linux-kernel - Re: [PATCH v4] kasan: Don't call find_vm_area() in a PREEMPT

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CA+fCnZf3JbTUErHm_AG7r-dMD_6BmMctPAOaFAJQNH4k2Ev+dQ@mail.gmail.com>
Date: Mon, 17 Feb 2025 23:56:55 +0100
From: Andrey Konovalov <andreyknvl@...il.com>
To: Waiman Long <longman@...hat.com>
Cc: Andrey Ryabinin <ryabinin.a.a@...il.com>, Alexander Potapenko <glider@...gle.com>, 
	Dmitry Vyukov <dvyukov@...gle.com>, Vincenzo Frascino <vincenzo.frascino@....com>, 
	Andrew Morton <akpm@...ux-foundation.org>, 
	Sebastian Andrzej Siewior <bigeasy@...utronix.de>, Clark Williams <clrkwllms@...nel.org>, 
	Steven Rostedt <rostedt@...dmis.org>, kasan-dev@...glegroups.com, linux-mm@...ck.org, 
	linux-kernel@...r.kernel.org, linux-rt-devel@...ts.linux.dev, 
	Nico Pache <npache@...hat.com>
Subject: Re: [PATCH v4] kasan: Don't call find_vm_area() in a PREEMPT_RT kernel

On Mon, Feb 17, 2025 at 9:44 PM Waiman Long <longman@...hat.com> wrote:
>
> The following bug report was found when running a PREEMPT_RT debug kernel.
>
>  BUG: sleeping function called from invalid context at kernel/locking/spinlock_rt.c:48
>  in_atomic(): 1, irqs_disabled(): 1, non_block: 0, pid: 140605, name: kunit_try_catch
>  preempt_count: 1, expected: 0
>
>  Call trace:
>   rt_spin_lock+0x70/0x140
>   find_vmap_area+0x84/0x168
>   find_vm_area+0x1c/0x50
>   print_address_description.constprop.0+0x2a0/0x320
>   print_report+0x108/0x1f8
>   kasan_report+0x90/0xc8
>
> Since commit e30a0361b851 ("kasan: make report_lock a raw spinlock"),
> report_lock was changed to raw_spinlock_t to fix another similar
> PREEMPT_RT problem. That alone isn't enough to cover other corner cases.
>
> print_address_description() is always invoked under the
> report_lock. The context under this lock is always atomic even on
> PREEMPT_RT. find_vm_area() acquires vmap_node::busy.lock which is a
> spinlock_t, becoming a sleeping lock on PREEMPT_RT and must not be
> acquired in atomic context.
>
> Don't invoke find_vm_area() on PREEMPT_RT and just print the address.
> Non-PREEMPT_RT builds remain unchanged. Add a DEFINE_WAIT_OVERRIDE_MAP()
> macro to tell lockdep that this lock nesting is allowed because the
> PREEMPT_RT part (which is invalid) has been taken care of. This macro
> was first introduced in commit 0cce06ba859a ("debugobjects,locking:
> Annotate debug_object_fill_pool() wait type violation").
>
> Fixes: e30a0361b851 ("kasan: make report_lock a raw spinlock")
> Suggested-by: Andrey Konovalov <andreyknvl@...il.com>
> Signed-off-by: Waiman Long <longman@...hat.com>
> ---
>  mm/kasan/report.c | 34 +++++++++++++++++++++++++++++++++-
>  1 file changed, 33 insertions(+), 1 deletion(-)
>
>  [v4] Use Andrey's suggestion of a kasan_find_vm_area() helper and
>  update comment and commit log as suggested by Andrey and Sebastian.
>
> diff --git a/mm/kasan/report.c b/mm/kasan/report.c
> index 3fe77a360f1c..8357e1a33699 100644
> --- a/mm/kasan/report.c
> +++ b/mm/kasan/report.c
> @@ -370,6 +370,36 @@ static inline bool init_task_stack_addr(const void *addr)
>                         sizeof(init_thread_union.stack));
>  }
>
> +/*
> + * This function is invoked with report_lock (a raw_spinlock) held. A
> + * PREEMPT_RT kernel cannot call find_vm_area() as it will acquire a sleeping
> + * rt_spinlock.
> + *
> + * For !RT kernel, the PROVE_RAW_LOCK_NESTING config option will print a
> + * lockdep warning for this raw_spinlock -> spinlock dependency. This config
> + * option is enabled by default to ensure better test coverage to expose this
> + * kind of RT kernel problem. This lockdep splat, however, can be suppressed
> + * by using DEFINE_WAIT_OVERRIDE_MAP() if it serves a useful purpose and the
> + * invalid PREEMPT_RT case has been taken care of.
> + */
> +static inline struct vm_struct *kasan_find_vm_area(void *addr)
> +{
> +       static DEFINE_WAIT_OVERRIDE_MAP(vmalloc_map, LD_WAIT_SLEEP);
> +       struct vm_struct *va;
> +
> +       if (IS_ENABLED(CONFIG_PREEMPT_RT))
> +               return NULL;
> +
> +       /*
> +        * Suppress lockdep warning and fetch vmalloc area of the
> +        * offending address.
> +        */
> +       lock_map_acquire_try(&vmalloc_map);
> +       va = find_vm_area(addr);
> +       lock_map_release(&vmalloc_map);
> +       return va;
> +}
> +
>  static void print_address_description(void *addr, u8 tag,
>                                       struct kasan_report_info *info)
>  {
> @@ -399,7 +429,7 @@ static void print_address_description(void *addr, u8 tag,
>         }
>
>         if (is_vmalloc_addr(addr)) {
> -               struct vm_struct *va = find_vm_area(addr);
> +               struct vm_struct *va = kasan_find_vm_area(addr);
>
>                 if (va) {
>                         pr_err("The buggy address belongs to the virtual mapping at\n"
> @@ -409,6 +439,8 @@ static void print_address_description(void *addr, u8 tag,
>                         pr_err("\n");
>
>                         page = vmalloc_to_page(addr);
> +               } else {
> +                       pr_err("The buggy address %px belongs to a vmalloc virtual mapping\n", addr);
>                 }
>         }
>
> --
> 2.48.1
>

Reviewed-by: Andrey Konovalov <andreyknvl@...il.com>

Thank you!