Commit 7591c127 authored by Catalin Marinas's avatar Catalin Marinas Committed by Andrew Morton
Browse files

kmemleak: iommu/iova: fix transient kmemleak false positive 

The introduction of iova_depot_pop() in 911aa124 ("iommu/iova: Make
the rcache depot scale better") confused kmemleak by moving a struct
iova_magazine object from a singly linked list to rcache->depot and
resetting the 'next' pointer referencing it.  Unlike doubly linked lists,
the content of the object being referred is never changed on removal from
a singly linked list and the kmemleak checksum heuristics do not detect
such scenario.  This leads to false positives like:

unreferenced object 0xffff8881a5301000 (size 1024):
  comm "softirq", pid 0, jiffies 4306297099 (age 462.991s)
  hex dump (first 32 bytes):
    00 00 00 00 00 00 00 00 e7 7d 05 00 00 00 00 00  .........}......
    0f b4 05 00 00 00 00 00 b4 96 05 00 00 00 00 00  ................
  backtrace:
    [<ffffffff819f5f08>] __kmem_cache_alloc_node+0x1e8/0x320
    [<ffffffff818a239a>] kmalloc_trace+0x2a/0x60
    [<ffffffff8231d31e>] free_iova_fast+0x28e/0x4e0
    [<ffffffff82310860>] fq_ring_free_locked+0x1b0/0x310
    [<ffffffff8231225d>] fq_flush_timeout+0x19d/0x2e0
    [<ffffffff813e95ba>] call_timer_fn+0x19a/0x5c0
    [<ffffffff813ea16b>] __run_timers+0x78b/0xb80
    [<ffffffff813ea5bd>] run_timer_softirq+0x5d/0xd0
    [<ffffffff82f1d915>] __do_softirq+0x205/0x8b5

Introduce kmemleak_transient_leak() which resets the object checksum
requiring another scan pass before it is reported (if still unreferenced).
Call this new API in iova_depot_pop().

Link: https://lkml.kernel.org/r/20241104111944.2207155-1-catalin.marinas@arm.com
Link: https://lore.kernel.org/r/ZY1osaGLyT-sdKE8@shredder/


Signed-off-by: default avatarCatalin Marinas <catalin.marinas@arm.com>
Reported-by: default avatarIdo Schimmel <idosch@idosch.org>
Tested-by: default avatarIdo Schimmel <idosch@nvidia.com>
Acked-by: default avatarRobin Murphy <robin.murphy@arm.com>
Cc: Joerg Roedel <joro@8bytes.org>
Cc: Will Deacon <will@kernel.org>
Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
parent da0c0251

Documentation/dev-tools/kmemleak.rst

+1 −0
Original line number Diff line number Diff line
@@ -161,6 +161,7 @@ See the include/linux/kmemleak.h header for the functions prototype. 
- ``kmemleak_free_percpu``	 - notify of a percpu memory block freeing

- ``kmemleak_update_trace``	 - update object allocation stack trace

- ``kmemleak_not_leak``	 - mark an object as not a leak

- ``kmemleak_transient_leak``	 - mark an object as a transient leak

- ``kmemleak_ignore``		 - do not scan or report an object as leak

- ``kmemleak_scan_area``	 - add scan areas inside a memory block

- ``kmemleak_no_scan``	 - do not scan a memory block

drivers/iommu/iova.c

+6 −0
Original line number Diff line number Diff line
@@ -6,6 +6,7 @@ 
 */



#include <linux/iova.h>

#include <linux/kmemleak.h>

#include <linux/module.h>

#include <linux/slab.h>

#include <linux/smp.h>
@@ -673,6 +674,11 @@ static struct iova_magazine *iova_depot_pop(struct iova_rcache *rcache) 
{

	struct iova_magazine *mag = rcache->depot;



	/*

	 * As the mag->next pointer is moved to rcache->depot and reset via

	 * the mag->size assignment, mark it as a transient false positive.

	 */

	kmemleak_transient_leak(mag->next);

	rcache->depot = mag->next;

	mag->size = IOVA_MAG_SIZE;

	rcache->depot_size--;

include/linux/kmemleak.h

+4 −0
Original line number Diff line number Diff line
@@ -26,6 +26,7 @@ extern void kmemleak_free_part(const void *ptr, size_t size) __ref; 
extern void kmemleak_free_percpu(const void __percpu *ptr) __ref;

extern void kmemleak_update_trace(const void *ptr) __ref;

extern void kmemleak_not_leak(const void *ptr) __ref;

extern void kmemleak_transient_leak(const void *ptr) __ref;

extern void kmemleak_ignore(const void *ptr) __ref;

extern void kmemleak_scan_area(const void *ptr, size_t size, gfp_t gfp) __ref;

extern void kmemleak_no_scan(const void *ptr) __ref;
@@ -93,6 +94,9 @@ static inline void kmemleak_update_trace(const void *ptr) 
static inline void kmemleak_not_leak(const void *ptr)

{

}

static inline void kmemleak_transient_leak(const void *ptr)

{

}

static inline void kmemleak_ignore(const void *ptr)

{

}

mm/kmemleak.c

+39 −0
Original line number Diff line number Diff line
@@ -934,6 +934,28 @@ static void make_black_object(unsigned long ptr, unsigned int objflags) 
	paint_ptr(ptr, KMEMLEAK_BLACK, objflags);

}



/*

 * Reset the checksum of an object. The immediate effect is that it will not

 * be reported as a leak during the next scan until its checksum is updated.

 */

static void reset_checksum(unsigned long ptr)

{

	unsigned long flags;

	struct kmemleak_object *object;



	object = find_and_get_object(ptr, 0);

	if (!object) {

		kmemleak_warn("Not resetting the checksum of an unknown object at 0x%08lx\n",

			      ptr);

		return;

	}



	raw_spin_lock_irqsave(&object->lock, flags);

	object->checksum = 0;

	raw_spin_unlock_irqrestore(&object->lock, flags);

	put_object(object);

}



/*

 * Add a scanning area to the object. If at least one such area is added,

 * kmemleak will only scan these ranges rather than the whole memory block.
@@ -1202,6 +1224,23 @@ void __ref kmemleak_not_leak(const void *ptr) 
}

EXPORT_SYMBOL(kmemleak_not_leak);



/**

 * kmemleak_transient_leak - mark an allocated object as transient false positive

 * @ptr:	pointer to beginning of the object

 *

 * Calling this function on an object will cause the memory block to not be

 * reported as a leak temporarily. This may happen, for example, if the object

 * is part of a singly linked list and the ->next reference to it is changed.

 */

void __ref kmemleak_transient_leak(const void *ptr)

{

	pr_debug("%s(0x%px)\n", __func__, ptr);



	if (kmemleak_enabled && ptr && !IS_ERR(ptr))

		reset_checksum((unsigned long)ptr);

}

EXPORT_SYMBOL(kmemleak_transient_leak);



/**

 * kmemleak_ignore - ignore an allocated object

 * @ptr:	pointer to beginning of the object