Skip to content

Commit

Permalink
kasan: remove atomic accesses to stack ring entries
Browse files Browse the repository at this point in the history
Remove the atomic accesses to entry fields in save_stack_info and
kasan_complete_mode_report_info for tag-based KASAN modes.

These atomics are not required, as the read/write lock prevents the
entries from being read (in kasan_complete_mode_report_info) while being
written (in save_stack_info) and the try_cmpxchg prevents the same entry
from being rewritten (in save_stack_info) in the unlikely case of wrapping
during writing.

Link: https://lkml.kernel.org/r/29f59126d9845c5257b6c29cd7ad113b16f19f47.1700502145.git.andreyknvl@google.com
Signed-off-by: Andrey Konovalov <andreyknvl@google.com>
Reviewed-by: Alexander Potapenko <glider@google.com>
Cc: Dmitry Vyukov <dvyukov@google.com>
Cc: Evgenii Stepanov <eugenis@google.com>
Cc: Marco Elver <elver@google.com>
Cc: Oscar Salvador <osalvador@suse.de>
Cc: Vlastimil Babka <vbabka@suse.cz>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
  • Loading branch information
Andrey Konovalov authored and Andrew Morton committed Dec 11, 2023
1 parent 108be8d commit f3b5979
Show file tree
Hide file tree
Showing 2 changed files with 12 additions and 26 deletions.
25 changes: 7 additions & 18 deletions mm/kasan/report_tags.c
Original file line number Diff line number Diff line change
Expand Up @@ -31,10 +31,6 @@ void kasan_complete_mode_report_info(struct kasan_report_info *info)
unsigned long flags;
u64 pos;
struct kasan_stack_ring_entry *entry;
void *ptr;
u32 pid;
depot_stack_handle_t stack;
bool is_free;
bool alloc_found = false, free_found = false;

if ((!info->cache || !info->object) && !info->bug_type) {
Expand All @@ -61,27 +57,20 @@ void kasan_complete_mode_report_info(struct kasan_report_info *info)

entry = &stack_ring.entries[i % stack_ring.size];

/* Paired with smp_store_release() in save_stack_info(). */
ptr = (void *)smp_load_acquire(&entry->ptr);

if (kasan_reset_tag(ptr) != info->object ||
get_tag(ptr) != get_tag(info->access_addr))
if (kasan_reset_tag(entry->ptr) != info->object ||
get_tag(entry->ptr) != get_tag(info->access_addr))
continue;

pid = READ_ONCE(entry->pid);
stack = READ_ONCE(entry->stack);
is_free = READ_ONCE(entry->is_free);

if (is_free) {
if (entry->is_free) {
/*
* Second free of the same object.
* Give up on trying to find the alloc entry.
*/
if (free_found)
break;

info->free_track.pid = pid;
info->free_track.stack = stack;
info->free_track.pid = entry->pid;
info->free_track.stack = entry->stack;
free_found = true;

/*
Expand All @@ -95,8 +84,8 @@ void kasan_complete_mode_report_info(struct kasan_report_info *info)
if (alloc_found)
break;

info->alloc_track.pid = pid;
info->alloc_track.stack = stack;
info->alloc_track.pid = entry->pid;
info->alloc_track.stack = entry->stack;
alloc_found = true;

/*
Expand Down
13 changes: 5 additions & 8 deletions mm/kasan/tags.c
Original file line number Diff line number Diff line change
Expand Up @@ -121,15 +121,12 @@ static void save_stack_info(struct kmem_cache *cache, void *object,
if (!try_cmpxchg(&entry->ptr, &old_ptr, STACK_RING_BUSY_PTR))
goto next; /* Busy slot. */

WRITE_ONCE(entry->size, cache->object_size);
WRITE_ONCE(entry->pid, current->pid);
WRITE_ONCE(entry->stack, stack);
WRITE_ONCE(entry->is_free, is_free);
entry->size = cache->object_size;
entry->pid = current->pid;
entry->stack = stack;
entry->is_free = is_free;

/*
* Paired with smp_load_acquire() in kasan_complete_mode_report_info().
*/
smp_store_release(&entry->ptr, (s64)object);
entry->ptr = object;

read_unlock_irqrestore(&stack_ring.lock, flags);
}
Expand Down

0 comments on commit f3b5979

Please sign in to comment.