From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id 1C8EFC433F5 for ; Tue, 18 Jan 2022 22:38:35 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id 3FE1C6B0072; Tue, 18 Jan 2022 17:38:35 -0500 (EST) Received: by kanga.kvack.org (Postfix, from userid 40) id 3AD4C6B0073; Tue, 18 Jan 2022 17:38:35 -0500 (EST) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 2753B6B0074; Tue, 18 Jan 2022 17:38:35 -0500 (EST) X-Delivered-To: linux-mm@kvack.org Received: from forelay.hostedemail.com (smtprelay0006.hostedemail.com [216.40.44.6]) by kanga.kvack.org (Postfix) with ESMTP id 196946B0072 for ; Tue, 18 Jan 2022 17:38:35 -0500 (EST) Received: from smtpin10.hostedemail.com (10.5.19.251.rfc1918.com [10.5.19.251]) by forelay01.hostedemail.com (Postfix) with ESMTP id C6A8E1809AEEF for ; Tue, 18 Jan 2022 22:38:34 +0000 (UTC) X-FDA: 79044873348.10.6E583F5 Received: from mail-ua1-f45.google.com (mail-ua1-f45.google.com [209.85.222.45]) by imf10.hostedemail.com (Postfix) with ESMTP id 6AB4BC0003 for ; Tue, 18 Jan 2022 22:38:34 +0000 (UTC) Received: by mail-ua1-f45.google.com with SMTP id w21so960057uan.7 for ; Tue, 18 Jan 2022 14:38:34 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20210112; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=sFIPDwsDeRm81c05CD5S02oyUJN8DIpI+1GsvDMiep4=; b=Jfugtf9FbGJis6uBQ4CdXc/8nGduDpvhXy+a27fLvitVKGrLopKpViHKRTXSVXqewY cjAWMe19MPI2EVo2djGEGz3qllkZkYd9nbf6TEsLnVMTi+FdIzdmDADcm1tWu3ntoMqg vfgyvwacp89WuvL7BspNzyyBXpxQOeOTwYHhEvOq+me4IzdfiNkJtn7VmqCiMBwSxl9h j+jXpUvZ4pNBWhLTHMuNeOppkdgSynwqMWguZVWhdgyq3B6q2k8tEY0eCQNIA4A6BNni +wvxQlo2GGOJv9x2DtpxzkWVdwKdzQSbqFeGqcCgMHoL4pLIwsmJvkO3bhyzQMQqMe4Z BTEw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=sFIPDwsDeRm81c05CD5S02oyUJN8DIpI+1GsvDMiep4=; b=03V/JmvxGxbSEz74cWBbpjoX+8GnvNAVSyTiKCNYMYso6oqeVc/lDtH402Hc4zsKB8 nE+kfYUg/gLXbHXgvxDlxsLvRBHcG4NLmOW9KwVVhWQbrH0K7k0hAREY7LJeESvIfw2C 2FYfwrZQTA6UCg0JIB5z2OsSbC2sxRrat5vBnJBYLBbt3B48xyUvyYM2EyWjMxcEYIR2 YJ866wQMfgBY4Hv10KopRmA8OSM1VKaiCTkjLwz0wwRdJVTk9U8hpZA99tpHlrTVNIxN rI5yrR0Qrz7TrrFQ6d0oTg+lM4Ybe5Palzypp2O8iZ+UOCCs8wwdg/beaDGK5SZz/Ge9 UT1w== X-Gm-Message-State: AOAM532Q4E5mA9SguMA0dArmz2fgehZYwRL+tzR2bHvCqXecTsiMDZzn TYQ2GBp5WvHES+KeG/OXvkVyvv/gxnFErKn5ulT5/A== X-Google-Smtp-Source: ABdhPJxQh1t44Frfz/2XYxwpy7ZXI1lO+ncbRUGm6GBcUykDOdHTvp8gIOSQksTNoWrRHe66Sh+aumcYSnD4CXhOpo4= X-Received: by 2002:a67:ebc2:: with SMTP id y2mr3183653vso.72.1642545513445; Tue, 18 Jan 2022 14:38:33 -0800 (PST) MIME-Version: 1.0 References: <20220113031434.464992-1-pcc@google.com> In-Reply-To: From: Peter Collingbourne Date: Tue, 18 Jan 2022 14:38:22 -0800 Message-ID: Subject: Re: [PATCH] mm: use compare-exchange operation to set KASAN page tag To: Andrey Konovalov Cc: Andrew Morton , Linux Memory Management List , LKML , "# 3.4.x" Content-Type: text/plain; charset="UTF-8" X-Rspamd-Server: rspam11 X-Rspamd-Queue-Id: 6AB4BC0003 X-Stat-Signature: kc78b965bpsdyy4k4ntci7aek83of7z7 Authentication-Results: imf10.hostedemail.com; dkim=pass header.d=google.com header.s=20210112 header.b=Jfugtf9F; dmarc=pass (policy=reject) header.from=google.com; spf=pass (imf10.hostedemail.com: domain of pcc@google.com designates 209.85.222.45 as permitted sender) smtp.mailfrom=pcc@google.com X-HE-Tag: 1642545514-255569 X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: On Fri, Jan 14, 2022 at 1:58 PM Andrey Konovalov wrote: > > On Thu, Jan 13, 2022 at 6:14 AM Peter Collingbourne wrote: > > > > It has been reported that the tag setting operation on newly-allocated > > pages can cause the page flags to be corrupted when performed > > concurrently with other flag updates as a result of the use of > > non-atomic operations. > > Is it know how exactly this race happens? Why are flags for a newly > allocated page being accessed concurrently? In the report that we received, the race resulted in a crash in kswapd. This may just be a symptom of the problem though. I haven't closely audited all of the callers to page_kasan_tag_set() to check whether they may be operating on already-visible pages, but at least it doesn't appear to be unanticipated that there may be other threads accessing the page flags concurrently with a call to page_kasan_tag_set() (see the calls to smp_wmb() in arch/arm64/kernel/mte.c, arch/arm64/mm/copypage.c and arch/arm64/mm/mteswap.c). > > Fix the problem by using a compare-exchange > > loop to update the tag. > > > > Signed-off-by: Peter Collingbourne > > Link: https://linux-review.googlesource.com/id/I456b24a2b9067d93968d43b4bb3351c0cec63101 > > Fixes: 2813b9c02962 ("kasan, mm, arm64: tag non slab memory allocated via pagealloc") > > Cc: stable@vger.kernel.org > > --- > > include/linux/mm.h | 16 +++++++++++----- > > 1 file changed, 11 insertions(+), 5 deletions(-) > > > > diff --git a/include/linux/mm.h b/include/linux/mm.h > > index c768a7c81b0b..b544b0a9f537 100644 > > --- a/include/linux/mm.h > > +++ b/include/linux/mm.h > > @@ -1531,11 +1531,17 @@ static inline u8 page_kasan_tag(const struct page *page) > > > > static inline void page_kasan_tag_set(struct page *page, u8 tag) > > { > > - if (kasan_enabled()) { > > - tag ^= 0xff; > > - page->flags &= ~(KASAN_TAG_MASK << KASAN_TAG_PGSHIFT); > > - page->flags |= (tag & KASAN_TAG_MASK) << KASAN_TAG_PGSHIFT; > > - } > > + unsigned long old_flags, flags; > > + > > + if (!kasan_enabled()) > > + return; > > + > > + tag ^= 0xff; > > + do { > > + old_flags = flags = page->flags; > > I guess this should be at least READ_ONCE(page->flags) if we care > about concurrency. Makes sense. I copied this code from page_cpupid_xchg_last() in mm/mmzone.c which has the same problem. I'll send a patch to fix that one as well. Peter