Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752605AbbB1AHc (ORCPT ); Fri, 27 Feb 2015 19:07:32 -0500 Received: from ozlabs.org ([103.22.144.67]:37457 "EHLO ozlabs.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1750761AbbB1AHa (ORCPT ); Fri, 27 Feb 2015 19:07:30 -0500 From: Rusty Russell To: Andrey Ryabinin , Andrew Morton Cc: linux-mm@kvack.org, linux-kernel@vger.kernel.org, Andrey Ryabinin , Dmitry Vyukov Subject: Re: [PATCH 1/2] kasan, module, vmalloc: rework shadow allocation for modules In-Reply-To: <1425049816-11385-1-git-send-email-a.ryabinin@samsung.com> References: <1425049816-11385-1-git-send-email-a.ryabinin@samsung.com> User-Agent: Notmuch/0.17 (http://notmuchmail.org) Emacs/24.3.1 (x86_64-pc-linux-gnu) Date: Sat, 28 Feb 2015 09:31:28 +1030 Message-ID: <87egpbklh3.fsf@rustcorp.com.au> MIME-Version: 1.0 Content-Type: text/plain Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 1664 Lines: 42 Andrey Ryabinin writes: > Current approach in handling shadow memory for modules is broken. > > Shadow memory could be freed only after memory shadow corresponds > it is no longer used. > vfree() called from interrupt context could use memory its > freeing to store 'struct llist_node' in it: > > void vfree(const void *addr) > { > ... > if (unlikely(in_interrupt())) { > struct vfree_deferred *p = this_cpu_ptr(&vfree_deferred); > if (llist_add((struct llist_node *)addr, &p->list)) > schedule_work(&p->wq); > > Latter this list node used in free_work() which actually frees memory. > Currently module_memfree() called in interrupt context will free > shadow before freeing module's memory which could provoke kernel > crash. > So shadow memory should be freed after module's memory. > However, such deallocation order could race with kasan_module_alloc() > in module_alloc(). > > Free shadow right before releasing vm area. At this point vfree()'d > memory is not used anymore and yet not available for other allocations. > New VM_KASAN flag used to indicate that vm area has dynamically allocated > shadow memory so kasan frees shadow only if it was previously allocated. > > Signed-off-by: Andrey Ryabinin > Cc: Dmitry Vyukov > Cc: Rusty Russell Acked-by: Rusty Russell Thanks! Rusty. -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/