[Devel] [PATCH RHEL7 COMMIT] kasan: drain quarantine of memcg slab objects

[Konstantin Khorenko]

The commit is pushed to "branch-rh7-3.10.0-693.1.1.vz7.37.x-ovz" and will appear at https://src.openvz.org/scm/ovz/vzkernel.git
after rh7-3.10.0-693.1.1.vz7.37.4
------>
commit 90e281c91fa17277c16b34d3b9d63b3b47db91c2
Author: Greg Thelen <gthelen at google.com>
Date:   Fri Sep 15 17:27:33 2017 +0300

    kasan: drain quarantine of memcg slab objects
    
    Per memcg slab accounting and kasan have a problem with kmem_cache
    destruction.
     - kmem_cache_create() allocates a kmem_cache, which is used for
       allocations from processes running in root (top) memcg.
     - Processes running in non root memcg and allocating with either
       __GFP_ACCOUNT or from a SLAB_ACCOUNT cache use a per memcg
       kmem_cache.
     - Kasan catches use-after-free by having kfree() and kmem_cache_free()
       defer freeing of objects. Objects are placed in a quarantine.
     - kmem_cache_destroy() destroys root and non root kmem_caches. It takes
       care to drain the quarantine of objects from the root memcg's
       kmem_cache, but ignores objects associated with non root memcg. This
       causes leaks because quarantined per memcg objects refer to per memcg
       kmem cache being destroyed.
    
    To see the problem:
    
     1) create a slab cache with kmem_cache_create(,,,SLAB_ACCOUNT,)
     2) from non root memcg, allocate and free a few objects from cache
     3) dispose of the cache with kmem_cache_destroy() kmem_cache_destroy()
        will trigger a "Slab cache still has objects" warning indicating
        that the per memcg kmem_cache structure was leaked.
    
    Fix the leak by draining kasan quarantined objects allocated from non
    root memcg.
    
    Racing memcg deletion is tricky, but handled.  kmem_cache_destroy() =>
    shutdown_memcg_caches() => __shutdown_memcg_cache() => shutdown_cache()
    flushes per memcg quarantined objects, even if that memcg has been
    rmdir'd and gone through memcg_deactivate_kmem_caches().
    
    This leak only affects destroyed SLAB_ACCOUNT kmem caches when kasan is
    enabled.  So I don't think it's worth patching stable kernels.
    
    Link: http://lkml.kernel.org/r/1482257462-36948-1-git-send-email-gthelen@google.com
    Signed-off-by: Greg Thelen <gthelen at google.com>
    Reviewed-by: Vladimir Davydov <vdavydov.dev at gmail.com>
    Acked-by: Andrey Ryabinin <aryabinin at virtuozzo.com>
    Cc: Alexander Potapenko <glider at google.com>
    Cc: Dmitry Vyukov <dvyukov at google.com>
    Cc: Christoph Lameter <cl at linux.com>
    Cc: Pekka Enberg <penberg at kernel.org>
    Cc: David Rientjes <rientjes at google.com>
    Cc: Joonsoo Kim <iamjoonsoo.kim at lge.com>
    Signed-off-by: Andrew Morton <akpm at linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds at linux-foundation.org>
    
    https://jira.sw.ru/browse/PSBM-69081
    (cherry picked from commit f9fa1d919c696e90c887d8742198023e7639d139)
    Signed-off-by: Andrey Ryabinin <aryabinin at virtuozzo.com>
---
 include/linux/kasan.h | 4 ++--
 mm/kasan/kasan.c      | 2 +-
 mm/kasan/quarantine.c | 1 +
 mm/slab_common.c      | 6 ++++--
 4 files changed, 8 insertions(+), 5 deletions(-)

diff --git a/include/linux/kasan.h b/include/linux/kasan.h
index 536a400..21cedc3 100644
--- a/include/linux/kasan.h
+++ b/include/linux/kasan.h
@@ -41,7 +41,7 @@ void kasan_free_pages(struct page *page, unsigned int order);
 void kasan_cache_create(struct kmem_cache *cache, size_t *size,
 			unsigned long *flags);
 void kasan_cache_shrink(struct kmem_cache *cache);
-void kasan_cache_destroy(struct kmem_cache *cache);
+void kasan_cache_shutdown(struct kmem_cache *cache);
 
 void kasan_poison_slab(struct page *page);
 void kasan_unpoison_object_data(struct kmem_cache *cache, void *object);
@@ -83,7 +83,7 @@ static inline void kasan_cache_create(struct kmem_cache *cache,
 				      size_t *size,
 				      unsigned long *flags) {}
 static inline void kasan_cache_shrink(struct kmem_cache *cache) {}
-static inline void kasan_cache_destroy(struct kmem_cache *cache) {}
+static inline void kasan_cache_shutdown(struct kmem_cache *cache) {}
 
 static inline void kasan_poison_slab(struct page *page) {}
 static inline void kasan_unpoison_object_data(struct kmem_cache *cache,
diff --git a/mm/kasan/kasan.c b/mm/kasan/kasan.c
index 8f350a2..8b95313 100644
--- a/mm/kasan/kasan.c
+++ b/mm/kasan/kasan.c
@@ -373,7 +373,7 @@ void kasan_cache_shrink(struct kmem_cache *cache)
 	quarantine_remove_cache(cache);
 }
 
-void kasan_cache_destroy(struct kmem_cache *cache)
+void kasan_cache_shutdown(struct kmem_cache *cache)
 {
 	quarantine_remove_cache(cache);
 }
diff --git a/mm/kasan/quarantine.c b/mm/kasan/quarantine.c
index dae929c..6f1ed16 100644
--- a/mm/kasan/quarantine.c
+++ b/mm/kasan/quarantine.c
@@ -274,6 +274,7 @@ static void per_cpu_remove_cache(void *arg)
 	qlist_free_all(&to_free, cache);
 }
 
+/* Free all quarantined objects belonging to cache. */
 void quarantine_remove_cache(struct kmem_cache *cache)
 {
 	unsigned long flags, i;
diff --git a/mm/slab_common.c b/mm/slab_common.c
index 8c8c99b..b24d35d 100644
--- a/mm/slab_common.c
+++ b/mm/slab_common.c
@@ -359,6 +359,10 @@ EXPORT_SYMBOL(kmem_cache_create);
 static int do_kmem_cache_shutdown(struct kmem_cache *s,
 		struct list_head *release, bool *need_rcu_barrier)
 {
+
+	/* free asan quarantined objects */
+	kasan_cache_shutdown(s);
+
 	if (__kmem_cache_shutdown(s) != 0) {
 		printk(KERN_ERR "kmem_cache_destroy %s: "
 		       "Slab cache still has objects\n", s->name);
@@ -544,8 +548,6 @@ void kmem_cache_destroy(struct kmem_cache *s)
 
 	BUG_ON(!is_root_cache(s));
 
-	kasan_cache_destroy(s);
-
 	get_online_cpus();
 	mutex_lock(&slab_mutex);