Received-SPF: pass (google.com: domain of linux-kernel+bounces-104626-linux.lists.archive=gmail.com@vger.kernel.org designates 2604:1380:40f1:3f00::1 as permitted sender) client-ip=2604:1380:40f1:3f00::1;
Date: Fri, 15 Mar 2024 17:32:05 +0100
From: Ilya Leoshkevich <iii@linux.ibm.com>
To: Mark Rutland <mark.rutland@arm.com>, Changbin Du <changbin.du@huawei.com>
Cc: Ingo Molnar <mingo@redhat.com>, Andrew Morton <akpm@linux-foundation.org>,
        Peter Zijlstra <peterz@infradead.org>,
        Juri Lelli <juri.lelli@redhat.com>,
        Vincent Guittot <vincent.guittot@linaro.org>,
        Dietmar Eggemann <dietmar.eggemann@arm.com>,
        Steven Rostedt <rostedt@goodmis.org>, Ben Segall <bsegall@google.com>,
        Mel Gorman <mgorman@suse.de>,
        Daniel Bristot de Oliveira <bristot@redhat.com>,
        Valentin Schneider <vschneid@redhat.com>, kasan-dev@googlegroups.com,
        linux-mm@kvack.org, Alexander Potapenko <glider@google.com>,
        linux-kernel@vger.kernel.org, Marco Elver <elver@google.com>
Subject: Re: [PATCH] mm: kmsan: fix instrumentation recursion on preempt_count
Message-ID: <lisylv2horoqxszuajysz6gp5nv4pkfhtdehi7wkp3oidao6dj@djh3zzri56dt>
References: <20240311112330.372158-1-changbin.du@huawei.com>
 <Ze7uJUynNXDjLmmn@FVFF77S0Q05N>
Precedence: bulk
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <Ze7uJUynNXDjLmmn@FVFF77S0Q05N>

On Mon, Mar 11, 2024 at 11:42:29AM +0000, Mark Rutland wrote:
> On Mon, Mar 11, 2024 at 07:23:30PM +0800, Changbin Du wrote:
> > This disables msan check for preempt_count_{add,sub} to fix a
> > instrumentation recursion issue on preempt_count:
> > 
> >   __msan_metadata_ptr_for_load_4() -> kmsan_virt_addr_valid() ->
> > 	preempt_disable() -> __msan_metadata_ptr_for_load_4()
> > 
> > With this fix, I was able to run kmsan kernel with:
> >   o CONFIG_DEBUG_KMEMLEAK=n
> >   o CONFIG_KFENCE=n
> >   o CONFIG_LOCKDEP=n
> > 
> > KMEMLEAK and KFENCE generate too many false positives in unwinding code.
> > LOCKDEP still introduces instrumenting recursions issue. But these are
> > other issues expected to be fixed.
> > 
> > Cc: Marco Elver <elver@google.com>
> > Signed-off-by: Changbin Du <changbin.du@huawei.com>
> > ---
> >  kernel/sched/core.c | 4 ++--
> >  1 file changed, 2 insertions(+), 2 deletions(-)
> > 
> > diff --git a/kernel/sched/core.c b/kernel/sched/core.c
> > index 9116bcc90346..5b63bb98e60a 100644
> > --- a/kernel/sched/core.c
> > +++ b/kernel/sched/core.c
> > @@ -5848,7 +5848,7 @@ static inline void preempt_latency_start(int val)
> >  	}
> >  }
> >  
> > -void preempt_count_add(int val)
> > +void __no_kmsan_checks preempt_count_add(int val)
> >  {
> >  #ifdef CONFIG_DEBUG_PREEMPT
> >  	/*
> > @@ -5880,7 +5880,7 @@ static inline void preempt_latency_stop(int val)
> >  		trace_preempt_on(CALLER_ADDR0, get_lock_parent_ip());
> >  }
> 
> What prevents a larger loop via one of the calles of preempt_count_{add,sub}()
> 
> For example, via preempt_latency_{start,stop}() ?
> 
> ... or via some *other* instrumentation that might be placed in those?
> 
> I suspect we should be using noinstr or __always_inline in a bunch of places to
> clean this up properly.
> 
> Mark.

Hi,

I tried the patch with the ftrace testsuite, and this uncovered another
loop, as predicted here:

preempt_count_add():int3
  function_trace_call()
    __msan_metadata_ptr_for_load_8()
      kmsan_get_shadow_origin_ptr()
        kmsan_get_metadata()
          virt_to_page_or_null()
            preempt_count_add()

Best regards,
Ilya