Commit 0c49fbe2 authored by Oreoluwa Babatunde's avatar Oreoluwa Babatunde Committed by Treehugger Robot
Browse files

ANDROID: arm64: Add kernel_nofault vendor hook in __slab_alloc path

Consider the below call flow during kmem_cache_alloc using the lock-less
fast path.

__slab_alloc_node
  object = c->freelist;
  get_freepointer_safe();
  if (!debug_pagealloc_enabled_static())
	get_freepointer();
	  freelist_ptr_decode() <- possible bad memory access.

In this path, the slab lock is not taken before reading the freelist.
This means that it is possible to get a stale pointer here if another
thread is modifying or has modified the freelist in parallel.

The patch linked in [1] introduces a vendor hook which gracefully
handles the case where the kernel tries to access an address
that has been unmapped in the S2 pg-tables and given to another vm.

For the slab_alloc_node() path in question, If CONFIG_DEBUG_PAGEALLOC is
not enabled, then the code will access the address without calling
copy_from_kernel_nofault() which is meant to register the access in the
ex_table. If the access is not registered in the ex_table, then the vendor
hook cannot handle the fault if the address turned out to have been
unmapped in S2.

Hence add a kernel_nofault vendor hook in the __slab_alloc_node() fast
path to ensure that copy_from_kernel_nofault() is called so that this
case can be handled gracefully.

[1] https://android-review.googlesource.com/c/kernel/common/+/3460342



Bug: 448438370
Fixes: 57fa6d94 ("ANDROID: arm64: Call fixup_exception() within do_sea()")
Change-Id: Ib7013840a06049744761aa3bd340c7274f0f95b1
Signed-off-by: default avatarOreoluwa Babatunde <quic_obabatun@quicinc.com>
parent 445fb9b8
Loading
Loading
Loading
Loading
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Please to comment