• Andrey Ryabinin's avatar
    kasan, module, vmalloc: rework shadow allocation for modules · a5af5aa8
    Andrey Ryabinin authored
    Current approach in handling shadow memory for modules is broken.
    
    Shadow memory could be freed only after memory shadow corresponds it is no
    longer used.  vfree() called from interrupt context could use memory its
    freeing to store 'struct llist_node' in it:
    
        void vfree(const void *addr)
        {
        ...
            if (unlikely(in_interrupt())) {
                struct vfree_deferred *p = this_cpu_ptr(&vfree_deferred);
                if (llist_add((struct llist_node *)addr, &p->list))
                        schedule_work(&p->wq);
    
    Later this list node used in free_work() which actually frees memory.
    Currently module_memfree() called in interrupt context will free shadow
    before freeing module's memory which could provoke kernel crash.
    
    So shadow memory should be freed after module's memory.  However, such
    deallocation order could race with kasan_module_alloc() in module_alloc().
    
    Free shadow right before releasing vm area.  At this point vfree()'d
    memory is not used anymore and yet not available for other allocations.
    New VM_KASAN flag used to indicate that vm area has dynamically allocated
    shadow memory so kasan frees shadow only if it was previously allocated.
    Signed-off-by: default avatarAndrey Ryabinin <a.ryabinin@samsung.com>
    Acked-by: default avatarRusty Russell <rusty@rustcorp.com.au>
    Cc: Dmitry Vyukov <dvyukov@google.com>
    Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
    Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
    a5af5aa8
vmalloc.c 68.2 KB