linux-kernel - [PATCH] kasan: Prevent cpu_quarantine corruption when CPU offline and cache shrink occur at same time

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-Id: <20220414025925.2423818-1-qiang1.zhang@intel.com>
Date:   Thu, 14 Apr 2022 10:59:25 +0800
From:   Zqiang <qiang1.zhang@...el.com>
To:     ryabinin.a.a@...il.com, dvyukov@...gle.com,
        akpm@...ux-foundation.org
Cc:     linux-mm@...ck.org, linux-kernel@...r.kernel.org
Subject: [PATCH] kasan: Prevent cpu_quarantine corruption when CPU offline and cache shrink occur at same time

The kasan_quarantine_remove_cache() is called in kmem_cache_shrink()/
destroy(), the kasan_quarantine_remove_cache() call is protected by
cpuslock in kmem_cache_destroy(), can ensure serialization with
kasan_cpu_offline(). however the kasan_quarantine_remove_cache() call
is not protected by cpuslock in kmem_cache_shrink(), when CPU going
offline and cache shrink occur at same time, the cpu_quarantine may be
corrupted by interrupt(per_cpu_remove_cache operation). so add
cpu_quarantine offline flags check in per_cpu_remove_cache().

Signed-off-by: Zqiang <qiang1.zhang@...el.com>
---
 mm/kasan/quarantine.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/mm/kasan/quarantine.c b/mm/kasan/quarantine.c
index 0e33d30abb8d..51a8192d49cf 100644
--- a/mm/kasan/quarantine.c
+++ b/mm/kasan/quarantine.c
@@ -330,6 +330,8 @@ static void per_cpu_remove_cache(void *arg)
 	struct cpu_shrink_qlist *sq;
 #endif
 	q = this_cpu_ptr(&cpu_quarantine);
+	if (READ_ONCE(q->offline))
+		return;
 #ifndef CONFIG_PREEMPT_RT
 	qlist_move_cache(q, &to_free, cache);
 	qlist_free_all(&to_free, cache);
-- 
2.25.1