Thread (9 messages) 9 messages, 2 authors, 2016-08-01

Re: [4.7+] various memory corruption reports.

From: Andrey Ryabinin <ryabinin.a.a@gmail.com>
Date: 2016-08-01 12:03:08
Also in: lkml
Subsystem: kasan, memory management, the rest · Maintainers: Andrey Ryabinin, Andrew Morton, Linus Torvalds

On 07/29/2016 09:39 PM, Dave Jones wrote:
On Fri, Jul 29, 2016 at 08:56:08PM +0300, Andrey Ryabinin wrote:

 > >>  > I suspect this is false positives due to changes in KASAN.
 > >>  > Bisection probably will point to
 > >>  > 80a9201a5965f4715d5c09790862e0df84ce0614 ("mm, kasan: switch SLUB to
 > >>  > stackdepot, enable memory quarantine for SLUB)"
 > >>
 > >> good call. reverting that changeset seems to have solved it.
 > > Could you please try with this?
 > Actually, this is not quite right, it should be like this:


Seems to have stopped the corruption, but now I get NMi watchdog traces..
This should help:

---
 mm/kasan/kasan.c      | 4 ++--
 mm/kasan/quarantine.c | 8 ++++++--
 2 files changed, 8 insertions(+), 4 deletions(-)
diff --git a/mm/kasan/kasan.c b/mm/kasan/kasan.c
index 3019cec..c99ef40 100644
--- a/mm/kasan/kasan.c
+++ b/mm/kasan/kasan.c
@@ -565,7 +565,7 @@ void kasan_kmalloc(struct kmem_cache *cache, const void *object, size_t size,
 	unsigned long redzone_start;
 	unsigned long redzone_end;
 
-	if (flags & __GFP_RECLAIM)
+	if (gfpflags_allow_blocking(flags))
 		quarantine_reduce();
 
 	if (unlikely(object == NULL))
@@ -596,7 +596,7 @@ void kasan_kmalloc_large(const void *ptr, size_t size, gfp_t flags)
 	unsigned long redzone_start;
 	unsigned long redzone_end;
 
-	if (flags & __GFP_RECLAIM)
+	if (gfpflags_allow_blocking(flags))
 		quarantine_reduce();
 
 	if (unlikely(ptr == NULL))
diff --git a/mm/kasan/quarantine.c b/mm/kasan/quarantine.c
index 65793f1..4852625 100644
--- a/mm/kasan/quarantine.c
+++ b/mm/kasan/quarantine.c
@@ -147,10 +147,14 @@ static void qlink_free(struct qlist_node *qlink, struct kmem_cache *cache)
 	struct kasan_alloc_meta *alloc_info = get_alloc_info(cache, object);
 	unsigned long flags;
 
-	local_irq_save(flags);
+	if (IS_ENABLED(CONFIG_SLAB))
+		local_irq_save(flags);
+
 	alloc_info->state = KASAN_STATE_FREE;
 	___cache_free(cache, object, _THIS_IP_);
-	local_irq_restore(flags);
+
+	if (IS_ENABLED(CONFIG_SLAB))
+		local_irq_restore(flags);
 }
 
 static void qlist_free_all(struct qlist_head *q, struct kmem_cache *cache)
-- 
2.7.3

--
To unsubscribe, send a message with 'unsubscribe linux-mm' in
the body to majordomo@kvack.org.  For more info on Linux MM,
see: http://www.linux-mm.org/ .
Don't email: <a href=mailto:"dont@kvack.org"> email@kvack.org </a>
Keyboard shortcuts
hback out one level
jnext message in thread
kprevious message in thread
ldrill in
Escclose help / fold thread tree
?toggle this help