lib/stackdepot: allow users to evict stack traces") Reviewed-by: Marco Elver Signed-off-by: Andrey Konovalov --- include/linux/stackdepot.h | 2 -- 1 file changed, 2 deletions(-) diff --git a/include/linux/stackdepot.h b/include/linux/stackdepot.h index a6796f178913..adcbb8f23600 100644 --- a/include/linux/stackdepot.h +++ b/include/linux/stackdepot.h @@ -11,8 +11,6 @@ * SLUB_DEBUG needs 256 bytes per object for that). Since allocation and f= ree * stack traces often repeat, using stack depot allows to save about 100x = space. * - * Stack traces are never removed from the stack depot. - * * Author: Alexander Potapenko * Copyright (C) 2016 Google, Inc. * --=20 2.25.1