Re: [PATCH v11 1/4] kasan: support backing vmalloc space with real shadow memory

[Qian Cai]

On Thu, 2019-10-31 at 20:39 +1100, Daniel Axtens wrote:
>  	/*
>  	 * In this function, newly allocated vm_struct has VM_UNINITIALIZED
>  	 * flag. It means that vm_struct is not fully initialized.
> @@ -3377,6 +3411,9 @@ struct vm_struct **pcpu_get_vm_areas(const unsigned long *offsets,
>  
>  		setup_vmalloc_vm_locked(vms[area], vas[area], VM_ALLOC,
>  				 pcpu_get_vm_areas);
> +
> +		/* assume success here */
> +		kasan_populate_vmalloc(sizes[area], vms[area]);
>  	}
>  	spin_unlock(&vmap_area_lock);

Here it is all wrong. GFP_KERNEL with in_atomic().

[ÂÂÂ32.231000][ÂÂÂÂT1] BUG: sleeping function called from invalid context at
mm/page_alloc.c:4681
[ÂÂÂ32.239934][ÂÂÂÂT1] in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 1,
name: swapper/0
[ÂÂÂ32.248896][ÂÂÂÂT1] 2 locks held by swapper/0/1:
[ÂÂÂ32.253580][ÂÂÂÂT1]ÂÂ#0: ffffffff880d6160 (pcpu_alloc_mutex){+.+.}, at:
pcpu_alloc+0x707/0xbe0
[ÂÂÂ32.262305][ÂÂÂÂT1]ÂÂ#1: ffffffff88105558 (vmap_area_lock){+.+.}, at:
pcpu_get_vm_areas+0xc4f/0x1e60
[ÂÂÂ32.271919][ÂÂÂÂT1] CPU: 4 PID: 1 Comm: swapper/0 Tainted:
GÂÂÂÂÂÂÂÂWÂÂÂÂÂÂÂÂÂ5.4.0-rc7-next-20191115+ #6
[ÂÂÂ32.281555][ÂÂÂÂT1] Hardware name: HPE ProLiant DL385 Gen10/ProLiant DL385
Gen10, BIOS A40 03/09/2018
[ÂÂÂ32.281896][ÂÂÂÂT1] Call Trace:
[ÂÂÂ32.281896][ÂÂÂÂT1]ÂÂdump_stack+0xa0/0xea
[ÂÂÂ32.281896][ÂÂÂÂT1]ÂÂ___might_sleep.cold.89+0xd2/0x122
[ÂÂÂ32.301996][ÂÂÂÂT1]ÂÂ__might_sleep+0x73/0xe0
[ÂÂÂ32.301996][ÂÂÂÂT1]ÂÂ__alloc_pages_nodemask+0x442/0x720
[ÂÂÂ32.311564][ÂÂÂÂT1]ÂÂ? __kasan_check_read+0x11/0x20
[ÂÂÂ32.311564][ÂÂÂÂT1]ÂÂ? __alloc_pages_slowpath+0x1870/0x1870
[ÂÂÂ32.321705][ÂÂÂÂT1]ÂÂ? mark_held_locks+0x86/0xb0
[ÂÂÂ32.321705][ÂÂÂÂT1]ÂÂ? _raw_spin_unlock_irqrestore+0x44/0x50
[ÂÂÂ32.331563][ÂÂÂÂT1]ÂÂalloc_page_interleave+0x18/0x130
[ÂÂÂ32.331563][ÂÂÂÂT1]ÂÂalloc_pages_current+0xf6/0x110
[ÂÂÂ32.341979][ÂÂÂÂT1]ÂÂ__get_free_pages+0x12/0x60
[ÂÂÂ32.341979][ÂÂÂÂT1]ÂÂ__pte_alloc_kernel+0x1b/0xc0
[ÂÂÂ32.351563][ÂÂÂÂT1]ÂÂapply_to_page_range+0x5b5/0x690
[ÂÂÂ32.351563][ÂÂÂÂT1]ÂÂ? memset+0x40/0x40
[ÂÂÂ32.361693][ÂÂÂÂT1]ÂÂkasan_populate_vmalloc+0x6d/0xa0
[ÂÂÂ32.361693][ÂÂÂÂT1]ÂÂpcpu_get_vm_areas+0xd49/0x1e60
[ÂÂÂ32.371425][ÂÂÂÂT1]ÂÂ? vm_map_ram+0x10d0/0x10d0
[ÂÂÂ32.371425][ÂÂÂÂT1]ÂÂ? pcpu_mem_zalloc+0x65/0x90
[ÂÂÂ32.371425][ÂÂÂÂT1]ÂÂpcpu_create_chunk+0x152/0x3f0
[ÂÂÂ32.371425][ÂÂÂÂT1]ÂÂpcpu_alloc+0xa2f/0xbe0
[ÂÂÂ32.391423][ÂÂÂÂT1]ÂÂ? pcpu_balance_workfn+0xb00/0xb00
[ÂÂÂ32.391423][ÂÂÂÂT1]ÂÂ? __kasan_kmalloc.constprop.11+0xc1/0xd0
[ÂÂÂ32.391423][ÂÂÂÂT1]ÂÂ? kasan_kmalloc+0x9/0x10
[ÂÂÂ32.391423][ÂÂÂÂT1]ÂÂ? kmem_cache_alloc_trace+0x1f8/0x470
[ÂÂÂ32.411421][ÂÂÂÂT1]ÂÂ? iommu_dma_get_resv_regions+0x10/0x10
[ÂÂÂ32.411421][ÂÂÂÂT1]ÂÂ__alloc_percpu+0x15/0x20
[ÂÂÂ32.411421][ÂÂÂÂT1]ÂÂinit_iova_flush_queue+0x79/0x230
[ÂÂÂ32.411421][ÂÂÂÂT1]ÂÂiommu_setup_dma_ops+0x87d/0x890
[ÂÂÂ32.431420][ÂÂÂÂT1]ÂÂ? __kasan_check_write+0x14/0x20
[ÂÂÂ32.431420][ÂÂÂÂT1]ÂÂ? refcount_sub_and_test_checked+0xba/0x170
[ÂÂÂ32.431420][ÂÂÂÂT1]ÂÂ? __kasan_check_write+0x14/0x20
[ÂÂÂ32.431420][ÂÂÂÂT1]ÂÂ? iommu_dma_alloc+0x1e0/0x1e0
[ÂÂÂ32.451420][ÂÂÂÂT1]ÂÂ? iommu_group_get_for_dev+0x153/0x450
[ÂÂÂ32.451420][ÂÂÂÂT1]ÂÂ? refcount_dec_and_test_checked+0x11/0x20
[ÂÂÂ32.451420][ÂÂÂÂT1]ÂÂ? kobject_put+0x36/0x270
[ÂÂÂ32.451420][ÂÂÂÂT1]ÂÂamd_iommu_add_device+0x560/0x710
[ÂÂÂ32.471423][ÂÂÂÂT1]ÂÂ? iommu_probe_device+0x150/0x150
[ÂÂÂ32.471423][ÂÂÂÂT1]ÂÂiommu_probe_device+0x8c/0x150
[ÂÂÂ32.471423][ÂÂÂÂT1]ÂÂadd_iommu_group+0xe/0x20
[ÂÂÂ32.471423][ÂÂÂÂT1]ÂÂbus_for_each_dev+0xfe/0x160
[ÂÂÂ32.491421][ÂÂÂÂT1]ÂÂ? subsys_dev_iter_init+0x80/0x80
[ÂÂÂ32.491421][ÂÂÂÂT1]ÂÂ? blocking_notifier_chain_register+0x4f/0x70
[ÂÂÂ32.491421][ÂÂÂÂT1]ÂÂbus_set_iommu+0xc6/0x100
[ÂÂÂ32.491421][ÂÂÂÂT1]ÂÂ? e820__memblock_setup+0x10e/0x10e
[ÂÂÂ32.511571][ÂÂÂÂT1]ÂÂamd_iommu_init_api+0x25/0x3e
[ÂÂÂ32.511571][ÂÂÂÂT1]ÂÂstate_next+0x214/0x7ea
[ÂÂÂ32.511571][ÂÂÂÂT1]ÂÂ? check_flags.part.25+0x86/0x220
[ÂÂÂ32.511571][ÂÂÂÂT1]ÂÂ? early_amd_iommu_init+0x10c0/0x10c0
[ÂÂÂ32.531421][ÂÂÂÂT1]ÂÂ? e820__memblock_setup+0x10e/0x10e
[ÂÂÂ32.531421][ÂÂÂÂT1]ÂÂ? rcu_read_lock_sched_held+0xac/0xe0
[ÂÂÂ32.531421][ÂÂÂÂT1]ÂÂ? e820__memblock_setup+0x10e/0x10e
[ÂÂÂ32.551423][ÂÂÂÂT1]ÂÂamd_iommu_init+0x25/0x57
[ÂÂÂ32.551423][ÂÂÂÂT1]ÂÂpci_iommu_init+0x26/0x62
[ÂÂÂ32.551423][ÂÂÂÂT1]ÂÂdo_one_initcall+0xfe/0x4fa
[ÂÂÂ32.551423][ÂÂÂÂT1]ÂÂ? perf_trace_initcall_level+0x240/0x240
[ÂÂÂ32.571420][ÂÂÂÂT1]ÂÂ? rcu_read_lock_sched_held+0xac/0xe0
[ÂÂÂ32.571420][ÂÂÂÂT1]ÂÂ? rcu_read_lock_bh_held+0xc0/0xc0
[ÂÂÂ32.571420][ÂÂÂÂT1]ÂÂ? __kasan_check_read+0x11/0x20
[ÂÂÂ32.571420][ÂÂÂÂT1]ÂÂkernel_init_freeable+0x420/0x4e4
[ÂÂÂ32.591420][ÂÂÂÂT1]ÂÂ? start_kernel+0x6a9/0x6a9
[ÂÂÂ32.591420][ÂÂÂÂT1]ÂÂ? lockdep_hardirqs_on+0x1b0/0x2a0
[ÂÂÂ32.591420][ÂÂÂÂT1]ÂÂ? _raw_spin_unlock_irq+0x27/0x40
[ÂÂÂ32.591420][ÂÂÂÂT1]ÂÂ? rest_init+0x307/0x307
[ÂÂÂ32.611557][ÂÂÂÂT1]ÂÂkernel_init+0x11/0x139
[ÂÂÂ32.611557][ÂÂÂÂT1]ÂÂ? rest_init+0x307/0x307
[ÂÂÂ32.611557][ÂÂÂÂT1]ÂÂret_from_fork+0x27/0x50


[ÂÂÂ32.054647][ÂÂÂÂT1] BUG: sleeping function called from invalid context at
mm/page_alloc.c:4681
[ÂÂÂ32.063814][ÂÂÂÂT1] in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 1,
name: swapper/0
[ÂÂÂ32.072444][ÂÂÂÂT1] 2 locks held by swapper/0/1:
[ÂÂÂ32.077104][ÂÂÂÂT1]ÂÂ#0: ffffffffac0d6160 (pcpu_alloc_mutex){+.+.}, at:
pcpu_alloc+0x707/0xbe0
[ÂÂÂ32.086227][ÂÂÂÂT1]ÂÂ#1: ffffffffac105558 (vmap_area_lock){+.+.}, at:
pcpu_get_vm_areas+0xc4f/0x1e50
[ÂÂÂ32.095478][ÂÂÂÂT1] CPU: 53 PID: 1 Comm: swapper/0 Tainted:
GÂÂÂÂÂÂÂÂWÂÂÂÂÂÂÂÂÂ5.4.0-rc7-next-20191115 #5
[ÂÂÂ32.105115][ÂÂÂÂT1] Hardware name: HPE ProLiant DL385 Gen10/ProLiant DL385
Gen10, BIOS A40 03/09/2018
[ÂÂÂ32.105450][ÂÂÂÂT1] Call Trace:
[ÂÂÂ32.105450][ÂÂÂÂT1]ÂÂdump_stack+0xa0/0xea
[ÂÂÂ32.105450][ÂÂÂÂT1]ÂÂ___might_sleep.cold.89+0xd2/0x122
[ÂÂÂ32.105450][ÂÂÂÂT1]ÂÂ__might_sleep+0x73/0xe0
[ÂÂÂ32.105450][ÂÂÂÂT1]ÂÂ__alloc_pages_nodemask+0x442/0x720
[ÂÂÂ32.105450][ÂÂÂÂT1]ÂÂ? add_iommu_group+0xe/0x20
[ÂÂÂ32.105450][ÂÂÂÂT1]ÂÂ? bus_for_each_dev+0xfe/0x160
[ÂÂÂ32.105450][ÂÂÂÂT1]ÂÂ? __alloc_pages_slowpath+0x1870/0x1870
[ÂÂÂ32.105450][ÂÂÂÂT1]ÂÂ? check_chain_key+0x1df/0x2e0
[ÂÂÂ32.105450][ÂÂÂÂT1]ÂÂalloc_page_interleave+0x18/0x130
[ÂÂÂ32.105450][ÂÂÂÂT1]ÂÂalloc_pages_current+0xf6/0x110
[ÂÂÂ32.105450][ÂÂÂÂT1]ÂÂ__get_free_pages+0x12/0x60
[ÂÂÂ32.105450][ÂÂÂÂT1]ÂÂkasan_populate_vmalloc_pte+0x2a/0x150
[ÂÂÂ32.105450][ÂÂÂÂT1]ÂÂ? register_lock_class+0x940/0x940
[ÂÂÂ32.105450][ÂÂÂÂT1]ÂÂapply_to_page_range+0x42d/0x690
[ÂÂÂ32.105450][ÂÂÂÂT1]ÂÂ? memset+0x40/0x40
[ÂÂÂ32.105450][ÂÂÂÂT1]ÂÂkasan_populate_vmalloc+0x69/0xa0
[ÂÂÂ32.105450][ÂÂÂÂT1]ÂÂpcpu_get_vm_areas+0xd44/0x1e50
[ÂÂÂ32.105450][ÂÂÂÂT1]ÂÂ? vm_map_ram+0x10d0/0x10d0
[ÂÂÂ32.105450][ÂÂÂÂT1]ÂÂ? pcpu_mem_zalloc+0x65/0x90
[ÂÂÂ32.105450][ÂÂÂÂT1]ÂÂpcpu_create_chunk+0x152/0x3f0
[ÂÂÂ32.105450][ÂÂÂÂT1]ÂÂpcpu_alloc+0xa2f/0xbe0
[ÂÂÂ32.105450][ÂÂÂÂT1]ÂÂ? pcpu_balance_workfn+0xb00/0xb00
[ÂÂÂ32.105450][ÂÂÂÂT1]ÂÂ? __kasan_kmalloc.constprop.11+0xc1/0xd0
[ÂÂÂ32.105450][ÂÂÂÂT1]ÂÂ? kasan_kmalloc+0x9/0x10
[ÂÂÂ32.105450][ÂÂÂÂT1]ÂÂ? kmem_cache_alloc_trace+0x1f8/0x470
[ÂÂÂ32.105450][ÂÂÂÂT1]ÂÂ? iommu_dma_get_resv_regions+0x10/0x10
[ÂÂÂ32.105450][ÂÂÂÂT1]ÂÂ__alloc_percpu+0x15/0x20
[ÂÂÂ32.105450][ÂÂÂÂT1]ÂÂinit_iova_flush_queue+0x79/0x230
[ÂÂÂ32.105450][ÂÂÂÂT1]ÂÂiommu_setup_dma_ops+0x87d/0x890
[ÂÂÂ32.105450][ÂÂÂÂT1]ÂÂ? __kasan_check_write+0x14/0x20
[ÂÂÂ32.105450][ÂÂÂÂT1]ÂÂ? refcount_sub_and_test_checked+0xba/0x170
[ÂÂÂ32.105450][ÂÂÂÂT1]ÂÂ? __kasan_check_write+0x14/0x20
[ÂÂÂ32.105450][ÂÂÂÂT1]ÂÂ? iommu_dma_alloc+0x1e0/0x1e0
[ÂÂÂ32.105450][ÂÂÂÂT1]ÂÂ? iommu_group_get_for_dev+0x153/0x450
[ÂÂÂ32.105450][ÂÂÂÂT1]ÂÂ? refcount_dec_and_test_checked+0x11/0x20
[ÂÂÂ32.105450][ÂÂÂÂT1]ÂÂ? kobject_put+0x36/0x270
[ÂÂÂ32.105450][ÂÂÂÂT1]ÂÂamd_iommu_add_device+0x560/0x710
[ÂÂÂ32.105450][ÂÂÂÂT1]ÂÂ? iommu_probe_device+0x150/0x150
[ÂÂÂ32.105450][ÂÂÂÂT1]ÂÂiommu_probe_device+0x8c/0x150
[ÂÂÂ32.105450][ÂÂÂÂT1]ÂÂadd_iommu_group+0xe/0x20
[ÂÂÂ32.105450][ÂÂÂÂT1]ÂÂbus_for_each_dev+0xfe/0x160
[ÂÂÂ32.105450][ÂÂÂÂT1]ÂÂ? subsys_dev_iter_init+0x80/0x80
[ÂÂÂ32.105450][ÂÂÂÂT1]ÂÂ? blocking_notifier_chain_register+0x4f/0x70
[ÂÂÂ32.105450][ÂÂÂÂT1]ÂÂbus_set_iommu+0xc6/0x100
[ÂÂÂ32.105450][ÂÂÂÂT1]ÂÂ? e820__memblock_setup+0x10e/0x10e
[ÂÂÂ32.105450][ÂÂÂÂT1]ÂÂamd_iommu_init_api+0x25/0x3e
[ÂÂÂ32.105450][ÂÂÂÂT1]ÂÂstate_next+0x214/0x7ea
[ÂÂÂ32.105450][ÂÂÂÂT1]ÂÂ? check_flags.part.25+0x86/0x220
[ÂÂÂ32.105450][ÂÂÂÂT1]ÂÂ? early_amd_iommu_init+0x10c0/0x10c0
[ÂÂÂ32.105450][ÂÂÂÂT1]ÂÂ? e820__memblock_setup+0x10e/0x10e
[ÂÂÂ32.105450][ÂÂÂÂT1]ÂÂ? rcu_read_lock_sched_held+0xac/0xe0
[ÂÂÂ32.105450][ÂÂÂÂT1]ÂÂ? e820__memblock_setup+0x10e/0x10e
[ÂÂÂ32.105450][ÂÂÂÂT1]ÂÂamd_iommu_init+0x25/0x57
[ÂÂÂ32.105450][ÂÂÂÂT1]ÂÂpci_iommu_init+0x26/0x62
[ÂÂÂ32.105450][ÂÂÂÂT1]ÂÂdo_one_initcall+0xfe/0x4fa
[ÂÂÂ32.105450][ÂÂÂÂT1].781281][ÂÂÂÂT1] pci 0000:60:08.0: Adding to iommu group
63
[ÂÂÂ32.831700][ÂÂÂÂT1] pci 0000:60:08.1: Adding to iommu group 64
[ÂÂÂ32.883138][ÂÂÂÂT1] pci 0000:63:00.0: Adding to iommu group 65
[ÂÂÂ32.933084][ÂÂÂÂT1] pci 0000:63:00.1: Adding to iommu group 65
[ÂÂÂ32.940474][ÂÂÂÂT1] pci 0000:62:00.0: Adding to iommu group 66
[ÂÂÂ32.991631][ÂÂÂÂT1] pci 0000:62:00.2: Adding to iommu group 67
[ÂÂÂ33.042553][ÂÂÂÂT1] pci 0000:61:00.0: Adding to iommu group 68