ANDROID: arm64: Add kernel_nofault vendor hook in __slab_alloc path
Consider the below call flow during kmem_cache_alloc using the lock-less fast path. __slab_alloc_node object = c->freelist; get_freepointer_safe(); if (!debug_pagealloc_enabled_static()) get_freepointer(); freelist_ptr_decode() <- possible bad memory access. In this path, the slab lock is not taken before reading the freelist. This means that it is possible to get a stale pointer here if another thread is modifying or has modified the freelist in parallel. The patch linked in [1] introduces a vendor hook which gracefully handles the case where the kernel tries to access an address that has been unmapped in the S2 pg-tables and given to another vm. For the slab_alloc_node() path in question, If CONFIG_DEBUG_PAGEALLOC is not enabled, then the code will access the address without calling copy_from_kernel_nofault() which is meant to register the access in the ex_table. If the access is not registered in the ex_table, then the vendor hook cannot handle the fault if the address turned out to have been unmapped in S2. Hence add a kernel_nofault vendor hook in the __slab_alloc_node() fast path to ensure that copy_from_kernel_nofault() is called so that this case can be handled gracefully. [1] https://android-review.googlesource.com/c/kernel/common/+/3460342 Bug: 448438370 Fixes: 57fa6d94 ("ANDROID: arm64: Call fixup_exception() within do_sea()") Change-Id: Ib7013840a06049744761aa3bd340c7274f0f95b1 Signed-off-by:Oreoluwa Babatunde <quic_obabatun@quicinc.com>
Loading