Commit f3b59798 authored by Andrey Konovalov's avatar Andrey Konovalov Committed by Andrew Morton
Browse files

kasan: remove atomic accesses to stack ring entries 

Remove the atomic accesses to entry fields in save_stack_info and
kasan_complete_mode_report_info for tag-based KASAN modes.

These atomics are not required, as the read/write lock prevents the
entries from being read (in kasan_complete_mode_report_info) while being
written (in save_stack_info) and the try_cmpxchg prevents the same entry
from being rewritten (in save_stack_info) in the unlikely case of wrapping
during writing.

Link: https://lkml.kernel.org/r/29f59126d9845c5257b6c29cd7ad113b16f19f47.1700502145.git.andreyknvl@google.com


Signed-off-by: default avatarAndrey Konovalov <andreyknvl@google.com>
Reviewed-by: default avatarAlexander Potapenko <glider@google.com>
Cc: Dmitry Vyukov <dvyukov@google.com>
Cc: Evgenii Stepanov <eugenis@google.com>
Cc: Marco Elver <elver@google.com>
Cc: Oscar Salvador <osalvador@suse.de>
Cc: Vlastimil Babka <vbabka@suse.cz>
Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
parent 108be8de

mm/kasan/report_tags.c

+7 −18
Original line number Diff line number Diff line
@@ -31,10 +31,6 @@ void kasan_complete_mode_report_info(struct kasan_report_info *info) 
	unsigned long flags;

	u64 pos;

	struct kasan_stack_ring_entry *entry;

	void *ptr;

	u32 pid;

	depot_stack_handle_t stack;

	bool is_free;

	bool alloc_found = false, free_found = false;



	if ((!info->cache || !info->object) && !info->bug_type) {
@@ -61,18 +57,11 @@ void kasan_complete_mode_report_info(struct kasan_report_info *info) 


		entry = &stack_ring.entries[i % stack_ring.size];



		/* Paired with smp_store_release() in save_stack_info(). */

		ptr = (void *)smp_load_acquire(&entry->ptr);



		if (kasan_reset_tag(ptr) != info->object ||

		    get_tag(ptr) != get_tag(info->access_addr))

		if (kasan_reset_tag(entry->ptr) != info->object ||

		    get_tag(entry->ptr) != get_tag(info->access_addr))

			continue;



		pid = READ_ONCE(entry->pid);

		stack = READ_ONCE(entry->stack);

		is_free = READ_ONCE(entry->is_free);



		if (is_free) {

		if (entry->is_free) {

			/*

			 * Second free of the same object.

			 * Give up on trying to find the alloc entry.
@@ -80,8 +69,8 @@ void kasan_complete_mode_report_info(struct kasan_report_info *info) 
			if (free_found)

				break;



			info->free_track.pid = pid;

			info->free_track.stack = stack;

			info->free_track.pid = entry->pid;

			info->free_track.stack = entry->stack;

			free_found = true;



			/*
@@ -95,8 +84,8 @@ void kasan_complete_mode_report_info(struct kasan_report_info *info) 
			if (alloc_found)

				break;



			info->alloc_track.pid = pid;

			info->alloc_track.stack = stack;

			info->alloc_track.pid = entry->pid;

			info->alloc_track.stack = entry->stack;

			alloc_found = true;



			/*

mm/kasan/tags.c

+5 −8
Original line number Diff line number Diff line
@@ -121,15 +121,12 @@ static void save_stack_info(struct kmem_cache *cache, void *object, 
	if (!try_cmpxchg(&entry->ptr, &old_ptr, STACK_RING_BUSY_PTR))

		goto next; /* Busy slot. */



	WRITE_ONCE(entry->size, cache->object_size);

	WRITE_ONCE(entry->pid, current->pid);

	WRITE_ONCE(entry->stack, stack);

	WRITE_ONCE(entry->is_free, is_free);

	entry->size = cache->object_size;

	entry->pid = current->pid;

	entry->stack = stack;

	entry->is_free = is_free;



	/*

	 * Paired with smp_load_acquire() in kasan_complete_mode_report_info().

	 */

	smp_store_release(&entry->ptr, (s64)object);

	entry->ptr = object;



	read_unlock_irqrestore(&stack_ring.lock, flags);

}