Re: [PATCH] mm: page_alloc: fix page_poison=1 / INIT_ON_ALLOC_DEFAULT_ON interaction

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



‐‐‐‐‐‐‐ Original Message ‐‐‐‐‐‐‐

On Wednesday, July 14th, 2021 at 5:10 AM, Kees Cook <keescook@xxxxxxxxxxxx> wrote:

> On Mon, Jul 12, 2021 at 10:58:16PM +0100, Sergei Trofimovich wrote:
> 

> > To reproduce the failure we need the following system:
> > 

> > -   kernel command: page_poison=1 init_on_free=0 init_on_alloc=0
> >     

> > -   kernel config:
> >     

> >     -   CONFIG_INIT_ON_ALLOC_DEFAULT_ON=y
> >     -   CONFIG_INIT_ON_FREE_DEFAULT_ON=y
> >     -   CONFIG_PAGE_POISONING=y
> >     

> >     0000000085629bdd: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
> >     

> >     0000000022861832: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
> >     

> >     00000000c597f5b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
> >     

> >     CPU: 11 PID: 15195 Comm: bash Kdump: loaded Tainted: G U O 5.13.1-gentoo-x86_64 #1
> >     

> >     Hardware name: System manufacturer System Product Name/PRIME Z370-A, BIOS 2801 01/13/2021
> >     

> >     Call Trace:
> >     

> >     dump_stack+0x64/0x7c
> >     

> >     __kernel_unpoison_pages.cold+0x48/0x84
> >     

> >     post_alloc_hook+0x60/0xa0
> >     

> >     get_page_from_freelist+0xdb8/0x1000
> >     

> >     __alloc_pages+0x163/0x2b0
> >     

> >     __get_free_pages+0xc/0x30
> >     

> >     pgd_alloc+0x2e/0x1a0
> >     

> >     ? dup_mm+0x37/0x4f0
> >     

> >     mm_init+0x185/0x270
> >     

> >     dup_mm+0x6b/0x4f0
> >     

> >     ? __lock_task_sighand+0x35/0x70
> >     

> >     copy_process+0x190d/0x1b10
> >     

> >     kernel_clone+0xba/0x3b0
> >     

> >     __do_sys_clone+0x8f/0xb0
> >     

> >     do_syscall_64+0x68/0x80
> >     

> >     ? do_syscall_64+0x11/0x80
> >     

> >     entry_SYSCALL_64_after_hwframe+0x44/0xae
> >     

> > 

> > Before the 51cba1eb ("init_on_alloc: Optimize static branches")
> > 

> > init_on_alloc never enabled static branch by default. It could
> > 

> > only be enabed explicitly by init_mem_debugging_and_hardening().
> 

> But init_mem_debugging_and_hardening() is always called (by mm_init()).
> 

> > But after the 51cba1eb static branch could already be enabled
> > 

> > by default. There was no code to ever disable it. That caused
> > 

> > page_poison=1 / init_on_free=1 conflict.
> > 

> > This change extends init_mem_debugging_and_hardening() to also
> > 

> > disable static branch disabling.
> > 

> > CC: Andrew Morton akpm@xxxxxxxxxxxxxxxxxxxx
> > 

> > CC: Kees Cook keescook@xxxxxxxxxxxx
> > 

> > CC: Alexander Potapenko glider@xxxxxxxxxx
> > 

> > CC: Thomas Gleixner tglx@xxxxxxxxxxxxx
> > 

> > CC: Vlastimil Babka vbabka@xxxxxxx
> > 

> > CC: linux-mm@xxxxxxxxx
> > 

> > Reported-by: bowsingbetee@xxxxx
> > 

> > Reported-by: Mikhail Morfikov
> > 

> > Fixes: 51cba1eb ("init_on_alloc: Optimize static branches")
> > 

> > Signed-off-by: Sergei Trofimovich slyfox@xxxxxxxxxx
> > -----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
> > 

> > mm/page_alloc.c | 16 ++++++++++------
> > 

> > 1 file changed, 10 insertions(+), 6 deletions(-)
> > 

> > diff --git a/mm/page_alloc.c b/mm/page_alloc.c
> > 

> > index 3b97e17806be..46cb4a9c2b50 100644
> > 

> > --- a/mm/page_alloc.c
> > 

> > +++ b/mm/page_alloc.c
> > 

> > @@ -840,18 +840,22 @@ void init_mem_debugging_and_hardening(void)
> > 

> > }
> > 

> > #endif
> > 

> > -   if (_init_on_alloc_enabled_early) {
> > -       if (page_poisoning_requested)
> >         

> >     

> > 

> > -   if (_init_on_alloc_enabled_early ||
> > -       IS_ENABLED(CONFIG_INIT_ON_ALLOC_DEFAULT_ON)) {
> >         

> >     

> 

> This doesn't look right. _init_on_alloc_enabled_early already has the
> 

> same value:
> 

> static bool _init_on_alloc_enabled_early __read_mostly
> 

> = IS_ENABLED(CONFIG_INIT_ON_ALLOC_DEFAULT_ON);
> 

> So checking this is just a side-effect of how static_branch_maybe()
> 

> happens to be behaving.
> 

> > -       if (page_poisoning_requested) {
> >         	pr_info("mem auto-init: CONFIG_PAGE_POISONING is on, "
> >         		"will take precedence over init_on_alloc\\n");
> >         

> >     

> > 

> > -       else
> >         

> >     

> > 

> > -       	static_branch_disable(&init_on_alloc);
> >         

> >     

> > -       } else
> >         	static_branch_enable(&init_on_alloc);
> >         

> >     

> >     }
> > 

> > -   if (_init_on_free_enabled_early) {
> > -       if (page_poisoning_requested)
> >         

> >     

> > 

> > -   if (_init_on_free_enabled_early ||
> > -       IS_ENABLED(CONFIG_INIT_ON_FREE_DEFAULT_ON)) {
> >         

> >     

> > -       if (page_poisoning_requested) {
> >         	pr_info("mem auto-init: CONFIG_PAGE_POISONING is on, "
> >         		"will take precedence over init_on_free\\n");
> >         

> >     

> > 

> > -       else
> >         

> >     

> > 

> > -       	static_branch_disable(&init_on_free);
> >         

> >     

> > -       } else
> >         	static_branch_enable(&init_on_free);
> >         

> >     

> >     }
> 

> I think it would be better to clean this up without additional
> 

> confusion involving the CONFIGs:
> 

> diff --git a/mm/page_alloc.c b/mm/page_alloc.c
> 

> index 3b97e17806be..1f19365bc158 100644
> 

> --- a/mm/page_alloc.c
> 

> +++ b/mm/page_alloc.c
> 

> @@ -840,21 +840,24 @@ void init_mem_debugging_and_hardening(void)
> 

> }
> 

> #endif
> 

> -   if (_init_on_alloc_enabled_early) {
> -         if (page_poisoning_requested)
>         

>     

> -         	pr_info("mem auto-init: CONFIG_PAGE_POISONING is on, "
>         

>     

> -         		"will take precedence over init_on_alloc\\n");
>         

>     

> -         else
>         

>     

> -         	static_branch_enable(&init_on_alloc);
>         

>     

> -   }
> -   if (_init_on_free_enabled_early) {
> -         if (page_poisoning_requested)
>         

>     

> -         	pr_info("mem auto-init: CONFIG_PAGE_POISONING is on, "
>         

>     

> -         		"will take precedence over init_on_free\\n");
>         

>     

> -         else
>         

>     

> -         	static_branch_enable(&init_on_free);
>         

>     

> 

> -   if ((_init_on_alloc_enabled_early || _init_on_free_enabled_early) &&
> -         page_poisoning_requested) {
>         

>     

> -         pr_info("mem auto-init: CONFIG_PAGE_POISONING is on, "
>         

>     

> -         	"will take precedence over init_on_alloc and init_on_free\\n");
>         


B & C variants show this message and A does not, which is what I would expect to happen.

Tested variants:

A. "page_poison=1 init_on_free=0 init_on_alloc=0 slub_debug=P"
B. "page_poison=1 init_on_free=0 init_on_alloc=0 slub_debug=P init_on_free=1"
C. "page_poison=1 slub_debug=P"

in common:
CONFIG_INIT_ON_ALLOC_DEFAULT_ON=y
CONFIG_INIT_ON_FREE_DEFAULT_ON=y
CONFIG_PAGE_POISONING=y
CONFIG_SLUB_DEBUG=y
CONFIG_SLUB=y

(the slub parts don't matter, ignore them)

>     

> -         _init_on_alloc_enabled_early = false;
>         

>     

> -         _init_on_free_enabled_early = false;
>         

>     

>     }
> -   if (_init_on_alloc_enabled_early)
> -         static_branch_enable(&init_on_alloc);
>         

>     

> -   else
> -         static_branch_disable(&init_on_alloc);
>         

>     

> 

> -   if (_init_on_free_enabled_early)
> -         static_branch_enable(&init_on_free);
>         

>     

> -   else
> -         static_branch_disable(&init_on_free);
>         

>     

> 

> #ifdef CONFIG_DEBUG_PAGEALLOC
> 

> if (!debug_pagealloc_enabled())
> 

> return;
> 

> ------------------------------------------------------------------------
> 

> Kees Cook

While both patches(Sergei's, and yours) work for me, I'll be using this one for now.

Thank you for your work!
Cheers!

Attachment: publickey - bowsingbetee@protonmail.com - 0x65EDD6AE.asc
Description: application/pgp-keys

Attachment: signature.asc
Description: OpenPGP digital signature


[Index of Archives]     [Linux ARM Kernel]     [Linux ARM]     [Linux Omap]     [Fedora ARM]     [IETF Annouce]     [Bugtraq]     [Linux OMAP]     [Linux MIPS]     [eCos]     [Asterisk Internet PBX]     [Linux API]

  Powered by Linux