From: Qian Cai <cai@xxxxxx> Subject: slub: fix a crash with SLUB_DEBUG + KASAN_SW_TAGS In process_slab(), "p = get_freepointer()" could return a tagged pointer, but "addr = page_address()" always return a native pointer. As the result, slab_index() is messed up here, return (p - addr) / s->size; All other callers of slab_index() have the same situation where "addr" is from page_address(), so just need to untag "p". # cat /sys/kernel/slab/hugetlbfs_inode_cache/alloc_calls [18868.759419] Unable to handle kernel paging request at virtual address 2bff808aa4856d48 [18868.767341] Mem abort info: [18868.770133] ESR = 0x96000007 [18868.773187] Exception class = DABT (current EL), IL = 32 bits [18868.779103] SET = 0, FnV = 0 [18868.782155] EA = 0, S1PTW = 0 [18868.785292] Data abort info: [18868.788170] ISV = 0, ISS = 0x00000007 [18868.792003] CM = 0, WnR = 0 [18868.794973] swapper pgtable: 64k pages, 48-bit VAs, pgdp = 0000000002498338 [18868.801932] [2bff808aa4856d48] pgd=00000097fcfd0003, pud=00000097fcfd0003, pmd=00000097fca30003, pte=00e8008b24850712 [18868.812597] Internal error: Oops: 96000007 [#1] SMP [18868.835088] CPU: 3 PID: 79210 Comm: read_all Tainted: G L 5.0.0-rc7+ #84 [18868.843087] Hardware name: HPE Apollo 70 /C01_APACHE_MB , BIOS L50_5.13_1.0.6 07/10/2018 [18868.852915] pstate: 00400089 (nzcv daIf +PAN -UAO) [18868.857710] pc : get_map+0x78/0xec [18868.861109] lr : get_map+0xa0/0xec [18868.864505] sp : aeff808989e3f8e0 [18868.867816] x29: aeff808989e3f940 x28: ffff800826200000 [18868.873128] x27: ffff100012d47000 x26: 9700000000002500 [18868.878440] x25: 0000000000000001 x24: 52ff8008200131f8 [18868.883753] x23: 52ff8008200130a0 x22: 52ff800820013098 [18868.889065] x21: ffff800826200000 x20: ffff100013172ba0 [18868.894377] x19: 2bff808a8971bc00 x18: ffff1000148f5538 [18868.899690] x17: 000000000000001b x16: 00000000000000ff [18868.905002] x15: ffff1000148f5000 x14: 00000000000000d2 [18868.910314] x13: 0000000000000001 x12: 0000000000000000 [18868.915626] x11: 0000000020000002 x10: 2bff808aa4856d48 [18868.920937] x9 : 0000020000000000 x8 : 68ff80082620ebb0 [18868.926249] x7 : 0000000000000000 x6 : ffff1000105da1dc [18868.931561] x5 : 0000000000000000 x4 : 0000000000000000 [18868.936872] x3 : 0000000000000010 x2 : 2bff808a8971bc00 [18868.942184] x1 : ffff7fe002098800 x0 : ffff80082620ceb0 [18868.947499] Process read_all (pid: 79210, stack limit = 0x00000000f65b9361) [18868.954454] Call trace: [18868.956899] get_map+0x78/0xec [18868.959952] process_slab+0x7c/0x47c [18868.963526] list_locations+0xb0/0x3c8 [18868.967273] alloc_calls_show+0x34/0x40 [18868.971107] slab_attr_show+0x34/0x48 [18868.974768] sysfs_kf_seq_show+0x2e4/0x570 [18868.978864] kernfs_seq_show+0x12c/0x1a0 [18868.982786] seq_read+0x48c/0xf84 [18868.986099] kernfs_fop_read+0xd4/0x448 [18868.989935] __vfs_read+0x94/0x5d4 [18868.993334] vfs_read+0xcc/0x194 [18868.996560] ksys_read+0x6c/0xe8 [18868.999786] __arm64_sys_read+0x68/0xb0 [18869.003622] el0_svc_handler+0x230/0x3bc [18869.007544] el0_svc+0x8/0xc [18869.010428] Code: d3467d2a 9ac92329 8b0a0e6a f9800151 (c85f7d4b) [18869.016742] ---[ end trace a383a9a44ff13176 ]--- [18869.021356] Kernel panic - not syncing: Fatal exception [18869.026705] SMP: stopping secondary CPUs [18870.254279] SMP: failed to stop secondary CPUs 1-7,32,40,127 [18870.259942] Kernel Offset: disabled [18870.263434] CPU features: 0x002,20000c18 [18870.267358] Memory Limit: none [18870.270725] ---[ end Kernel panic - not syncing: Fatal exception ]--- Link: http://lkml.kernel.org/r/20190220020251.82039-1-cai@xxxxxx Signed-off-by: Qian Cai <cai@xxxxxx> Reviewed-by: Andrey Konovalov <andreyknvl@xxxxxxxxxx> Signed-off-by: Andrew Morton <akpm@xxxxxxxxxxxxxxxxxxxx> --- --- a/mm/slub.c~slub-fix-a-crash-with-slub_debug-kasan_sw_tags +++ a/mm/slub.c @@ -317,7 +317,7 @@ static inline void set_freepointer(struc /* Determine object index from a given position */ static inline unsigned int slab_index(void *p, struct kmem_cache *s, void *addr) { - return (p - addr) / s->size; + return (kasan_reset_tag(p) - addr) / s->size; } static inline unsigned int order_objects(unsigned int order, unsigned int size) _