On Mon, Dec 07, 2015 at 05:09:21PM +0100, Dmitry Vyukov wrote: > If your audit does not give any results, can you give me a patch that > prints rcu callback submission stacks in KASAN reports?
Just because my brain is fried for today, I figured I'd give it a go. Completely untested.. --- include/linux/slub_def.h | 2 ++ kernel/rcu/tree_plugin.h | 1 + mm/slub.c | 34 ++++++++++++++++++++++++++++++++-- 3 files changed, 35 insertions(+), 2 deletions(-) diff --git a/include/linux/slub_def.h b/include/linux/slub_def.h index 33885118523c..445b586c0bfa 100644 --- a/include/linux/slub_def.h +++ b/include/linux/slub_def.h @@ -129,4 +129,6 @@ static inline void *virt_to_obj(struct kmem_cache *s, void object_err(struct kmem_cache *s, struct page *page, u8 *object, char *reason); +void object_set_indirect(const void *addr); + #endif /* _LINUX_SLUB_DEF_H */ diff --git a/kernel/rcu/tree_plugin.h b/kernel/rcu/tree_plugin.h index 630c19772630..4e1e79e01e34 100644 --- a/kernel/rcu/tree_plugin.h +++ b/kernel/rcu/tree_plugin.h @@ -659,6 +659,7 @@ static void rcu_preempt_do_callbacks(void) */ void call_rcu(struct rcu_head *head, rcu_callback_t func) { + object_set_indirect(head); __call_rcu(head, func, rcu_state_p, -1, 0); } EXPORT_SYMBOL_GPL(call_rcu); diff --git a/mm/slub.c b/mm/slub.c index 46997517406e..6977dc7cffcd 100644 --- a/mm/slub.c +++ b/mm/slub.c @@ -196,7 +196,12 @@ struct track { unsigned long when; /* When did the operation occur */ }; -enum track_item { TRACK_ALLOC, TRACK_FREE }; +enum track_item { + TRACK_ALLOC = 0, + TRACK_FREE, + TRACK_INDIRECT, + TRACK_NR, +}; #ifdef CONFIG_SYSFS static int sysfs_slab_add(struct kmem_cache *); @@ -551,6 +556,7 @@ static void init_tracking(struct kmem_cache *s, void *object) set_track(s, object, TRACK_FREE, 0UL); set_track(s, object, TRACK_ALLOC, 0UL); + set_track(s, object, TRACK_INDIRECT, 0UL); } static void print_track(const char *s, struct track *t) @@ -579,6 +585,7 @@ static void print_tracking(struct kmem_cache *s, void *object) print_track("Allocated", get_track(s, object, TRACK_ALLOC)); print_track("Freed", get_track(s, object, TRACK_FREE)); + print_track("Indirect", get_track(s, object, TRACK_INDIRECT)); } static void print_page_info(struct page *page) @@ -652,6 +659,29 @@ static void print_trailer(struct kmem_cache *s, struct page *page, u8 *p) dump_stack(); } +void object_set_indirect(const void *addr) +{ + if ((addr >= (void *)PAGE_OFFSET) && + (addr < high_memory)) { + struct page *page = virt_to_head_page(addr); + + if (PageSlab(page)) { + void *object; + struct kmem_cache *cache = page->slab_cache; + void *last_object; + + object = virt_to_obj(cache, page_address(page), addr); + last_object = page_address(page) + + page->objects * cache->size; + + if (unlikely(object > last_object)) + object = last_object; /* we hit into padding */ + + set_track(cache, object, TRACK_INDIRECT, (unsigned long)addr); + } + } +} + void object_err(struct kmem_cache *s, struct page *page, u8 *object, char *reason) { @@ -767,7 +797,7 @@ static int check_pad_bytes(struct kmem_cache *s, struct page *page, u8 *p) if (s->flags & SLAB_STORE_USER) /* We also have user information there */ - off += 2 * sizeof(struct track); + off += TRACK_NR * sizeof(struct track); if (s->size == off) return 1; -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majord...@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/