From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id 0F0ADC433EF for ; Fri, 27 May 2022 04:00:40 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id 74CC08D0003; Fri, 27 May 2022 00:00:40 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id 7208D8D0002; Fri, 27 May 2022 00:00:40 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 5BE8D8D0003; Fri, 27 May 2022 00:00:40 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0013.hostedemail.com [216.40.44.13]) by kanga.kvack.org (Postfix) with ESMTP id 45E988D0002 for ; Fri, 27 May 2022 00:00:40 -0400 (EDT) Received: from smtpin21.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay10.hostedemail.com (Postfix) with ESMTP id 1CC9D8D6 for ; Fri, 27 May 2022 04:00:40 +0000 (UTC) X-FDA: 79510171440.21.9D68E54 Received: from mailgw01.mediatek.com (mailgw01.mediatek.com [216.200.240.184]) by imf02.hostedemail.com (Postfix) with ESMTP id 8B8CB80047 for ; Fri, 27 May 2022 04:00:33 +0000 (UTC) X-UUID: bce9f715bc7a45b39e93055c25ff7d21-20220526 X-CID-P-RULE: Release_Ham X-CID-O-INFO: VERSION:1.1.5,REQID:30c5d019-fc61-46d2-946b-3b66d2e24f3f,OB:0,LO B:0,IP:0,URL:0,TC:0,Content:0,EDM:0,RT:0,SF:0,FILE:0,RULE:Release_Ham,ACTI ON:release,TS:0 X-CID-META: VersionHash:2a19b09,CLOUDID:c4f76fb8-3c45-407b-8f66-25095432a27a,C OID:IGNORED,Recheck:0,SF:nil,TC:nil,Content:0,EDM:-3,IP:nil,URL:1,File:nil ,QS:0,BEC:nil X-UUID: bce9f715bc7a45b39e93055c25ff7d21-20220526 Received: from mtkcas66.mediatek.inc [(172.29.193.44)] by mailgw01.mediatek.com (envelope-from ) (musrelay.mediatek.com ESMTP with TLSv1.2 ECDHE-RSA-AES256-SHA384 256/256) with ESMTP id 221746050; Thu, 26 May 2022 21:00:10 -0700 Received: from mtkmbs11n2.mediatek.inc (172.21.101.187) by MTKMBS62DR.mediatek.inc (172.29.94.18) with Microsoft SMTP Server (TLS) id 15.0.1497.2; Thu, 26 May 2022 21:00:08 -0700 Received: from mtkmbs11n2.mediatek.inc (172.21.101.187) by mtkmbs11n2.mediatek.inc (172.21.101.187) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.792.3; Fri, 27 May 2022 12:00:07 +0800 Received: from mtksdccf07 (172.21.84.99) by mtkmbs11n2.mediatek.inc (172.21.101.73) with Microsoft SMTP Server id 15.2.792.3 via Frontend Transport; Fri, 27 May 2022 12:00:07 +0800 Message-ID: Subject: Re: [PATCH] mm: kmemleak: take a full lowmem check in kmemleak_*_phys() From: Yee Lee To: Patrick Wang CC: , , , , , Date: Fri, 27 May 2022 12:00:07 +0800 In-Reply-To: <20220413122925.33856-1-patrick.wang.shcn@gmail.com> References: <20220413122925.33856-1-patrick.wang.shcn@gmail.com> Content-Type: text/plain; charset="UTF-8" X-Mailer: Evolution 3.28.5-0ubuntu0.18.04.2 MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-MTK: N X-Rspamd-Server: rspam06 X-Rspamd-Queue-Id: 8B8CB80047 X-Stat-Signature: 8bc57uq1dai3de5u7n1dxpy7o6r1ypik X-Rspam-User: Authentication-Results: imf02.hostedemail.com; dkim=none; dmarc=pass (policy=quarantine) header.from=mediatek.com; spf=pass (imf02.hostedemail.com: domain of yee.lee@mediatek.com designates 216.200.240.184 as permitted sender) smtp.mailfrom=yee.lee@mediatek.com X-HE-Tag: 1653624033-343869 X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: In arm64, some false leaks happen since memblock allocates memory eariler than that the pfn boundary (max_low_pfn/min_low_pfn) is initialized. I would relax the checking condidtion when the boundary is not ready. Please refer to the patch: https://lkml.org/lkml/2022/5/26/971 Not sure this work for the other archs like RISCV and for your situation. Please help to review it. On Wed, 2022-04-13 at 20:29 +0800, Patrick Wang wrote: > The kmemleak_*_phys() apis do not check the address for lowmem's min > boundary, while the caller may pass an address below lowmem, which > will trigger an oops: > > # echo scan > /sys/kernel/debug/kmemleak > [ 54.888353] Unable to handle kernel paging request at virtual > address ff5fffffffe00000 > [ 54.888932] Oops [#1] > [ 54.889102] Modules linked in: > [ 54.889326] CPU: 2 PID: 134 Comm: bash Not tainted 5.18.0-rc1- > next-20220407 #33 > [ 54.889620] Hardware name: riscv-virtio,qemu (DT) > [ 54.889901] epc : scan_block+0x74/0x15c > [ 54.890215] ra : scan_block+0x72/0x15c > [ 54.890390] epc : ffffffff801e5806 ra : ffffffff801e5804 sp : > ff200000104abc30 > [ 54.890607] gp : ffffffff815cd4e8 tp : ff60000004cfa340 t0 : > 0000000000000200 > [ 54.890835] t1 : 00aaaaaac23954cc t2 : 00000000000003ff s0 : > ff200000104abc90 > [ 54.891024] s1 : ffffffff81b0ff28 a0 : 0000000000000000 a1 : > ff5fffffffe01000 > [ 54.891201] a2 : ffffffff81b0ff28 a3 : 0000000000000002 a4 : > 0000000000000001 > [ 54.891377] a5 : 0000000000000000 a6 : ff200000104abd7c a7 : > 0000000000000005 > [ 54.891552] s2 : ff5fffffffe00ff9 s3 : ffffffff815cd998 s4 : > ffffffff815d0e90 > [ 54.891727] s5 : ffffffff81b0ff28 s6 : 0000000000000020 s7 : > ffffffff815d0eb0 > [ 54.891903] s8 : ffffffffffffffff s9 : ff5fffffffe00000 s10: > ff5fffffffe01000 > [ 54.892078] s11: 0000000000000022 t3 : 00ffffffaa17db4c t4 : > 000000000000000f > [ 54.892271] t5 : 0000000000000001 t6 : 0000000000000000 > [ 54.892408] status: 0000000000000100 badaddr: ff5fffffffe00000 > cause: 000000000000000d > [ 54.892643] [] scan_gray_list+0x12e/0x1a6 > [ 54.892824] [] kmemleak_scan+0x2aa/0x57e > [ 54.892961] [] kmemleak_write+0x32a/0x40c > [ 54.893096] [] full_proxy_write+0x56/0x82 > [ 54.893235] [] vfs_write+0xa6/0x2a6 > [ 54.893362] [] ksys_write+0x6c/0xe2 > [ 54.893487] [] sys_write+0x22/0x2a > [ 54.893609] [] ret_from_syscall+0x0/0x2 > [ 54.894183] ---[ end trace 0000000000000000 ]--- > > So check the address for lowmem's min boundary. > > Signed-off-by: Patrick Wang > --- > mm/kmemleak.c | 8 ++++---- > 1 file changed, 4 insertions(+), 4 deletions(-) > > diff --git a/mm/kmemleak.c b/mm/kmemleak.c > index acd7cbb82..a182f5dda 100644 > --- a/mm/kmemleak.c > +++ b/mm/kmemleak.c > @@ -1132,7 +1132,7 @@ EXPORT_SYMBOL(kmemleak_no_scan); > void __ref kmemleak_alloc_phys(phys_addr_t phys, size_t size, int > min_count, > gfp_t gfp) > { > - if (!IS_ENABLED(CONFIG_HIGHMEM) || PHYS_PFN(phys) < > max_low_pfn) > + if (PHYS_PFN(phys) >= min_low_pfn && PHYS_PFN(phys) < > max_low_pfn) > kmemleak_alloc(__va(phys), size, min_count, gfp); > } > EXPORT_SYMBOL(kmemleak_alloc_phys); > @@ -1146,7 +1146,7 @@ EXPORT_SYMBOL(kmemleak_alloc_phys); > */ > void __ref kmemleak_free_part_phys(phys_addr_t phys, size_t size) > { > - if (!IS_ENABLED(CONFIG_HIGHMEM) || PHYS_PFN(phys) < > max_low_pfn) > + if (PHYS_PFN(phys) >= min_low_pfn && PHYS_PFN(phys) < > max_low_pfn) > kmemleak_free_part(__va(phys), size); > } > EXPORT_SYMBOL(kmemleak_free_part_phys); > @@ -1158,7 +1158,7 @@ EXPORT_SYMBOL(kmemleak_free_part_phys); > */ > void __ref kmemleak_not_leak_phys(phys_addr_t phys) > { > - if (!IS_ENABLED(CONFIG_HIGHMEM) || PHYS_PFN(phys) < > max_low_pfn) > + if (PHYS_PFN(phys) >= min_low_pfn && PHYS_PFN(phys) < > max_low_pfn) > kmemleak_not_leak(__va(phys)); > } > EXPORT_SYMBOL(kmemleak_not_leak_phys); > @@ -1170,7 +1170,7 @@ EXPORT_SYMBOL(kmemleak_not_leak_phys); > */ > void __ref kmemleak_ignore_phys(phys_addr_t phys) > { > - if (!IS_ENABLED(CONFIG_HIGHMEM) || PHYS_PFN(phys) < > max_low_pfn) > + if (PHYS_PFN(phys) >= min_low_pfn && PHYS_PFN(phys) < > max_low_pfn) > kmemleak_ignore(__va(phys)); > } > EXPORT_SYMBOL(kmemleak_ignore_phys);