Messages in this thread Patch in this message | | | From | Weizhao Ouyang <> | Subject | [PATCH] kasan: fix deadlock in start_report() | Date | Thu, 9 Feb 2023 10:45:36 +0800 |
| |
From: Shuai Yuan <yuanshuai@zeku.com>
Calling start_report() again between start_report() and end_report() will result in a race issue for the report_lock. In extreme cases this problem arose in Kunit tests in the hardware tag-based Kasan mode.
For example, when an invalid memory release problem is found, kasan_report_invalid_free() will print error log, but if an MTE exception is raised during the output log, the kasan_report() is called, resulting in a deadlock problem. The kasan_depth not protect it in hardware tag-based Kasan mode.
Signed-off-by: Shuai Yuan <yuanshuai@zeku.com> Reviewed-by: Weizhao Ouyang <ouyangweizhao@zeku.com> Reviewed-by: Peng Ren <renlipeng@zeku.com> --- mm/kasan/report.c | 26 +++++++++++++++++++++----- 1 file changed, 21 insertions(+), 5 deletions(-)
diff --git a/mm/kasan/report.c b/mm/kasan/report.c index 22598b20c7b7..82aa75259cf4 100644 --- a/mm/kasan/report.c +++ b/mm/kasan/report.c @@ -166,7 +166,7 @@ static inline void fail_non_kasan_kunit_test(void) { } static DEFINE_SPINLOCK(report_lock); -static void start_report(unsigned long *flags, bool sync) +static bool start_report(unsigned long *flags, bool sync) { fail_non_kasan_kunit_test(); /* Respect the /proc/sys/kernel/traceoff_on_warning interface. */ @@ -175,8 +175,14 @@ static void start_report(unsigned long *flags, bool sync) lockdep_off(); /* Make sure we don't end up in loop. */ kasan_disable_current(); - spin_lock_irqsave(&report_lock, *flags); + if (!spin_trylock_irqsave(&report_lock, *flags)) { + lockdep_on(); + kasan_enable_current(); + pr_err("%s ignore\n", __func__); + return false; + } pr_err("==================================================================\n"); + return true; } static void end_report(unsigned long *flags, void *addr) @@ -468,7 +474,10 @@ void kasan_report_invalid_free(void *ptr, unsigned long ip, enum kasan_report_ty if (unlikely(!report_enabled())) return; - start_report(&flags, true); + if (!start_report(&flags, true)) { + pr_err("%s: start report ignore\n", __func__); + return; + } memset(&info, 0, sizeof(info)); info.type = type; @@ -500,10 +509,14 @@ bool kasan_report(unsigned long addr, size_t size, bool is_write, if (unlikely(report_suppressed()) || unlikely(!report_enabled())) { ret = false; + pr_err("%s: start report ignore\n", __func__); goto out; } - start_report(&irq_flags, true); + if (!start_report(&irq_flags, true)) { + ret = false; + goto out; + } memset(&info, 0, sizeof(info)); info.type = KASAN_REPORT_ACCESS; @@ -536,7 +549,10 @@ void kasan_report_async(void) if (unlikely(!report_enabled())) return; - start_report(&flags, false); + if (!start_report(&flags, false)) { + pr_err("%s: start report ignore\n", __func__); + return; + } pr_err("BUG: KASAN: invalid-access\n"); pr_err("Asynchronous fault: no details available\n"); pr_err("\n"); -- 2.25.1
| |