get_wchan() is racy by design, it may access volatile stack
of running task, thus it may access redzone in a stack frame
and cause KASAN to warn about this.

Use kasan_disable_current()/kasan_enable_current() to silence
these warnings.

Reported-by: Sasha Levin <[email protected]>
Signed-off-by: Andrey Ryabinin <[email protected]>
---

 Perhaps it would be better to add something like this:
        READ_ONCE_NOCHECK()
        {
                kasan_disable_current();
                READ_ONCE();
                kasan_enable_current();
        }
  ?

 arch/x86/kernel/process.c | 18 +++++++++++++-----
 1 file changed, 13 insertions(+), 5 deletions(-)

diff --git a/arch/x86/kernel/process.c b/arch/x86/kernel/process.c
index 39e585a..0488eb9 100644
--- a/arch/x86/kernel/process.c
+++ b/arch/x86/kernel/process.c
@@ -13,6 +13,7 @@
 #include <linux/random.h>
 #include <linux/user-return-notifier.h>
 #include <linux/dmi.h>
+#include <linux/kasan.h>
 #include <linux/utsname.h>
 #include <linux/stackprotector.h>
 #include <linux/tick.h>
@@ -514,7 +515,7 @@ unsigned long arch_randomize_brk(struct mm_struct *mm)
  */
 unsigned long get_wchan(struct task_struct *p)
 {
-       unsigned long start, bottom, top, sp, fp, ip;
+       unsigned long start, bottom, top, sp, fp, ip, ret = 0;
        int count = 0;
 
        if (!p || p == current || p->state == TASK_RUNNING)
@@ -550,14 +551,21 @@ unsigned long get_wchan(struct task_struct *p)
        if (sp < bottom || sp > top)
                return 0;
 
+       kasan_disable_current();
        fp = READ_ONCE(*(unsigned long *)sp);
        do {
                if (fp < bottom || fp > top)
-                       return 0;
+                       goto out;
+
                ip = READ_ONCE(*(unsigned long *)(fp + sizeof(unsigned long)));
-               if (!in_sched_functions(ip))
-                       return ip;
+               if (!in_sched_functions(ip)) {
+                       ret = ip;
+                       goto out;
+               }
                fp = READ_ONCE(*(unsigned long *)fp);
        } while (count++ < 16 && p->state != TASK_RUNNING);
-       return 0;
+
+out:
+       kasan_enable_current();
+       return ret;
 }
-- 
2.4.9

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to [email protected]
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

Reply via email to