linux-kernel - [PATCH v2] mm, slub: emit the "free" trace report before freeing memory in kmem_cache

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <a6824ebe-a0ad-fedb-ada3-c362f9c8f363@huawei.com>
Date:   Tue, 2 Nov 2021 19:43:00 +0800
From:   Yunfeng Ye <yeyunfeng@...wei.com>
To:     <cl@...ux.com>, <penberg@...nel.org>, <rientjes@...gle.com>,
        <iamjoonsoo.kim@....com>,
        Andrew Morton <akpm@...ux-foundation.org>, <vbabka@...e.cz>,
        <linux-mm@...ck.org>, <linux-kernel@...r.kernel.org>
CC:     <vbabka@...e.cz>, <jhubbard@...dia.com>,
        <songmuchun@...edance.com>, <willy@...radead.org>,
        <wuxu.wu@...wei.com>, Hewenliang <hewenliang4@...wei.com>
Subject: [PATCH v2] mm, slub: emit the "free" trace report before freeing
 memory in kmem_cache_free()

After the memory is freed, it can be immediately allocated by other
CPUs, before the "free" trace report has been emitted. This causes
inaccurate traces.

For example, if the following sequence of events occurs:

    CPU 0                 CPU 1

  (1) alloc xxxxxx
  (2) free  xxxxxx
                         (3) alloc xxxxxx
                         (4) free  xxxxxx

Then they will be inaccurately reported via tracing, so that they appear
to have happened in this order:

    CPU 0                 CPU 1

  (1) alloc xxxxxx
                         (2) alloc xxxxxx
  (3) free  xxxxxx
                         (4) free  xxxxxx

This makes it look like CPU 1 somehow managed to allocate mmemory that
CPU 0 still had allocated for itself.

In order to avoid this, emit the "free xxxxxx" tracing report just
before the actual call to free the memory, instead of just after it.

Signed-off-by: Yunfeng Ye <yeyunfeng@...wei.com>
Reviewed-by: Vlastimil Babka <vbabka@...e.cz>
---
v1 -> v2:
 - Modify the description
 - Add "Reviewed-by"

 mm/slub.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/mm/slub.c b/mm/slub.c
index 432145d7b4ec..427e62034c3f 100644
--- a/mm/slub.c
+++ b/mm/slub.c
@@ -3526,8 +3526,8 @@ void kmem_cache_free(struct kmem_cache *s, void *x)
 	s = cache_from_obj(s, x);
 	if (!s)
 		return;
-	slab_free(s, virt_to_head_page(x), x, NULL, 1, _RET_IP_);
 	trace_kmem_cache_free(_RET_IP_, x, s->name);
+	slab_free(s, virt_to_head_page(x), x, NULL, 1, _RET_IP_);
 }
 EXPORT_SYMBOL(kmem_cache_free);

-- 
2.27.0