Skip to content

Commit 79357cd

Browse files
urezkiakpm00
urezki
authored and
akpm00
committed
mm/vmalloc, mm/kasan: respect gfp mask in kasan_populate_vmalloc()
kasan_populate_vmalloc() and its helpers ignore the caller's gfp_mask and always allocate memory using the hardcoded GFP_KERNEL flag. This makes them inconsistent with vmalloc(), which was recently extended to support GFP_NOFS and GFP_NOIO allocations. Page table allocations performed during shadow population also ignore the external gfp_mask. To preserve the intended semantics of GFP_NOFS and GFP_NOIO, wrap the apply_to_page_range() calls into the appropriate memalloc scope. xfs calls vmalloc with GFP_NOFS, so this bug could lead to deadlock. There was a report here https://lkml.kernel.org/r/686ea951.050a0220.385921.0016.GAE@google.com This patch: - Extends kasan_populate_vmalloc() and helpers to take gfp_mask; - Passes gfp_mask down to alloc_pages_bulk() and __get_free_page(); - Enforces GFP_NOFS/NOIO semantics with memalloc_*_save()/restore() around apply_to_page_range(); - Updates vmalloc.c and percpu allocator call sites accordingly. Link: https://lkml.kernel.org/r/20250831121058.92971-1-urezki@gmail.com Fixes: 451769e ("mm/vmalloc: alloc GFP_NO{FS,IO} for vmalloc") Signed-off-by: Uladzislau Rezki (Sony) <urezki@gmail.com> Reported-by: syzbot+3470c9ffee63e4abafeb@syzkaller.appspotmail.com Reviewed-by: Andrey Ryabinin <ryabinin.a.a@gmail.com> Cc: Baoquan He <bhe@redhat.com> Cc: Michal Hocko <mhocko@kernel.org> Cc: Alexander Potapenko <glider@google.com> Cc: Andrey Konovalov <andreyknvl@gmail.com> Cc: Dmitry Vyukov <dvyukov@google.com> Cc: Vincenzo Frascino <vincenzo.frascino@arm.com> Cc: <stable@vger.kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
1 parent 04100f7 commit 79357cd

File tree

3 files changed

+31
-14
lines changed

3 files changed

+31
-14
lines changed

‎include/linux/kasan.h‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -562,7 +562,7 @@ static inline void kasan_init_hw_tags(void) { }
562562
#if defined(CONFIG_KASAN_GENERIC) || defined(CONFIG_KASAN_SW_TAGS)
563563

564564
void kasan_populate_early_vm_area_shadow(void *start, unsigned long size);
565-
int kasan_populate_vmalloc(unsigned long addr, unsigned long size);
565+
int kasan_populate_vmalloc(unsigned long addr, unsigned long size, gfp_t gfp_mask);
566566
void kasan_release_vmalloc(unsigned long start, unsigned long end,
567567
unsigned long free_region_start,
568568
unsigned long free_region_end,
@@ -574,7 +574,7 @@ static inline void kasan_populate_early_vm_area_shadow(void *start,
574574
unsigned long size)
575575
{ }
576576
static inline int kasan_populate_vmalloc(unsigned long start,
577-
unsigned long size)
577+
unsigned long size, gfp_t gfp_mask)
578578
{
579579
return 0;
580580
}
@@ -610,7 +610,7 @@ static __always_inline void kasan_poison_vmalloc(const void *start,
610610
static inline void kasan_populate_early_vm_area_shadow(void *start,
611611
unsigned long size) { }
612612
static inline int kasan_populate_vmalloc(unsigned long start,
613-
unsigned long size)
613+
unsigned long size, gfp_t gfp_mask)
614614
{
615615
return 0;
616616
}

‎mm/kasan/shadow.c‎

Lines changed: 24 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -336,13 +336,13 @@ static void ___free_pages_bulk(struct page **pages, int nr_pages)
336336
}
337337
}
338338

339-
static int ___alloc_pages_bulk(struct page **pages, int nr_pages)
339+
static int ___alloc_pages_bulk(struct page **pages, int nr_pages, gfp_t gfp_mask)
340340
{
341341
unsigned long nr_populated, nr_total = nr_pages;
342342
struct page **page_array = pages;
343343

344344
while (nr_pages) {
345-
nr_populated = alloc_pages_bulk(GFP_KERNEL, nr_pages, pages);
345+
nr_populated = alloc_pages_bulk(gfp_mask, nr_pages, pages);
346346
if (!nr_populated) {
347347
___free_pages_bulk(page_array, nr_total - nr_pages);
348348
return -ENOMEM;
@@ -354,25 +354,42 @@ static int ___alloc_pages_bulk(struct page **pages, int nr_pages)
354354
return 0;
355355
}
356356

357-
static int __kasan_populate_vmalloc(unsigned long start, unsigned long end)
357+
static int __kasan_populate_vmalloc(unsigned long start, unsigned long end, gfp_t gfp_mask)
358358
{
359359
unsigned long nr_pages, nr_total = PFN_UP(end - start);
360360
struct vmalloc_populate_data data;
361+
unsigned int flags;
361362
int ret = 0;
362363

363-
data.pages = (struct page **)__get_free_page(GFP_KERNEL | __GFP_ZERO);
364+
data.pages = (struct page **)__get_free_page(gfp_mask | __GFP_ZERO);
364365
if (!data.pages)
365366
return -ENOMEM;
366367

367368
while (nr_total) {
368369
nr_pages = min(nr_total, PAGE_SIZE / sizeof(data.pages[0]));
369-
ret = ___alloc_pages_bulk(data.pages, nr_pages);
370+
ret = ___alloc_pages_bulk(data.pages, nr_pages, gfp_mask);
370371
if (ret)
371372
break;
372373

373374
data.start = start;
375+
376+
/*
377+
* page tables allocations ignore external gfp mask, enforce it
378+
* by the scope API
379+
*/
380+
if ((gfp_mask & (__GFP_FS | __GFP_IO)) == __GFP_IO)
381+
flags = memalloc_nofs_save();
382+
else if ((gfp_mask & (__GFP_FS | __GFP_IO)) == 0)
383+
flags = memalloc_noio_save();
384+
374385
ret = apply_to_page_range(&init_mm, start, nr_pages * PAGE_SIZE,
375386
kasan_populate_vmalloc_pte, &data);
387+
388+
if ((gfp_mask & (__GFP_FS | __GFP_IO)) == __GFP_IO)
389+
memalloc_nofs_restore(flags);
390+
else if ((gfp_mask & (__GFP_FS | __GFP_IO)) == 0)
391+
memalloc_noio_restore(flags);
392+
376393
___free_pages_bulk(data.pages, nr_pages);
377394
if (ret)
378395
break;
@@ -386,7 +403,7 @@ static int __kasan_populate_vmalloc(unsigned long start, unsigned long end)
386403
return ret;
387404
}
388405

389-
int kasan_populate_vmalloc(unsigned long addr, unsigned long size)
406+
int kasan_populate_vmalloc(unsigned long addr, unsigned long size, gfp_t gfp_mask)
390407
{
391408
unsigned long shadow_start, shadow_end;
392409
int ret;
@@ -415,7 +432,7 @@ int kasan_populate_vmalloc(unsigned long addr, unsigned long size)
415432
shadow_start = PAGE_ALIGN_DOWN(shadow_start);
416433
shadow_end = PAGE_ALIGN(shadow_end);
417434

418-
ret = __kasan_populate_vmalloc(shadow_start, shadow_end);
435+
ret = __kasan_populate_vmalloc(shadow_start, shadow_end, gfp_mask);
419436
if (ret)
420437
return ret;
421438

‎mm/vmalloc.c‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -2026,6 +2026,8 @@ static struct vmap_area *alloc_vmap_area(unsigned long size,
20262026
if (unlikely(!vmap_initialized))
20272027
return ERR_PTR(-EBUSY);
20282028

2029+
/* Only reclaim behaviour flags are relevant. */
2030+
gfp_mask = gfp_mask & GFP_RECLAIM_MASK;
20292031
might_sleep();
20302032

20312033
/*
@@ -2038,8 +2040,6 @@ static struct vmap_area *alloc_vmap_area(unsigned long size,
20382040
*/
20392041
va = node_alloc(size, align, vstart, vend, &addr, &vn_id);
20402042
if (!va) {
2041-
gfp_mask = gfp_mask & GFP_RECLAIM_MASK;
2042-
20432043
va = kmem_cache_alloc_node(vmap_area_cachep, gfp_mask, node);
20442044
if (unlikely(!va))
20452045
return ERR_PTR(-ENOMEM);
@@ -2089,7 +2089,7 @@ static struct vmap_area *alloc_vmap_area(unsigned long size,
20892089
BUG_ON(va->va_start < vstart);
20902090
BUG_ON(va->va_end > vend);
20912091

2092-
ret = kasan_populate_vmalloc(addr, size);
2092+
ret = kasan_populate_vmalloc(addr, size, gfp_mask);
20932093
if (ret) {
20942094
free_vmap_area(va);
20952095
return ERR_PTR(ret);
@@ -4826,7 +4826,7 @@ struct vm_struct **pcpu_get_vm_areas(const unsigned long *offsets,
48264826

48274827
/* populate the kasan shadow space */
48284828
for (area = 0; area < nr_vms; area++) {
4829-
if (kasan_populate_vmalloc(vas[area]->va_start, sizes[area]))
4829+
if (kasan_populate_vmalloc(vas[area]->va_start, sizes[area], GFP_KERNEL))
48304830
goto err_free_shadow;
48314831
}
48324832

0 commit comments

Comments
 (0)