[Devel] [PATCH RHEL7 COMMIT] mm/kasan: fix corruptions and false positive reports

[Konstantin Khorenko]

The commit is pushed to "branch-rh7-3.10.0-693.1.1.vz7.37.x-ovz" and will appear at https://src.openvz.org/scm/ovz/vzkernel.git
after rh7-3.10.0-693.1.1.vz7.37.4
------>
commit 0b2f9ec0f23fd90ab06e49210eea818ac561e071
Author: Andrey Ryabinin <aryabinin at virtuozzo.com>
Date:   Fri Sep 15 17:27:25 2017 +0300

    mm/kasan: fix corruptions and false positive reports
    
    Once an object is put into quarantine, we no longer own it, i.e.  object
    could leave the quarantine and be reallocated.  So having set_track()
    call after the quarantine_put() may corrupt slab objects.
    
     BUG kmalloc-4096 (Not tainted): Poison overwritten
     -----------------------------------------------------------------------------
     Disabling lock debugging due to kernel taint
     INFO: 0xffff8804540de850-0xffff8804540de857. First byte 0xb5 instead of 0x6b
    ...
     INFO: Freed in qlist_free_all+0x42/0x100 age=75 cpu=3 pid=24492
      __slab_free+0x1d6/0x2e0
      ___cache_free+0xb6/0xd0
      qlist_free_all+0x83/0x100
      quarantine_reduce+0x177/0x1b0
      kasan_kmalloc+0xf3/0x100
      kasan_slab_alloc+0x12/0x20
      kmem_cache_alloc+0x109/0x3e0
      mmap_region+0x53e/0xe40
      do_mmap+0x70f/0xa50
      vm_mmap_pgoff+0x147/0x1b0
      SyS_mmap_pgoff+0x2c7/0x5b0
      SyS_mmap+0x1b/0x30
      do_syscall_64+0x1a0/0x4e0
      return_from_SYSCALL_64+0x0/0x7a
     INFO: Slab 0xffffea0011503600 objects=7 used=7 fp=0x          (null) flags=0x8000000000004080
     INFO: Object 0xffff8804540de848 @offset=26696 fp=0xffff8804540dc588
     Redzone ffff8804540de840: bb bb bb bb bb bb bb bb                          ........
     Object ffff8804540de848: 6b 6b 6b 6b 6b 6b 6b 6b b5 52 00 00 f2 01 60 cc  kkkkkkkk.R....`.
    
    Similarly, poisoning after the quarantine_put() leads to false positive
    use-after-free reports:
    
     BUG: KASAN: use-after-free in anon_vma_interval_tree_insert+0x304/0x430 at addr ffff880405c540a0
     Read of size 8 by task trinity-c0/3036
     CPU: 0 PID: 3036 Comm: trinity-c0 Not tainted 4.7.0-think+ #9
     Call Trace:
       dump_stack+0x68/0x96
       kasan_report_error+0x222/0x600
       __asan_report_load8_noabort+0x61/0x70
       anon_vma_interval_tree_insert+0x304/0x430
       anon_vma_chain_link+0x91/0xd0
       anon_vma_clone+0x136/0x3f0
       anon_vma_fork+0x81/0x4c0
       copy_process.part.47+0x2c43/0x5b20
       _do_fork+0x16d/0xbd0
       SyS_clone+0x19/0x20
       do_syscall_64+0x1a0/0x4e0
       entry_SYSCALL64_slow_path+0x25/0x25
    
    Fix this by putting an object in the quarantine after all other
    operations.
    
    Fixes: 80a9201a5965 ("mm, kasan: switch SLUB to stackdepot, enable memory quarantine for SLUB")
    Link: http://lkml.kernel.org/r/1470062715-14077-1-git-send-email-aryabinin@virtuozzo.com
    Signed-off-by: Andrey Ryabinin <aryabinin at virtuozzo.com>
    
    Reported-by: Dave Jones <davej at codemonkey.org.uk>
    Reported-by: Vegard Nossum <vegard.nossum at oracle.com>
    Reported-by: Sasha Levin <alexander.levin at verizon.com>
    Acked-by: Alexander Potapenko <glider at google.com>
    Cc: Dmitry Vyukov <dvyukov at google.com>
    Signed-off-by: Andrew Morton <akpm at linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds at linux-foundation.org>
    
    https://jira.sw.ru/browse/PSBM-69081
    (cherry picked from commit 4a3d308d6674fabf213bce9c1a661ef43a85e515)
    Signed-off-by: Andrey Ryabinin <aryabinin at virtuozzo.com>
---
 mm/kasan/kasan.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/mm/kasan/kasan.c b/mm/kasan/kasan.c
index 8a57f22..d7c8143 100644
--- a/mm/kasan/kasan.c
+++ b/mm/kasan/kasan.c
@@ -504,9 +504,9 @@ bool kasan_slab_free(struct kmem_cache *cache, void *object)
 		switch (alloc_info->state) {
 		case KASAN_STATE_ALLOC:
 			alloc_info->state = KASAN_STATE_QUARANTINE;
-			quarantine_put(free_info, cache);
 			set_track(&free_info->track, GFP_NOWAIT);
 			kasan_poison_slab_free(cache, object);
+			quarantine_put(free_info, cache);
 			return true;
 		case KASAN_STATE_QUARANTINE:
 		case KASAN_STATE_FREE: