niansa-misc/linux
1
0
Fork 0
mirror of synced 2025-03-06 20:59:54 +01:00
Code Issues Projects Releases Packages Wiki Activity

kasan: don't call find_vm_area() in a PREEMPT_RT kernel

Browse source 
The following bug report was found when running a PREEMPT_RT debug kernel.

 BUG: sleeping function called from invalid context at kernel/locking/spinlock_rt.c:48
 in_atomic(): 1, irqs_disabled(): 1, non_block: 0, pid: 140605, name: kunit_try_catch
 preempt_count: 1, expected: 0

 Call trace:
  rt_spin_lock+0x70/0x140
  find_vmap_area+0x84/0x168
  find_vm_area+0x1c/0x50
  print_address_description.constprop.0+0x2a0/0x320
  print_report+0x108/0x1f8
  kasan_report+0x90/0xc8

Since commit e30a0361b8 ("kasan: make report_lock a raw spinlock"),
report_lock was changed to raw_spinlock_t to fix another similar
PREEMPT_RT problem.  That alone isn't enough to cover other corner cases.

print_address_description() is always invoked under the report_lock.  The
context under this lock is always atomic even on PREEMPT_RT. 
find_vm_area() acquires vmap_node::busy.lock which is a spinlock_t,
becoming a sleeping lock on PREEMPT_RT and must not be acquired in atomic
context.

Don't invoke find_vm_area() on PREEMPT_RT and just print the address. 
Non-PREEMPT_RT builds remain unchanged.  Add a DEFINE_WAIT_OVERRIDE_MAP()
macro to tell lockdep that this lock nesting is allowed because the
PREEMPT_RT part (which is invalid) has been taken care of.  This macro was
first introduced in commit 0cce06ba85 ("debugobjects,locking: Annotate
debug_object_fill_pool() wait type violation").

Link: https://lkml.kernel.org/r/20250217204402.60533-1-longman@redhat.com
Fixes: e30a0361b8 ("kasan: make report_lock a raw spinlock")
Signed-off-by: Waiman Long <longman@redhat.com>
Suggested-by: Andrey Konovalov <andreyknvl@gmail.com>
Reviewed-by: Andrey Konovalov <andreyknvl@gmail.com>
Cc: Alexander Potapenko <glider@google.com>
Cc: Andrey Ryabinin <ryabinin.a.a@gmail.com>
Cc: Dmitriy Vyukov <dvyukov@google.com>
Cc: Steven Rostedt <rostedt@goodmis.org>
Cc: Mariano Pache <npache@redhat.com>
Cc: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Cc: Vincenzo Frascino <vincenzo.frascino@arm.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
This commit is contained in:
Waiman Long 2025-02-17 15:44:02 -05:00 • committed by Andrew Morton
parent 4998a6fa2a
commit ac7af1f57a
1 changed files with 33 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

34
mm/kasan/report.c
View file

@ -370,6 +370,36 @@ static inline bool init_task_stack_addr(const void *addr)
sizeof(init_thread_union.stack));
}
/*
* This function is invoked with report_lock (a raw_spinlock) held. A
* PREEMPT_RT kernel cannot call find_vm_area() as it will acquire a sleeping
* rt_spinlock.
*
* For !RT kernel, the PROVE_RAW_LOCK_NESTING config option will print a
* lockdep warning for this raw_spinlock -> spinlock dependency. This config
* option is enabled by default to ensure better test coverage to expose this
* kind of RT kernel problem. This lockdep splat, however, can be suppressed
* by using DEFINE_WAIT_OVERRIDE_MAP() if it serves a useful purpose and the
* invalid PREEMPT_RT case has been taken care of.
*/
static inline struct vm_struct *kasan_find_vm_area(void *addr)
{
static DEFINE_WAIT_OVERRIDE_MAP(vmalloc_map, LD_WAIT_SLEEP);
struct vm_struct *va;
if (IS_ENABLED(CONFIG_PREEMPT_RT))
return NULL;
/*
* Suppress lockdep warning and fetch vmalloc area of the
* offending address.
*/
lock_map_acquire_try(&vmalloc_map);
va = find_vm_area(addr);
lock_map_release(&vmalloc_map);
return va;
}
static void print_address_description(void *addr, u8 tag,
struct kasan_report_info *info)
{
@ -399,7 +429,7 @@ static void print_address_description(void *addr, u8 tag,
}
if (is_vmalloc_addr(addr)) {
struct vm_struct *va = find_vm_area(addr);
struct vm_struct *va = kasan_find_vm_area(addr);
if (va) {
pr_err("The buggy address belongs to the virtual mapping at\n"
@ -409,6 +439,8 @@ static void print_address_description(void *addr, u8 tag,
pr_err("\n");
page = vmalloc_to_page(addr);
} else {
pr_err("The buggy address %px belongs to a vmalloc virtual mapping\n", addr);
}
}