kasan: make kasan_record_aux_stack_noalloc() the default behaviour
authorPeter Zijlstra <peterz@infradead.org>
Fri, 22 Nov 2024 15:54:51 +0000 (16:54 +0100)
committerAndrew Morton <akpm@linux-foundation.org>
Tue, 14 Jan 2025 06:40:36 +0000 (22:40 -0800)
kasan_record_aux_stack_noalloc() was introduced to record a stack trace
without allocating memory in the process.  It has been added to callers
which were invoked while a raw_spinlock_t was held.  More and more callers
were identified and changed over time.  Is it a good thing to have this
while functions try their best to do a locklessly setup?  The only
downside of having kasan_record_aux_stack() not allocate any memory is
that we end up without a stacktrace if stackdepot runs out of memory and
at the same stacktrace was not recorded before To quote Marco Elver from
https://lore.kernel.org/all/CANpmjNPmQYJ7pv1N3cuU8cP18u7PP_uoZD8YxwZd4jtbof9nVQ@mail.gmail.com/

| I'd be in favor, it simplifies things. And stack depot should be
| able to replenish its pool sufficiently in the "non-aux" cases
| i.e. regular allocations. Worst case we fail to record some
| aux stacks, but I think that's only really bad if there's a bug
| around one of these allocations. In general the probabilities
| of this being a regression are extremely small [...]

Make the kasan_record_aux_stack_noalloc() behaviour default as
kasan_record_aux_stack().

[bigeasy@linutronix.de: dressed the diff as patch]
Link: https://lkml.kernel.org/r/20241122155451.Mb2pmeyJ@linutronix.de
Fixes: 7cb3007ce2da ("kasan: generic: introduce kasan_record_aux_stack_noalloc()")
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Reported-by: syzbot+39f85d612b7c20d8db48@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/all/67275485.050a0220.3c8d68.0a37.GAE@google.com
Reviewed-by: Andrey Konovalov <andreyknvl@gmail.com>
Reviewed-by: Marco Elver <elver@google.com>
Reviewed-by: Waiman Long <longman@redhat.com>
Cc: Alexander Potapenko <glider@google.com>
Cc: Andrey Ryabinin <ryabinin.a.a@gmail.com>
Cc: Ben Segall <bsegall@google.com>
Cc: Boqun Feng <boqun.feng@gmail.com>
Cc: Christoph Lameter <cl@linux.com>
Cc: David Rientjes <rientjes@google.com>
Cc: Dietmar Eggemann <dietmar.eggemann@arm.com>
Cc: Dmitry Vyukov <dvyukov@google.com>
Cc: Frederic Weisbecker <frederic@kernel.org>
Cc: Hyeonggon Yoo <42.hyeyoo@gmail.com>
Cc: Ingo Molnar <mingo@redhat.com>
Cc: Jann Horn <jannh@google.com>
Cc: Joel Fernandes (Google) <joel@joelfernandes.org>
Cc: Joonsoo Kim <iamjoonsoo.kim@lge.com>
Cc: Josh Triplett <josh@joshtriplett.org>
Cc: Juri Lelli <juri.lelli@redhat.com>
Cc: <kasan-dev@googlegroups.com>
Cc: Lai Jiangshan <jiangshanlai@gmail.com>
Cc: Liam R. Howlett <Liam.Howlett@Oracle.com>
Cc: Lorenzo Stoakes <lorenzo.stoakes@oracle.com>
Cc: Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
Cc: Mel Gorman <mgorman@suse.de>
Cc: Neeraj Upadhyay <neeraj.upadhyay@kernel.org>
Cc: Paul E. McKenney <paulmck@kernel.org>
Cc: Pekka Enberg <penberg@kernel.org>
Cc: Roman Gushchin <roman.gushchin@linux.dev>
Cc: Steven Rostedt <rostedt@goodmis.org>
Cc: syzkaller-bugs@googlegroups.com
Cc: Tejun Heo <tj@kernel.org>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Uladzislau Rezki (Sony) <urezki@gmail.com>
Cc: Valentin Schneider <vschneid@redhat.com>
Cc: Vincent Guittot <vincent.guittot@linaro.org>
Cc: Vincenzo Frascino <vincenzo.frascino@arm.com>
Cc: Vlastimil Babka <vbabka@suse.cz>
Cc: Zqiang <qiang.zhang1211@gmail.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
include/linux/kasan.h
include/linux/task_work.h
kernel/irq_work.c
kernel/rcu/tiny.c
kernel/rcu/tree.c
kernel/sched/core.c
kernel/task_work.c
kernel/workqueue.c
mm/kasan/generic.c
mm/slub.c

index 6bbfc8aa42e8f47b25e7886f540574c87e02989b..1c1b3d39e7b63dbbf970aec83e2d10281e4b170c 100644 (file)
@@ -491,7 +491,6 @@ void kasan_cache_create(struct kmem_cache *cache, unsigned int *size,
 void kasan_cache_shrink(struct kmem_cache *cache);
 void kasan_cache_shutdown(struct kmem_cache *cache);
 void kasan_record_aux_stack(void *ptr);
-void kasan_record_aux_stack_noalloc(void *ptr);
 
 #else /* CONFIG_KASAN_GENERIC */
 
@@ -509,7 +508,6 @@ static inline void kasan_cache_create(struct kmem_cache *cache,
 static inline void kasan_cache_shrink(struct kmem_cache *cache) {}
 static inline void kasan_cache_shutdown(struct kmem_cache *cache) {}
 static inline void kasan_record_aux_stack(void *ptr) {}
-static inline void kasan_record_aux_stack_noalloc(void *ptr) {}
 
 #endif /* CONFIG_KASAN_GENERIC */
 
index 2964171856e00d2c97a2af04c44e0f3aa16c2ce6..0646804860ff14c938172c7ba3c4d2c897d43208 100644 (file)
@@ -19,9 +19,6 @@ enum task_work_notify_mode {
        TWA_SIGNAL,
        TWA_SIGNAL_NO_IPI,
        TWA_NMI_CURRENT,
-
-       TWA_FLAGS = 0xff00,
-       TWAF_NO_ALLOC = 0x0100,
 };
 
 static inline bool task_work_pending(struct task_struct *task)
index 2f4fb336dda17d173d0a1dcccd81cf9609bd09ce..73f7e1fd4ab4d9776744faf0e173d593567bf42f 100644 (file)
@@ -147,7 +147,7 @@ bool irq_work_queue_on(struct irq_work *work, int cpu)
        if (!irq_work_claim(work))
                return false;
 
-       kasan_record_aux_stack_noalloc(work);
+       kasan_record_aux_stack(work);
 
        preempt_disable();
        if (cpu != smp_processor_id()) {
index b3b3ce34df6310f7bddba40b2be1bdf6c9f00232..4b3f319114650d372d490919669a2a9e248e731d 100644 (file)
@@ -250,7 +250,7 @@ EXPORT_SYMBOL_GPL(poll_state_synchronize_rcu);
 void kvfree_call_rcu(struct rcu_head *head, void *ptr)
 {
        if (head)
-               kasan_record_aux_stack_noalloc(ptr);
+               kasan_record_aux_stack(ptr);
 
        __kvfree_call_rcu(head, ptr);
 }
index ff98233d4aa59f6ad4488ee96c1ea07ce56e9935..3885aae5f9cb563e24c2040e3d4462b99c0611d4 100644 (file)
@@ -3083,7 +3083,7 @@ __call_rcu_common(struct rcu_head *head, rcu_callback_t func, bool lazy_in)
        }
        head->func = func;
        head->next = NULL;
-       kasan_record_aux_stack_noalloc(head);
+       kasan_record_aux_stack(head);
        local_irq_save(flags);
        rdp = this_cpu_ptr(&rcu_data);
        lazy = lazy_in && !rcu_async_should_hurry();
@@ -3817,7 +3817,7 @@ void kvfree_call_rcu(struct rcu_head *head, void *ptr)
                return;
        }
 
-       kasan_record_aux_stack_noalloc(ptr);
+       kasan_record_aux_stack(ptr);
        success = add_ptr_to_bulk_krc_lock(&krcp, &flags, ptr, !head);
        if (!success) {
                run_page_cache_worker(krcp);
index 3e5a6bf587f911184c3aa47af035b412f926217c..755ae4659b6422d567c8f32284ba66e2132c7343 100644 (file)
@@ -10590,7 +10590,7 @@ void task_tick_mm_cid(struct rq *rq, struct task_struct *curr)
                return;
 
        /* No page allocation under rq lock */
-       task_work_add(curr, work, TWA_RESUME | TWAF_NO_ALLOC);
+       task_work_add(curr, work, TWA_RESUME);
 }
 
 void sched_mm_cid_exit_signals(struct task_struct *t)
index c969f1f26be58a87babfb7f05464e612bec1bc98..d1efec571a4a479268b5c444ab399654d0cecf9e 100644 (file)
@@ -55,26 +55,14 @@ int task_work_add(struct task_struct *task, struct callback_head *work,
                  enum task_work_notify_mode notify)
 {
        struct callback_head *head;
-       int flags = notify & TWA_FLAGS;
 
-       notify &= ~TWA_FLAGS;
        if (notify == TWA_NMI_CURRENT) {
                if (WARN_ON_ONCE(task != current))
                        return -EINVAL;
                if (!IS_ENABLED(CONFIG_IRQ_WORK))
                        return -EINVAL;
        } else {
-               /*
-                * Record the work call stack in order to print it in KASAN
-                * reports.
-                *
-                * Note that stack allocation can fail if TWAF_NO_ALLOC flag
-                * is set and new page is needed to expand the stack buffer.
-                */
-               if (flags & TWAF_NO_ALLOC)
-                       kasan_record_aux_stack_noalloc(work);
-               else
-                       kasan_record_aux_stack(work);
+               kasan_record_aux_stack(work);
        }
 
        head = READ_ONCE(task->task_works);
index f7d8fc2045795ddde681631bef003e5332acbcf1..77d8f672e1751e4d578ace953268dcc55e7d0af6 100644 (file)
@@ -2180,7 +2180,7 @@ static void insert_work(struct pool_workqueue *pwq, struct work_struct *work,
        debug_work_activate(work);
 
        /* record the work call stack in order to print it in KASAN reports */
-       kasan_record_aux_stack_noalloc(work);
+       kasan_record_aux_stack(work);
 
        /* we own @work, set data and link */
        set_work_pwq(work, pwq, extra_flags);
index 8b9e348113b13dadce623a91de9784f18479a989..d54e89f8c3e7601f3ebe12488efb217faede4622 100644 (file)
@@ -524,7 +524,11 @@ size_t kasan_metadata_size(struct kmem_cache *cache, bool in_object)
                        sizeof(struct kasan_free_meta) : 0);
 }
 
-static void __kasan_record_aux_stack(void *addr, depot_flags_t depot_flags)
+/*
+ * This function avoids dynamic memory allocations and thus can be called from
+ * contexts that do not allow allocating memory.
+ */
+void kasan_record_aux_stack(void *addr)
 {
        struct slab *slab = kasan_addr_to_slab(addr);
        struct kmem_cache *cache;
@@ -541,17 +545,7 @@ static void __kasan_record_aux_stack(void *addr, depot_flags_t depot_flags)
                return;
 
        alloc_meta->aux_stack[1] = alloc_meta->aux_stack[0];
-       alloc_meta->aux_stack[0] = kasan_save_stack(0, depot_flags);
-}
-
-void kasan_record_aux_stack(void *addr)
-{
-       return __kasan_record_aux_stack(addr, STACK_DEPOT_FLAG_CAN_ALLOC);
-}
-
-void kasan_record_aux_stack_noalloc(void *addr)
-{
-       return __kasan_record_aux_stack(addr, 0);
+       alloc_meta->aux_stack[0] = kasan_save_stack(0, 0);
 }
 
 void kasan_save_alloc_info(struct kmem_cache *cache, void *object, gfp_t flags)
index cef25d9a476a8f2a92292ad319e9ff177cc29903..a8e9b5106f4c100b73f95c33bf282d5f896c2af8 100644 (file)
--- a/mm/slub.c
+++ b/mm/slub.c
@@ -2311,7 +2311,7 @@ bool slab_free_hook(struct kmem_cache *s, void *x, bool init,
                         * We have to do this manually because the rcu_head is
                         * not located inside the object.
                         */
-                       kasan_record_aux_stack_noalloc(x);
+                       kasan_record_aux_stack(x);
 
                        delayed_free->object = x;
                        call_rcu(&delayed_free->head, slab_free_after_rcu_debug);