From: Johannes Berg <[email protected]>
When running KASAN with Tiny RCU (e.g. under ARCH=um, where
a working KASAN patch is now available), we don't get any
information on the original kfree_rcu() (or similar) caller
when a problem is reported, as Tiny RCU doesn't record this.
Add the recording, which required pulling kvfree_call_rcu()
out of line for the KASAN case since the recording function
(kasan_record_aux_stack_noalloc) is neither exported, nor
can we include kasan.h into rcutiny.h.
without KASAN, the patch has no size impact (ARCH=um kernel):
text data bss dec hex filename
6151515 4423154 33148520 43723189 29b29b5 linux
6151515 4423154 33148520 43723189 29b29b5 linux + patch
with KASAN, the impact on my build was minimal:
text data bss dec hex filename
13915539 7388050 33282304 54585893 340ea25 linux
13911266 7392114 33282304 54585684 340e954 linux + patch
-4273 +4064 +-0 -209
Acked-by: Dmitry Vyukov <[email protected]>
Signed-off-by: Johannes Berg <[email protected]>
Signed-off-by: Paul E. McKenney <[email protected]>
---
include/linux/rcutiny.h | 11 ++++++++++-
kernel/rcu/tiny.c | 14 ++++++++++++++
2 files changed, 24 insertions(+), 1 deletion(-)
diff --git a/include/linux/rcutiny.h b/include/linux/rcutiny.h
index 5fed476f977f6..d84e13f2c3848 100644
--- a/include/linux/rcutiny.h
+++ b/include/linux/rcutiny.h
@@ -38,7 +38,7 @@ static inline void synchronize_rcu_expedited(void)
*/
extern void kvfree(const void *addr);
-static inline void kvfree_call_rcu(struct rcu_head *head, rcu_callback_t func)
+static inline void __kvfree_call_rcu(struct rcu_head *head, rcu_callback_t func)
{
if (head) {
call_rcu(head, func);
@@ -51,6 +51,15 @@ static inline void kvfree_call_rcu(struct rcu_head *head, rcu_callback_t func)
kvfree((void *) func);
}
+#ifdef CONFIG_KASAN_GENERIC
+void kvfree_call_rcu(struct rcu_head *head, rcu_callback_t func);
+#else
+static inline void kvfree_call_rcu(struct rcu_head *head, rcu_callback_t func)
+{
+ __kvfree_call_rcu(head, func);
+}
+#endif
+
void rcu_qs(void);
static inline void rcu_softirq_qs(void)
diff --git a/kernel/rcu/tiny.c b/kernel/rcu/tiny.c
index 340b3f8b090d4..58ff3721d975c 100644
--- a/kernel/rcu/tiny.c
+++ b/kernel/rcu/tiny.c
@@ -217,6 +217,20 @@ bool poll_state_synchronize_rcu(unsigned long oldstate)
}
EXPORT_SYMBOL_GPL(poll_state_synchronize_rcu);
+#ifdef CONFIG_KASAN_GENERIC
+void kvfree_call_rcu(struct rcu_head *head, rcu_callback_t func)
+{
+ if (head) {
+ void *ptr = (void *) head - (unsigned long) func;
+
+ kasan_record_aux_stack_noalloc(ptr);
+ }
+
+ __kvfree_call_rcu(head, func);
+}
+EXPORT_SYMBOL_GPL(kvfree_call_rcu);
+#endif
+
void __init rcu_init(void)
{
open_softirq(RCU_SOFTIRQ, rcu_process_callbacks);
--
2.31.1.189.g2e36527f23
On 6/21/2022 3:50 AM, Paul E. McKenney wrote:
> From: Johannes Berg <[email protected]>
>
> When running KASAN with Tiny RCU (e.g. under ARCH=um, where
> a working KASAN patch is now available), we don't get any
> information on the original kfree_rcu() (or similar) caller
> when a problem is reported, as Tiny RCU doesn't record this.
>
> Add the recording, which required pulling kvfree_call_rcu()
> out of line for the KASAN case since the recording function
> (kasan_record_aux_stack_noalloc) is neither exported, nor
> can we include kasan.h into rcutiny.h.
>
> without KASAN, the patch has no size impact (ARCH=um kernel):
> text data bss dec hex filename
> 6151515 4423154 33148520 43723189 29b29b5 linux
> 6151515 4423154 33148520 43723189 29b29b5 linux + patch
>
> with KASAN, the impact on my build was minimal:
> text data bss dec hex filename
> 13915539 7388050 33282304 54585893 340ea25 linux
> 13911266 7392114 33282304 54585684 340e954 linux + patch
> -4273 +4064 +-0 -209
>
> Acked-by: Dmitry Vyukov <[email protected]>
> Signed-off-by: Johannes Berg <[email protected]>
> Signed-off-by: Paul E. McKenney <[email protected]>
> ---
> include/linux/rcutiny.h | 11 ++++++++++-
> kernel/rcu/tiny.c | 14 ++++++++++++++
> 2 files changed, 24 insertions(+), 1 deletion(-)
>
> diff --git a/include/linux/rcutiny.h b/include/linux/rcutiny.h
> index 5fed476f977f6..d84e13f2c3848 100644
> --- a/include/linux/rcutiny.h
> +++ b/include/linux/rcutiny.h
> @@ -38,7 +38,7 @@ static inline void synchronize_rcu_expedited(void)
> */
> extern void kvfree(const void *addr);
>
> -static inline void kvfree_call_rcu(struct rcu_head *head, rcu_callback_t func)
> +static inline void __kvfree_call_rcu(struct rcu_head *head, rcu_callback_t func)
> {
> if (head) {
> call_rcu(head, func);
> @@ -51,6 +51,15 @@ static inline void kvfree_call_rcu(struct rcu_head *head, rcu_callback_t func)
> kvfree((void *) func);
> }
>
> +#ifdef CONFIG_KASAN_GENERIC
> +void kvfree_call_rcu(struct rcu_head *head, rcu_callback_t func);
> +#else
> +static inline void kvfree_call_rcu(struct rcu_head *head, rcu_callback_t func)
> +{
> + __kvfree_call_rcu(head, func);
> +}
> +#endif
> +
> void rcu_qs(void);
>
> static inline void rcu_softirq_qs(void)
> diff --git a/kernel/rcu/tiny.c b/kernel/rcu/tiny.c
> index 340b3f8b090d4..58ff3721d975c 100644
> --- a/kernel/rcu/tiny.c
> +++ b/kernel/rcu/tiny.c
> @@ -217,6 +217,20 @@ bool poll_state_synchronize_rcu(unsigned long oldstate)
> }
> EXPORT_SYMBOL_GPL(poll_state_synchronize_rcu);
>
> +#ifdef CONFIG_KASAN_GENERIC
> +void kvfree_call_rcu(struct rcu_head *head, rcu_callback_t func)
> +{
> + if (head) {
> + void *ptr = (void *) head - (unsigned long) func;
> +
> + kasan_record_aux_stack_noalloc(ptr);
> + }
For the !head case; similar to Tree RCU's kvfree_call_rcu()
implementation, we do not need to record 'ptr' (which will be 'func')?
Thanks
Neeraj
> +
> + __kvfree_call_rcu(head, func);
> +}
> +EXPORT_SYMBOL_GPL(kvfree_call_rcu);
> +#endif
> +
> void __init rcu_init(void)
> {
> open_softirq(RCU_SOFTIRQ, rcu_process_callbacks);
On Tue, Jun 21, 2022 at 12:01:29PM +0530, Neeraj Upadhyay wrote:
>
>
> On 6/21/2022 3:50 AM, Paul E. McKenney wrote:
> > From: Johannes Berg <[email protected]>
> >
> > When running KASAN with Tiny RCU (e.g. under ARCH=um, where
> > a working KASAN patch is now available), we don't get any
> > information on the original kfree_rcu() (or similar) caller
> > when a problem is reported, as Tiny RCU doesn't record this.
> >
> > Add the recording, which required pulling kvfree_call_rcu()
> > out of line for the KASAN case since the recording function
> > (kasan_record_aux_stack_noalloc) is neither exported, nor
> > can we include kasan.h into rcutiny.h.
> >
> > without KASAN, the patch has no size impact (ARCH=um kernel):
> > text data bss dec hex filename
> > 6151515 4423154 33148520 43723189 29b29b5 linux
> > 6151515 4423154 33148520 43723189 29b29b5 linux + patch
> >
> > with KASAN, the impact on my build was minimal:
> > text data bss dec hex filename
> > 13915539 7388050 33282304 54585893 340ea25 linux
> > 13911266 7392114 33282304 54585684 340e954 linux + patch
> > -4273 +4064 +-0 -209
> >
> > Acked-by: Dmitry Vyukov <[email protected]>
> > Signed-off-by: Johannes Berg <[email protected]>
> > Signed-off-by: Paul E. McKenney <[email protected]>
> > ---
> > include/linux/rcutiny.h | 11 ++++++++++-
> > kernel/rcu/tiny.c | 14 ++++++++++++++
> > 2 files changed, 24 insertions(+), 1 deletion(-)
> >
> > diff --git a/include/linux/rcutiny.h b/include/linux/rcutiny.h
> > index 5fed476f977f6..d84e13f2c3848 100644
> > --- a/include/linux/rcutiny.h
> > +++ b/include/linux/rcutiny.h
> > @@ -38,7 +38,7 @@ static inline void synchronize_rcu_expedited(void)
> > */
> > extern void kvfree(const void *addr);
> > -static inline void kvfree_call_rcu(struct rcu_head *head, rcu_callback_t func)
> > +static inline void __kvfree_call_rcu(struct rcu_head *head, rcu_callback_t func)
> > {
> > if (head) {
> > call_rcu(head, func);
> > @@ -51,6 +51,15 @@ static inline void kvfree_call_rcu(struct rcu_head *head, rcu_callback_t func)
> > kvfree((void *) func);
> > }
> > +#ifdef CONFIG_KASAN_GENERIC
> > +void kvfree_call_rcu(struct rcu_head *head, rcu_callback_t func);
> > +#else
> > +static inline void kvfree_call_rcu(struct rcu_head *head, rcu_callback_t func)
> > +{
> > + __kvfree_call_rcu(head, func);
> > +}
> > +#endif
> > +
> > void rcu_qs(void);
> > static inline void rcu_softirq_qs(void)
> > diff --git a/kernel/rcu/tiny.c b/kernel/rcu/tiny.c
> > index 340b3f8b090d4..58ff3721d975c 100644
> > --- a/kernel/rcu/tiny.c
> > +++ b/kernel/rcu/tiny.c
> > @@ -217,6 +217,20 @@ bool poll_state_synchronize_rcu(unsigned long oldstate)
> > }
> > EXPORT_SYMBOL_GPL(poll_state_synchronize_rcu);
> > +#ifdef CONFIG_KASAN_GENERIC
> > +void kvfree_call_rcu(struct rcu_head *head, rcu_callback_t func)
> > +{
> > + if (head) {
> > + void *ptr = (void *) head - (unsigned long) func;
> > +
> > + kasan_record_aux_stack_noalloc(ptr);
> > + }
>
> For the !head case; similar to Tree RCU's kvfree_call_rcu() implementation,
> we do not need to record 'ptr' (which will be 'func')?
My understanding is that we do not need to record in that case
because __kvfree_call_rcu() will simply invoke the almost-zero-cost
synchronize_rcu() and then invoke kfree().
Johannes, Dmitry, Marco, anything that I am missing?
Thanx, Paul
> Thanks
> Neeraj
>
> > +
> > + __kvfree_call_rcu(head, func);
> > +}
> > +EXPORT_SYMBOL_GPL(kvfree_call_rcu);
> > +#endif
> > +
> > void __init rcu_init(void)
> > {
> > open_softirq(RCU_SOFTIRQ, rcu_process_callbacks);
On Tue, 21 Jun 2022 at 21:31, Paul E. McKenney <[email protected]> wrote:
>
> On Tue, Jun 21, 2022 at 12:01:29PM +0530, Neeraj Upadhyay wrote:
> >
> >
> > On 6/21/2022 3:50 AM, Paul E. McKenney wrote:
> > > From: Johannes Berg <[email protected]>
> > >
> > > When running KASAN with Tiny RCU (e.g. under ARCH=um, where
> > > a working KASAN patch is now available), we don't get any
> > > information on the original kfree_rcu() (or similar) caller
> > > when a problem is reported, as Tiny RCU doesn't record this.
> > >
> > > Add the recording, which required pulling kvfree_call_rcu()
> > > out of line for the KASAN case since the recording function
> > > (kasan_record_aux_stack_noalloc) is neither exported, nor
> > > can we include kasan.h into rcutiny.h.
> > >
> > > without KASAN, the patch has no size impact (ARCH=um kernel):
> > > text data bss dec hex filename
> > > 6151515 4423154 33148520 43723189 29b29b5 linux
> > > 6151515 4423154 33148520 43723189 29b29b5 linux + patch
> > >
> > > with KASAN, the impact on my build was minimal:
> > > text data bss dec hex filename
> > > 13915539 7388050 33282304 54585893 340ea25 linux
> > > 13911266 7392114 33282304 54585684 340e954 linux + patch
> > > -4273 +4064 +-0 -209
> > >
> > > Acked-by: Dmitry Vyukov <[email protected]>
> > > Signed-off-by: Johannes Berg <[email protected]>
> > > Signed-off-by: Paul E. McKenney <[email protected]>
> > > ---
> > > include/linux/rcutiny.h | 11 ++++++++++-
> > > kernel/rcu/tiny.c | 14 ++++++++++++++
> > > 2 files changed, 24 insertions(+), 1 deletion(-)
> > >
> > > diff --git a/include/linux/rcutiny.h b/include/linux/rcutiny.h
> > > index 5fed476f977f6..d84e13f2c3848 100644
> > > --- a/include/linux/rcutiny.h
> > > +++ b/include/linux/rcutiny.h
> > > @@ -38,7 +38,7 @@ static inline void synchronize_rcu_expedited(void)
> > > */
> > > extern void kvfree(const void *addr);
> > > -static inline void kvfree_call_rcu(struct rcu_head *head, rcu_callback_t func)
> > > +static inline void __kvfree_call_rcu(struct rcu_head *head, rcu_callback_t func)
> > > {
> > > if (head) {
> > > call_rcu(head, func);
> > > @@ -51,6 +51,15 @@ static inline void kvfree_call_rcu(struct rcu_head *head, rcu_callback_t func)
> > > kvfree((void *) func);
> > > }
> > > +#ifdef CONFIG_KASAN_GENERIC
> > > +void kvfree_call_rcu(struct rcu_head *head, rcu_callback_t func);
> > > +#else
> > > +static inline void kvfree_call_rcu(struct rcu_head *head, rcu_callback_t func)
> > > +{
> > > + __kvfree_call_rcu(head, func);
> > > +}
> > > +#endif
> > > +
> > > void rcu_qs(void);
> > > static inline void rcu_softirq_qs(void)
> > > diff --git a/kernel/rcu/tiny.c b/kernel/rcu/tiny.c
> > > index 340b3f8b090d4..58ff3721d975c 100644
> > > --- a/kernel/rcu/tiny.c
> > > +++ b/kernel/rcu/tiny.c
> > > @@ -217,6 +217,20 @@ bool poll_state_synchronize_rcu(unsigned long oldstate)
> > > }
> > > EXPORT_SYMBOL_GPL(poll_state_synchronize_rcu);
> > > +#ifdef CONFIG_KASAN_GENERIC
> > > +void kvfree_call_rcu(struct rcu_head *head, rcu_callback_t func)
> > > +{
> > > + if (head) {
> > > + void *ptr = (void *) head - (unsigned long) func;
> > > +
> > > + kasan_record_aux_stack_noalloc(ptr);
> > > + }
> >
> > For the !head case; similar to Tree RCU's kvfree_call_rcu() implementation,
> > we do not need to record 'ptr' (which will be 'func')?
>
> My understanding is that we do not need to record in that case
> because __kvfree_call_rcu() will simply invoke the almost-zero-cost
> synchronize_rcu() and then invoke kfree().
>
> Johannes, Dmitry, Marco, anything that I am missing?
As-is looks sensible - doing kasan_record_aux_stack_noalloc() only
makes sense if the actual kfree() is not done with a callstack that
will point at the kvfree_call_rcu() caller. Otherwise we're doing
redundant work and just polluting the aux stack storage slots. So in
the case where kvfree_call_rcu() does synchronize_rcu() and kfree()
the kvfree_call_rcu() caller is in the callstack, and would be shown
on use-after-free bugs.
Thanks,
-- Marco
On Tue, Jun 21, 2022 at 11:14:04PM +0200, Marco Elver wrote:
> On Tue, 21 Jun 2022 at 21:31, Paul E. McKenney <[email protected]> wrote:
> >
> > On Tue, Jun 21, 2022 at 12:01:29PM +0530, Neeraj Upadhyay wrote:
> > >
> > >
> > > On 6/21/2022 3:50 AM, Paul E. McKenney wrote:
> > > > From: Johannes Berg <[email protected]>
> > > >
> > > > When running KASAN with Tiny RCU (e.g. under ARCH=um, where
> > > > a working KASAN patch is now available), we don't get any
> > > > information on the original kfree_rcu() (or similar) caller
> > > > when a problem is reported, as Tiny RCU doesn't record this.
> > > >
> > > > Add the recording, which required pulling kvfree_call_rcu()
> > > > out of line for the KASAN case since the recording function
> > > > (kasan_record_aux_stack_noalloc) is neither exported, nor
> > > > can we include kasan.h into rcutiny.h.
> > > >
> > > > without KASAN, the patch has no size impact (ARCH=um kernel):
> > > > text data bss dec hex filename
> > > > 6151515 4423154 33148520 43723189 29b29b5 linux
> > > > 6151515 4423154 33148520 43723189 29b29b5 linux + patch
> > > >
> > > > with KASAN, the impact on my build was minimal:
> > > > text data bss dec hex filename
> > > > 13915539 7388050 33282304 54585893 340ea25 linux
> > > > 13911266 7392114 33282304 54585684 340e954 linux + patch
> > > > -4273 +4064 +-0 -209
> > > >
> > > > Acked-by: Dmitry Vyukov <[email protected]>
> > > > Signed-off-by: Johannes Berg <[email protected]>
> > > > Signed-off-by: Paul E. McKenney <[email protected]>
> > > > ---
> > > > include/linux/rcutiny.h | 11 ++++++++++-
> > > > kernel/rcu/tiny.c | 14 ++++++++++++++
> > > > 2 files changed, 24 insertions(+), 1 deletion(-)
> > > >
> > > > diff --git a/include/linux/rcutiny.h b/include/linux/rcutiny.h
> > > > index 5fed476f977f6..d84e13f2c3848 100644
> > > > --- a/include/linux/rcutiny.h
> > > > +++ b/include/linux/rcutiny.h
> > > > @@ -38,7 +38,7 @@ static inline void synchronize_rcu_expedited(void)
> > > > */
> > > > extern void kvfree(const void *addr);
> > > > -static inline void kvfree_call_rcu(struct rcu_head *head, rcu_callback_t func)
> > > > +static inline void __kvfree_call_rcu(struct rcu_head *head, rcu_callback_t func)
> > > > {
> > > > if (head) {
> > > > call_rcu(head, func);
> > > > @@ -51,6 +51,15 @@ static inline void kvfree_call_rcu(struct rcu_head *head, rcu_callback_t func)
> > > > kvfree((void *) func);
> > > > }
> > > > +#ifdef CONFIG_KASAN_GENERIC
> > > > +void kvfree_call_rcu(struct rcu_head *head, rcu_callback_t func);
> > > > +#else
> > > > +static inline void kvfree_call_rcu(struct rcu_head *head, rcu_callback_t func)
> > > > +{
> > > > + __kvfree_call_rcu(head, func);
> > > > +}
> > > > +#endif
> > > > +
> > > > void rcu_qs(void);
> > > > static inline void rcu_softirq_qs(void)
> > > > diff --git a/kernel/rcu/tiny.c b/kernel/rcu/tiny.c
> > > > index 340b3f8b090d4..58ff3721d975c 100644
> > > > --- a/kernel/rcu/tiny.c
> > > > +++ b/kernel/rcu/tiny.c
> > > > @@ -217,6 +217,20 @@ bool poll_state_synchronize_rcu(unsigned long oldstate)
> > > > }
> > > > EXPORT_SYMBOL_GPL(poll_state_synchronize_rcu);
> > > > +#ifdef CONFIG_KASAN_GENERIC
> > > > +void kvfree_call_rcu(struct rcu_head *head, rcu_callback_t func)
> > > > +{
> > > > + if (head) {
> > > > + void *ptr = (void *) head - (unsigned long) func;
> > > > +
> > > > + kasan_record_aux_stack_noalloc(ptr);
> > > > + }
> > >
> > > For the !head case; similar to Tree RCU's kvfree_call_rcu() implementation,
> > > we do not need to record 'ptr' (which will be 'func')?
> >
> > My understanding is that we do not need to record in that case
> > because __kvfree_call_rcu() will simply invoke the almost-zero-cost
> > synchronize_rcu() and then invoke kfree().
> >
> > Johannes, Dmitry, Marco, anything that I am missing?
>
> As-is looks sensible - doing kasan_record_aux_stack_noalloc() only
> makes sense if the actual kfree() is not done with a callstack that
> will point at the kvfree_call_rcu() caller. Otherwise we're doing
> redundant work and just polluting the aux stack storage slots. So in
> the case where kvfree_call_rcu() does synchronize_rcu() and kfree()
> the kvfree_call_rcu() caller is in the callstack, and would be shown
> on use-after-free bugs.
Thank you for checking and for confirmation!
Thanx, Paul