From nobody Wed Feb 11 03:51:30 2026 Received: from mx0a-001b2d01.pphosted.com (mx0a-001b2d01.pphosted.com [148.163.156.1]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 6A5F921E096; Tue, 29 Apr 2025 16:08:52 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=148.163.156.1 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1745942934; cv=none; b=FGRJ69fajBAaai3knqhHf0e7vMWwP7i5LZSejRbn53qAd8/D6HKR4huoE9Di4/7DQPPyZEIx7w0fEEwLke5qwJ0mF6etAL1K6fQgsAW5l4Qse/D84ZuBwORek8DhOQzgNFNaDmpGzvDS98Cl+zflmc+154HGWUN/ZeUfVAUQCsc= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1745942934; c=relaxed/simple; bh=Dt8MpVihF2c1tNvQdwKoV3z09/eaHqDrppW/ZkPP38E=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=BSFmEA77zImNTuiYlOlJId8HVrpIvhTibWWhLxHdJxrwYaXKIcFS7XORB4xA0yYC6tFxhGf4/dTbR8V3daBwtwCuKy2mzKsHIk0nHpo/62AvXbmB5hjRZwLTcpepsyETWcaYOX0R3IFi/npRmmINqsVSZAjQswXfqFvTduw0umw= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com; spf=pass smtp.mailfrom=linux.ibm.com; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b=f0r37keo; arc=none smtp.client-ip=148.163.156.1 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b="f0r37keo" Received: from pps.filterd (m0356517.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.2/8.18.1.2) with ESMTP id 53TFi49e007384; Tue, 29 Apr 2025 16:08:45 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=pp1; bh=exXFY8c3sXTfLTJs5 WHyoRrJ3cCFL+f9yepX0KeVH5A=; b=f0r37keoFcE4fNY5TlSCmQn35veUJkzF8 QHLeUS9bZ5FC3Ece/9PJGQXnxXRLztP/D7NfMRd3MGe+64g/OFgix/mVapPdddKR Ywkxly+57OETr3pXbkk2/qIbEWKEIZR331dOrHo6ct2aWYWBuI7m82yACCzBq0/0 4wqPFlVDp0M+v2TmoGWUjYQDaKTebGe4V6xbtJz+VX4hLNsvH75UZcrRX+QrvvWP Zjh1xv9agbfqkVTJ9Z/nlrN1OvTQn245UybF4E8pziZ+d1ZC9rplw+LmR/cSkBy5 TkDPMGDobg6SCSteO1SQuFy9qpoT1U6Ejq5/gT4IuR99RMEfS96DA== Received: from pps.reinject (localhost [127.0.0.1]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 46ahs9c4v6-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Tue, 29 Apr 2025 16:08:45 +0000 (GMT) Received: from m0356517.ppops.net (m0356517.ppops.net [127.0.0.1]) by pps.reinject (8.18.0.8/8.18.0.8) with ESMTP id 53TFi9Wf012165; Tue, 29 Apr 2025 16:08:44 GMT Received: from ppma11.dal12v.mail.ibm.com (db.9e.1632.ip4.static.sl-reverse.com [50.22.158.219]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 46ahs9c4v4-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Tue, 29 Apr 2025 16:08:44 +0000 (GMT) Received: from pps.filterd (ppma11.dal12v.mail.ibm.com [127.0.0.1]) by ppma11.dal12v.mail.ibm.com (8.18.1.2/8.18.1.2) with ESMTP id 53TF2ptu008490; Tue, 29 Apr 2025 16:08:43 GMT Received: from smtprelay04.fra02v.mail.ibm.com ([9.218.2.228]) by ppma11.dal12v.mail.ibm.com (PPS) with ESMTPS id 469ch33p5a-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Tue, 29 Apr 2025 16:08:43 +0000 Received: from smtpav07.fra02v.mail.ibm.com (smtpav07.fra02v.mail.ibm.com [10.20.54.106]) by smtprelay04.fra02v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 53TG8fmE19005828 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Tue, 29 Apr 2025 16:08:41 GMT Received: from smtpav07.fra02v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id B530420043; Tue, 29 Apr 2025 16:08:41 +0000 (GMT) Received: from smtpav07.fra02v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 9C5A520040; Tue, 29 Apr 2025 16:08:41 +0000 (GMT) Received: from tuxmaker.boeblingen.de.ibm.com (unknown [9.152.85.9]) by smtpav07.fra02v.mail.ibm.com (Postfix) with ESMTPS; Tue, 29 Apr 2025 16:08:41 +0000 (GMT) Received: by tuxmaker.boeblingen.de.ibm.com (Postfix, from userid 55669) id 4F3C9E1D62; Tue, 29 Apr 2025 18:08:41 +0200 (CEST) From: Alexander Gordeev To: Andrew Morton , Andrey Ryabinin , Daniel Axtens Cc: linux-kernel@vger.kernel.org, linux-mm@kvack.org, kasan-dev@googlegroups.com, linux-s390@vger.kernel.org, stable@vger.kernel.org Subject: [PATCH v3 1/1] kasan: Avoid sleepable page allocation from atomic context Date: Tue, 29 Apr 2025 18:08:41 +0200 Message-ID: <573a823565734e1eac3aa128fb9d3506ec918a72.1745940843.git.agordeev@linux.ibm.com> X-Mailer: git-send-email 2.45.2 In-Reply-To: References: Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Authority-Analysis: v=2.4 cv=LuKSymdc c=1 sm=1 tr=0 ts=6810f98d cx=c_pps a=aDMHemPKRhS1OARIsFnwRA==:117 a=aDMHemPKRhS1OARIsFnwRA==:17 a=XR8D0OoHHMoA:10 a=pGLkceISAAAA:8 a=VwQbUJbxAAAA:8 a=VnNF1IyMAAAA:8 a=5xA_3oZvIydUEubUgb0A:9 X-Proofpoint-ORIG-GUID: eKosXnLkU16YdrMOn0HBc3RHeNNSB_B9 X-Proofpoint-Spam-Details-Enc: AW1haW4tMjUwNDI5MDEyMCBTYWx0ZWRfX2IGG+lmTdPaB wCQTgHqF/pn5FxI4xPz0sOcj4WE0vLUd8BxQaL7T9RfoxReeiW8WaH+0LZ9y9AjrfEVNbAURcby ZJ18Hfp6JC0emTYaITP3j1DZrqHllnldPcdC8KZ2sA3PPZcOSqJUyGPbfqLnivwfyfq9uQrV7LM uj3CWFzl+9RNyzde+dpU1+EbY2Kg3FqZWgcoCEjFAOjQrH14065mFxjm2dILaAyex/TQfgyrIYe m2BnFl6vmtlFNHDmTnIpVjFTpdPwNyk3cWAMfVQwIoDbFnMxcsIZOVVxz+cLT1eSM8A6+gaKjtb odjriVZ1221loHCTvYfTEZD1CvqjvJxbDK2dgR3LC6HOCFSAiJMbX1pqmnfmUzCJYTm9Ir3EnBb HQ6fejZfxDNwcwYhktrk32uOGuKS/c9/LIWTX6isE0fEzeC1DQZBuxhxazRCQGZNDdgQB3LX X-Proofpoint-GUID: 0-B2yVFWNPdkcAEAxw-pzdBB9vj7F0Ff X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1099,Hydra:6.0.736,FMLib:17.12.80.40 definitions=2025-04-29_06,2025-04-24_02,2025-02-21_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 adultscore=0 phishscore=0 mlxlogscore=459 clxscore=1011 spamscore=0 lowpriorityscore=0 priorityscore=1501 bulkscore=0 mlxscore=0 impostorscore=0 suspectscore=0 malwarescore=0 classifier=spam authscore=0 authtc=n/a authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.19.0-2504070000 definitions=main-2504290120 Content-Type: text/plain; charset="utf-8" apply_to_pte_range() enters the lazy MMU mode and then invokes kasan_populate_vmalloc_pte() callback on each page table walk iteration. However, the callback can go into sleep when trying to allocate a single page, e.g. if an architecutre disables preemption on lazy MMU mode enter. On s390 if make arch_enter_lazy_mmu_mode() -> preempt_enable() and arch_leave_lazy_mmu_mode() -> preempt_disable(), such crash occurs: [ 553.332108] preempt_count: 1, expected: 0 [ 553.332117] no locks held by multipathd/2116. [ 553.332128] CPU: 24 PID: 2116 Comm: multipathd Kdump: loaded Tainted: [ 553.332139] Hardware name: IBM 3931 A01 701 (LPAR) [ 553.332146] Call Trace: [ 553.332152] [<00000000158de23a>] dump_stack_lvl+0xfa/0x150 [ 553.332167] [<0000000013e10d12>] __might_resched+0x57a/0x5e8 [ 553.332178] [<00000000144eb6c2>] __alloc_pages+0x2ba/0x7c0 [ 553.332189] [<00000000144d5cdc>] __get_free_pages+0x2c/0x88 [ 553.332198] [<00000000145663f6>] kasan_populate_vmalloc_pte+0x4e/0x= 110 [ 553.332207] [<000000001447625c>] apply_to_pte_range+0x164/0x3c8 [ 553.332218] [<000000001448125a>] apply_to_pmd_range+0xda/0x318 [ 553.332226] [<000000001448181c>] __apply_to_page_range+0x384/0x768 [ 553.332233] [<0000000014481c28>] apply_to_page_range+0x28/0x38 [ 553.332241] [<00000000145665da>] kasan_populate_vmalloc+0x82/0x98 [ 553.332249] [<00000000144c88d0>] alloc_vmap_area+0x590/0x1c90 [ 553.332257] [<00000000144ca108>] __get_vm_area_node.constprop.0+0x1= 38/0x260 [ 553.332265] [<00000000144d17fc>] __vmalloc_node_range+0x134/0x360 [ 553.332274] [<0000000013d5dbf2>] alloc_thread_stack_node+0x112/0x378 [ 553.332284] [<0000000013d62726>] dup_task_struct+0x66/0x430 [ 553.332293] [<0000000013d63962>] copy_process+0x432/0x4b80 [ 553.332302] [<0000000013d68300>] kernel_clone+0xf0/0x7d0 [ 553.332311] [<0000000013d68bd6>] __do_sys_clone+0xae/0xc8 [ 553.332400] [<0000000013d68dee>] __s390x_sys_clone+0xd6/0x118 [ 553.332410] [<0000000013c9d34c>] do_syscall+0x22c/0x328 [ 553.332419] [<00000000158e7366>] __do_syscall+0xce/0xf0 [ 553.332428] [<0000000015913260>] system_call+0x70/0x98 Instead of allocating single pages per-PTE, bulk-allocate the shadow memory prior to applying kasan_populate_vmalloc_pte() callback on a page range. Suggested-by: Andrey Ryabinin Cc: stable@vger.kernel.org Fixes: 3c5c3cfb9ef4 ("kasan: support backing vmalloc space with real shadow= memory") Signed-off-by: Alexander Gordeev --- mm/kasan/shadow.c | 65 +++++++++++++++++++++++++++++++++++------------ 1 file changed, 49 insertions(+), 16 deletions(-) diff --git a/mm/kasan/shadow.c b/mm/kasan/shadow.c index 88d1c9dcb507..ea9a06715a81 100644 --- a/mm/kasan/shadow.c +++ b/mm/kasan/shadow.c @@ -292,30 +292,65 @@ void __init __weak kasan_populate_early_vm_area_shado= w(void *start, { } =20 +struct vmalloc_populate_data { + unsigned long start; + struct page **pages; +}; + static int kasan_populate_vmalloc_pte(pte_t *ptep, unsigned long addr, - void *unused) + void *_data) { - unsigned long page; + struct vmalloc_populate_data *data =3D _data; + struct page *page; + unsigned long pfn; pte_t pte; =20 if (likely(!pte_none(ptep_get(ptep)))) return 0; =20 - page =3D __get_free_page(GFP_KERNEL); - if (!page) - return -ENOMEM; - - __memset((void *)page, KASAN_VMALLOC_INVALID, PAGE_SIZE); - pte =3D pfn_pte(PFN_DOWN(__pa(page)), PAGE_KERNEL); + page =3D data->pages[PFN_DOWN(addr - data->start)]; + pfn =3D page_to_pfn(page); + __memset(pfn_to_virt(pfn), KASAN_VMALLOC_INVALID, PAGE_SIZE); + pte =3D pfn_pte(pfn, PAGE_KERNEL); =20 spin_lock(&init_mm.page_table_lock); - if (likely(pte_none(ptep_get(ptep)))) { + if (likely(pte_none(ptep_get(ptep)))) set_pte_at(&init_mm, addr, ptep, pte); - page =3D 0; - } spin_unlock(&init_mm.page_table_lock); - if (page) - free_page(page); + + return 0; +} + +static int __kasan_populate_vmalloc(unsigned long start, unsigned long end) +{ + unsigned long nr_pages, nr_total =3D PFN_UP(end - start); + struct vmalloc_populate_data data; + int ret; + + data.pages =3D (struct page **)__get_free_page(GFP_KERNEL); + if (!data.pages) + return -ENOMEM; + + while (nr_total) { + nr_pages =3D min(nr_total, PAGE_SIZE / sizeof(data.pages[0])); + __memset(data.pages, 0, nr_pages * sizeof(data.pages[0])); + if (nr_pages !=3D alloc_pages_bulk(GFP_KERNEL, nr_pages, data.pages)) { + free_page((unsigned long)data.pages); + return -ENOMEM; + } + + data.start =3D start; + ret =3D apply_to_page_range(&init_mm, start, nr_pages * PAGE_SIZE, + kasan_populate_vmalloc_pte, &data); + if (ret) + return ret; + + start +=3D nr_pages * PAGE_SIZE; + nr_total -=3D nr_pages; + } + + free_page((unsigned long)data.pages); + return 0; } =20 @@ -348,9 +383,7 @@ int kasan_populate_vmalloc(unsigned long addr, unsigned= long size) shadow_start =3D PAGE_ALIGN_DOWN(shadow_start); shadow_end =3D PAGE_ALIGN(shadow_end); =20 - ret =3D apply_to_page_range(&init_mm, shadow_start, - shadow_end - shadow_start, - kasan_populate_vmalloc_pte, NULL); + ret =3D __kasan_populate_vmalloc(shadow_start, shadow_end); if (ret) return ret; =20 --=20 2.45.2