github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-09-12 20:53:03 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

kasan: fix quarantine_size accounting during cache removal

Browse Source 
quarantine_size tracks the total number of bytes stored in
global_quarantine[].  It is incremented when per-CPU quarantine objects
are moved into the global quarantine and decremented when a global batch
is evicted by kasan_quarantine_reduce().

kasan_quarantine_remove_cache() also removes objects from the global
quarantine.  qlist_move_cache() rebuilds the source batch and updates its
.bytes field, but quarantine_size is not adjusted accordingly.

As a result, quarantine_size remains over-counted by the size of the
removed objects.  The stale accounting accumulates across cache removals. 
Once the inflated value exceeds quarantine_max_size,
kasan_quarantine_reduce() can evict a batch even though the actual number
of bytes in global_quarantine[] is still below quarantine_max_size,
shortening the quarantine window.

Fix the accounting by recording each batch's size before
qlist_move_cache() and subtracting the number of bytes actually removed
from quarantine_size while holding quarantine_lock.

A KUnit reproducer used during testing observed the over-count grow by
4698864 bytes after one kasan_quarantine_remove_cache() call with the fix
reverted.  With this change applied, the over-count did not grow.

Link: https://lore.kernel.org/20260811073332.1351893-1-sh_def@163.com
Fixes: 64abdcb243 ("kasan: eliminate long stalls during quarantine reduction")
Signed-off-by: Hui Su <sh_def@163.com>
Reported-by: Sashiko <sashiko-bot@kernel.org>
Closes: https://sashiko.dev/#/patchset/20260808031459.3032812-1-sh_def%40163.com
Reviewed-by: Andrey Ryabinin <ryabinin.a.a@gmail.com>
Cc: Alexander Potapenko <glider@google.com>
Cc: Andrey Konovalov <andreyknvl@gmail.com>
Cc: Dmitry Vyukov <dvyukov@google.com>
Cc: Vincenzo Frascino <vincenzo.frascino@arm.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
This commit is contained in:
Hui Su 2026-08-11 15:33:32 +08:00 committed by Andrew Morton
parent 22779ae817
commit bd1ad3cf07
1 changed files with 5 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
mm/kasan/quarantine.c
View File

@ -370,9 +370,14 @@ void kasan_quarantine_remove_cache(struct kmem_cache *cache)
raw_spin_lock_irqsave(&quarantine_lock, flags);
for (i = 0; i < QUARANTINE_BATCHES; i++) {
size_t old_bytes;
if (qlist_empty(&global_quarantine[i]))
continue;
old_bytes = global_quarantine[i].bytes;
qlist_move_cache(&global_quarantine[i], &to_free, cache);
WRITE_ONCE(quarantine_size, quarantine_size -
(old_bytes - global_quarantine[i].bytes));
/* Scanning whole quarantine can take a while. */
raw_spin_unlock_irqrestore(&quarantine_lock, flags);
cond_resched();