linux-kernel - Re: [PATCH rcu 07/12] rcu: tiny: Record kvfree_call

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Tue, 21 Jun 2022 12:31:35 -0700
From:   "Paul E. McKenney" <paulmck@...nel.org>
To:     Neeraj Upadhyay <quic_neeraju@...cinc.com>
Cc:     rcu@...r.kernel.org, linux-kernel@...r.kernel.org,
        kernel-team@...com, rostedt@...dmis.org,
        Johannes Berg <johannes.berg@...el.com>,
        Dmitry Vyukov <dvyukov@...gle.com>, elver@...gle.com
Subject: Re: [PATCH rcu 07/12] rcu: tiny: Record kvfree_call_rcu() call stack
 for KASAN

On Tue, Jun 21, 2022 at 12:01:29PM +0530, Neeraj Upadhyay wrote:
> 
> 
> On 6/21/2022 3:50 AM, Paul E. McKenney wrote:
> > From: Johannes Berg <johannes.berg@...el.com>
> > 
> > When running KASAN with Tiny RCU (e.g. under ARCH=um, where
> > a working KASAN patch is now available), we don't get any
> > information on the original kfree_rcu() (or similar) caller
> > when a problem is reported, as Tiny RCU doesn't record this.
> > 
> > Add the recording, which required pulling kvfree_call_rcu()
> > out of line for the KASAN case since the recording function
> > (kasan_record_aux_stack_noalloc) is neither exported, nor
> > can we include kasan.h into rcutiny.h.
> > 
> > without KASAN, the patch has no size impact (ARCH=um kernel):
> >      text       data         bss         dec        hex    filename
> >   6151515    4423154    33148520    43723189    29b29b5    linux
> >   6151515    4423154    33148520    43723189    29b29b5    linux + patch
> > 
> > with KASAN, the impact on my build was minimal:
> >      text       data         bss         dec        hex    filename
> > 13915539    7388050    33282304    54585893    340ea25    linux
> > 13911266    7392114    33282304    54585684    340e954    linux + patch
> >     -4273      +4064         +-0        -209
> > 
> > Acked-by: Dmitry Vyukov <dvyukov@...gle.com>
> > Signed-off-by: Johannes Berg <johannes.berg@...el.com>
> > Signed-off-by: Paul E. McKenney <paulmck@...nel.org>
> > ---
> >   include/linux/rcutiny.h | 11 ++++++++++-
> >   kernel/rcu/tiny.c       | 14 ++++++++++++++
> >   2 files changed, 24 insertions(+), 1 deletion(-)
> > 
> > diff --git a/include/linux/rcutiny.h b/include/linux/rcutiny.h
> > index 5fed476f977f6..d84e13f2c3848 100644
> > --- a/include/linux/rcutiny.h
> > +++ b/include/linux/rcutiny.h
> > @@ -38,7 +38,7 @@ static inline void synchronize_rcu_expedited(void)
> >    */
> >   extern void kvfree(const void *addr);
> > -static inline void kvfree_call_rcu(struct rcu_head *head, rcu_callback_t func)
> > +static inline void __kvfree_call_rcu(struct rcu_head *head, rcu_callback_t func)
> >   {
> >   	if (head) {
> >   		call_rcu(head, func);
> > @@ -51,6 +51,15 @@ static inline void kvfree_call_rcu(struct rcu_head *head, rcu_callback_t func)
> >   	kvfree((void *) func);
> >   }
> > +#ifdef CONFIG_KASAN_GENERIC
> > +void kvfree_call_rcu(struct rcu_head *head, rcu_callback_t func);
> > +#else
> > +static inline void kvfree_call_rcu(struct rcu_head *head, rcu_callback_t func)
> > +{
> > +	__kvfree_call_rcu(head, func);
> > +}
> > +#endif
> > +
> >   void rcu_qs(void);
> >   static inline void rcu_softirq_qs(void)
> > diff --git a/kernel/rcu/tiny.c b/kernel/rcu/tiny.c
> > index 340b3f8b090d4..58ff3721d975c 100644
> > --- a/kernel/rcu/tiny.c
> > +++ b/kernel/rcu/tiny.c
> > @@ -217,6 +217,20 @@ bool poll_state_synchronize_rcu(unsigned long oldstate)
> >   }
> >   EXPORT_SYMBOL_GPL(poll_state_synchronize_rcu);
> > +#ifdef CONFIG_KASAN_GENERIC
> > +void kvfree_call_rcu(struct rcu_head *head, rcu_callback_t func)
> > +{
> > +	if (head) {
> > +		void *ptr = (void *) head - (unsigned long) func;
> > +
> > +		kasan_record_aux_stack_noalloc(ptr);
> > +	}
> 
> For the !head case; similar to Tree RCU's kvfree_call_rcu() implementation,
> we do not need to record 'ptr' (which will be 'func')?

My understanding is that we do not need to record in that case
because __kvfree_call_rcu() will simply invoke the almost-zero-cost
synchronize_rcu() and then invoke kfree().

Johannes, Dmitry, Marco, anything that I am missing?

							Thanx, Paul

> Thanks
> Neeraj
> 
> > +
> > +	__kvfree_call_rcu(head, func);
> > +}
> > +EXPORT_SYMBOL_GPL(kvfree_call_rcu);
> > +#endif
> > +
> >   void __init rcu_init(void)
> >   {
> >   	open_softirq(RCU_SOFTIRQ, rcu_process_callbacks);