Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:18 as permitted sender) client-ip=2620:137:e000::1:18;
Message-ID: <99faf6b0-30bf-f87c-2620-1eafb4eac1ac@gmail.com>
Date:   Wed, 1 Jun 2022 18:24:34 +0800
MIME-Version: 1.0
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:91.0) Gecko/20100101
 Thunderbird/91.9.1
Subject: Re: [PATCH] mm: kmemleak: check boundary of objects allocated with
 physical address when scan
Content-Language: en-US
To:     Catalin Marinas <catalin.marinas@arm.com>
Cc:     akpm@linux-foundation.org, linux-mm@kvack.org,
        linux-kernel@vger.kernel.org, yee.lee@mediatek.com
References: <20220531150823.1004101-1-patrick.wang.shcn@gmail.com>
 <YpZCWbfNE32EzCnz@arm.com>
From:   Patrick Wang <patrick.wang.shcn@gmail.com>
In-Reply-To: <YpZCWbfNE32EzCnz@arm.com>
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 7bit
Precedence: bulk


On 2022/6/1 00:29, Catalin Marinas wrote:
> On Tue, May 31, 2022 at 11:08:23PM +0800, Patrick Wang wrote:
>> @@ -1132,8 +1135,13 @@ EXPORT_SYMBOL(kmemleak_no_scan);
>>   void __ref kmemleak_alloc_phys(phys_addr_t phys, size_t size, int min_count,
>>   			       gfp_t gfp)
>>   {
>> -	if (PHYS_PFN(phys) >= min_low_pfn && PHYS_PFN(phys) < max_low_pfn)
>> -		kmemleak_alloc(__va(phys), size, min_count, gfp);
>> +	pr_debug("%s(0x%p, %zu, %d)\n", __func__, __va(phys), size, min_count);
> 
> I'd print just phys here since that's the function argument.

Will do.

> 
>> +	if (kmemleak_enabled && (unsigned long)__va(phys) >= PAGE_OFFSET &&
>> +	    !IS_ERR(__va(phys)))
>> +		/* create object with OBJECT_PHYS flag */
>> +		create_object((unsigned long)__va(phys), size, min_count,
>> +			      gfp, true);
> 
> Do we still need to check for __va(phys) >= PAGE_OFFSET? Also I don't
> think IS_ERR(__va(phys)) makes sense, we can't store an error in a
> physical address. The kmemleak_alloc_phys() function is only called on
> successful allocation, so shouldn't bother with error codes.

In this commit:
972fa3a7c17c(mm: kmemleak: alloc gray object for reserved
region with direct map)

The kmemleak_alloc_phys() function is called directly by passing
physical address from devicetree. So I'm concerned that could
__va() => __pa() convert always get the phys back? I thought
check for __va(phys) might help, but it probably dosen't work
and using IS_ERR is indeed inappropriate.

We might have to store phys in object and convert it via __va()
for normal use like:

#define object_pointer(obj)	\
	(obj->flags & OBJECT_PHYS ? (unsigned long)__va((void *)obj->pointer)	\
				: obj->pointer)

> 
>> @@ -1436,6 +1441,13 @@ static void kmemleak_scan(void)
>>   			dump_object_info(object);
>>   		}
>>   #endif
>> +
>> +		/* outside lowmem, make it black */
> 
> Maybe a bit more verbose:
> 
> 		/* ignore objects outside lowmem (paint them black) */

Will do.

> 
>> +		if (object->flags & OBJECT_PHYS)
>> +			if (PHYS_PFN(__pa((void *)object->pointer)) < min_low_pfn ||
>> +			    PHYS_PFN(__pa((void *)object->pointer)) >= max_low_pfn)
>> +				__paint_it(object, KMEMLEAK_BLACK);
> 
> I'd skip the checks if the object is OBJECT_NO_SCAN (side-effect of
> __paint_it()) so that the next scan won't have to go through the __pa()
> checks again. It's also probably more correct to check the upper object
> boundary). Something like:
> 
> 		if ((object->flags & OBJECT_PHYS) &&
> 		    !(object->flags & OBJECT_NO_SCAN)) {
> 			unsigned long phys = __pa((void *)object->pointer);
> 			if (PHYS_PFN(phys) < min_low_pfn ||
> 			    PHYS_PFN(phys + object->size) >= max_low_pfn)
> 				__paint_it(object, KMEMLEAK_BLACK);
> 		}

Right, much more thorough. Will do.

Thanks,
Patrick