From patchwork Fri Aug 9 15:36:54 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Jann Horn X-Patchwork-Id: 13758893 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id 53A3DC3DA4A for ; Fri, 9 Aug 2024 15:37:10 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id DDDA86B0089; Fri, 9 Aug 2024 11:37:09 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id D66146B008C; Fri, 9 Aug 2024 11:37:09 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id C2E0B6B0092; Fri, 9 Aug 2024 11:37:09 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0011.hostedemail.com [216.40.44.11]) by kanga.kvack.org (Postfix) with ESMTP id A4F9B6B0089 for ; Fri, 9 Aug 2024 11:37:09 -0400 (EDT) Received: from smtpin05.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay04.hostedemail.com (Postfix) with ESMTP id 56F061A11CD for ; Fri, 9 Aug 2024 15:37:09 +0000 (UTC) X-FDA: 82433110578.05.38F2D3A Received: from mail-wm1-f43.google.com (mail-wm1-f43.google.com [209.85.128.43]) by imf26.hostedemail.com (Postfix) with ESMTP id 4E42C140012 for ; Fri, 9 Aug 2024 15:37:07 +0000 (UTC) Authentication-Results: imf26.hostedemail.com; dkim=pass header.d=google.com header.s=20230601 header.b=ok+Y2eao; spf=pass (imf26.hostedemail.com: domain of jannh@google.com designates 209.85.128.43 as permitted sender) smtp.mailfrom=jannh@google.com; dmarc=pass (policy=reject) header.from=google.com ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1723217794; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type: content-transfer-encoding:content-transfer-encoding:in-reply-to: references:dkim-signature; bh=NwDMdzsGShHJ6e9jLnQFlgFGGOswIylgETD5oLDX1VI=; b=wHnmKRT5Tbhu9fdWQ45ETZZ/QFsiQaizVB34bVMPNyau8Q/Z0vvmTnWdYPwu2Y84J1Zpzg hdUTQRqjdrkTxpShTOpTwWQ/wOKUw2IXZG8/poopqQ9/9PlNvIvdiAanskg/72qNU3Hu9Q HkmdghlaO6vSzJXdtENj287p9o+xYAA= ARC-Authentication-Results: i=1; imf26.hostedemail.com; dkim=pass header.d=google.com header.s=20230601 header.b=ok+Y2eao; spf=pass (imf26.hostedemail.com: domain of jannh@google.com designates 209.85.128.43 as permitted sender) smtp.mailfrom=jannh@google.com; dmarc=pass (policy=reject) header.from=google.com ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1723217794; a=rsa-sha256; cv=none; b=OG/7dKBaz4Que5KH6/VTbv8kV0KX1gdqmMC4obUZXIhdIJpjLnfiYHbC9sIbIyrVzoswqC TalC6jXhEX94vVLFH2lZ3j7ojCAObV6O7Mi4KQ7PMXEiXA9etI1p0zJ1uWyPv5iyhqZRtA Esosawmo0DniOZRJGd+S0IZP7wJAzK0= Received: by mail-wm1-f43.google.com with SMTP id 5b1f17b1804b1-427fc9834deso65745e9.0 for ; Fri, 09 Aug 2024 08:37:06 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20230601; t=1723217826; x=1723822626; darn=kvack.org; h=cc:to:content-transfer-encoding:mime-version:message-id:date :subject:from:from:to:cc:subject:date:message-id:reply-to; bh=NwDMdzsGShHJ6e9jLnQFlgFGGOswIylgETD5oLDX1VI=; b=ok+Y2eaovw/ygs7wgqTZEZsGRlaaqRmZpcggN0/KiZuZW4aYYZNyOAcdXaW35ASLrD nkxdMCeI9a/kluU3i0rBmCKg//Cd2UDClGGvra9YsQ2ljEFfm9IYKmeD5hju9vLJGagw Y/s9/GlyKeQsb4+Cl95uZ1bXomwfRTzLQLajRf68o5FSYL0ob7xiCZ+66s9HNFh6UrgM qvhEP55TLK4ZzwQoymHPFdqLHrDdoQHjqBLGew+hLLBIm3jh59EGKOggKxgnsxssTgpT S45xVwyBMaZyxkpnwxBIafaoKDOqd2PqtRZIECih9e+8O0oJxJeZ8R/LXdwWQ2rdn5hS omvQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1723217826; x=1723822626; h=cc:to:content-transfer-encoding:mime-version:message-id:date :subject:from:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to; bh=NwDMdzsGShHJ6e9jLnQFlgFGGOswIylgETD5oLDX1VI=; b=cK63krfcmwPdL7OkONN2Xp+vJRvfSzprJvgv4O7gLtANXcdTe2DGDGK3tyzolCLBx/ dOE0xnHuDy2bA3TatRJaN+OyIeFxbZ6CbTmHhNkm+JCrev46rkOyUjWVbROb6PQ9GSne vUnG6qYXYPYdzGTPOROJoty3MHMqm2PVjGK4/xDvYKfzHG1Pz7byjj5WLp7r5qyh6+jA asuurG5oYD9XThNsDYwRIgSTKH++MyD0Bn4eo1IpLdVXeY0CJGharGj1TgIQP+JHNja3 Wax/c4PgK/Umpbybsw0dqJ0yv6bXLGbAyHgfeph4LSuK4yRIm1+SAP/nLWYCMg5tWHgl +pUQ== X-Forwarded-Encrypted: i=1; AJvYcCWpf0xRI69xvGY8C+4c8XW/pz3ioM44i4kG0nUY2AQGiKa0zt3F3XIpYolbao+IOeZlh1w1AdVHwdWh0grSLcSQ4HY= X-Gm-Message-State: AOJu0YyNpNTBtgaIFpC/S6uwlXD0ABUUwOjQ/xcjh1czFdHK5BZZGc26 VSjag7FIjF+m4KFb2M57gcQmaKHy3P7i/MkYT3jP/3KZtPCdhD6w+w6gzZtnnA== X-Google-Smtp-Source: AGHT+IF9SW1oRTPIzo1yEqiGOy+OXB/pUCTzDVM0WFzb9TNHbINjPNCzCPEg7+bT1Mcve9Kc21c2Fg== X-Received: by 2002:a05:600c:1f0a:b0:426:68ce:c97a with SMTP id 5b1f17b1804b1-429c23553ecmr1336575e9.7.1723217824918; Fri, 09 Aug 2024 08:37:04 -0700 (PDT) Received: from localhost ([2a00:79e0:9d:4:1cbc:ea05:2b3e:79e6]) by smtp.gmail.com with ESMTPSA id ffacd0b85a97d-36d27156c8asm5607035f8f.24.2024.08.09.08.37.04 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 09 Aug 2024 08:37:04 -0700 (PDT) From: Jann Horn Subject: [PATCH v8 0/2] allow KASAN to detect UAF in SLAB_TYPESAFE_BY_RCU slabs Date: Fri, 09 Aug 2024 17:36:54 +0200 Message-Id: <20240809-kasan-tsbrcu-v8-0-aef4593f9532@google.com> MIME-Version: 1.0 X-B4-Tracking: v=1; b=H4sIAJY3tmYC/2XOTU7DMBCG4atUXmM0/p+w4h6IhTOxUwuIUVwiU JW741RCpM7ys/S84ysrYU6hsKfTlc1hSSXlqQ58ODE6+2kMPA11MwlSg5OKv/niJ34p/UxfvHf C+A5EdM6ySj7nENP3LffyWvc5lUuef271RW6vfyF9H1okB65NxA7Bam3xecx5fA+PlD/YVlrUX ptGq6qNoE5GjEKAOGi9112j9aZdIDQhIpA9aLPTChpttp/joKgfIhGZg7b/GkE22lZtYUAbvEM tjrfdXmOjXdUwgOmAjPbhXq/r+guCXmJx3wEAAA== To: Andrey Ryabinin , Alexander Potapenko , Andrey Konovalov , Dmitry Vyukov , Vincenzo Frascino , Andrew Morton , Christoph Lameter , Pekka Enberg , David Rientjes , Joonsoo Kim , Vlastimil Babka , Roman Gushchin , Hyeonggon Yoo <42.hyeyoo@gmail.com> Cc: Marco Elver , kasan-dev@googlegroups.com, linux-kernel@vger.kernel.org, linux-mm@kvack.org, David Sterba , Jann Horn , syzbot+263726e59eab6b442723@syzkaller.appspotmail.com X-Mailer: b4 0.15-dev X-Developer-Signature: v=1; a=ed25519-sha256; t=1723217820; l=7406; i=jannh@google.com; s=20240730; h=from:subject:message-id; bh=uFiBYlbkxdigQenIMp5nAwwqrh4S/9K2gPEQtQ2EsiI=; b=W+3X6Fz2LJ4n6j7/pAhLNqx5v9SnrjJHYeGuApT6jH3QQbmWECsCaYqYbZQwG0dttTGpFq8fk PYkNcnijIsKCEYeR9ykvHN/3MJdvRUKIXxr+cQnX/95ui/fyc4cIhAg X-Developer-Key: i=jannh@google.com; a=ed25519; pk=AljNtGOzXeF6khBXDJVVvwSEkVDGnnZZYqfWhP1V+C8= X-Rspamd-Server: rspam03 X-Rspam-User: X-Rspamd-Queue-Id: 4E42C140012 X-Stat-Signature: gcc6c7n9dbzcfry49hxq5ie7iu8ex6g7 X-HE-Tag: 1723217827-378481 X-HE-Meta: U2FsdGVkX18maowH2f8w4nGKGMFMZ+ZLfHpnwkx9Z5CUOGuQ2BHe5NyZO8WNSxtKcIg7jKqAB3PLmqt7+vUYsk1lt298O4WE1eX1+FBQPaaKXq01X6WWcMmMiiJjjye2T+jBFkLKVWE4lpIBrHiqDrp9IQKiDBuppOfTMm0uK1O6xdOLu5k1HGqzY10/ap/WYTrKU1pCsuTFuAHGh3t+DqNSjCjtNAh2KpzzZTSK1mB7JuU7haoSatfXim18Gg+z5IkUM8XRxdpUAVyQ3SfFbx635J9yoG/zh9QQ1/rVR4AWwo5DK88OK86eFIFh03X43jQEBZx8tVs8OkRH7583yVyEYvaBrSsweKZl2KenmWJeSKW6mNx0X8NfXlwUa0IyYFjMrxTY5oCl1SbXLUrWDC2VfzveOWxsyQ4xFoHx/kcfc6hIyYbZ1pUrQL0FdN4a1aWVrD31YYuwXIu0erpZD6h8lAIkStXow0qT0+ro0BBcj6wO90YFNKkInAYsUmhGNEt0YKMn7WoFlgvt3W3TB3PdGWmmc6RBib/s5yzu+HnHiSvlgTEaocuM77vrABfKXOLwPxbsQX6DpqEVpFuORUSzWig0q3dmH/8yW6ezTxpPMwuk6OQS9c/uy8hxTIqRMPez5Rj6ibbbB08VGGx+HnLLSqxoAD8xwubwT1rmgIerhqJ9LR0OKiNwh5YvwopIAXxnAZAzzLO26wAW2/Kb/1K7M0DUoHtgLYVxOZRkszKo1XP8/n1dYk1KRNT2HRexV+o/5Y2V8TM0eac19vVz2II+S9xtlDN/ZzMVC8TGzdNDg9wIaDNWBNSXuNM2D8ZegnopFcy54HeS5O5B8481SQ4P79zSbw7UyApVkS2tvtljnlIf+bVTeS90l/P5lkl/omakaApCpKjYC8lsh3ntBGWN7tTWnRUzJo+kE+p1kHRu1JKGSqwO7Fpzl4sLW9RHwKATiim0pXW6YkLj8Cc 4PPExYda l9GNgZFzOsXyczB9GUYhNFHweJ7Rl6gMSjKz7Knd1TTuNfLOA/jQ909XeZXTeA8ACDYxtI5fzznJj1/fbEET0Tp5QUSsm4Mjrvz3tXxhMY28i5HEuxQ4wQWgWjsNBlPTvY3vQEZhSoUxqA63YKvy6qAM7Hv77Dx7/VqCUI3HO/qa8gP2OS2yjHbkZhtbi8Ia9/uUUWFAQq5jYR014zzRme3Q0vdMXKIoFKkISq8BgLYAActlYyrzgMszp26dvmasN6aumRLEaKOzjm78Nj8ozF0eQFs4ciuvKwHCEUjJYqSjkgvaNm6ln4k4tC4sztKcTTdt2oZkVoA/kHGbkAvu6nbXGReIRM09W94aNbdZoG0c80wv7qS+ocsmg3N6Bvg8cPQrhZAU3qJ8nHK4x7KQLk/rQixO23zuygrm+fYz+uXQ/mRb1XxhLyT+/qwG6gFvUYR5bDZkMPprqRjUfbCtVbSPair3OrVp8NP530XjtL/1qkD6bqFqQwx7YpQ== X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: List-Subscribe: List-Unsubscribe: Hi! The purpose of the series is to allow KASAN to detect use-after-free access in SLAB_TYPESAFE_BY_RCU slab caches, by essentially making them behave as if the cache was not SLAB_TYPESAFE_BY_RCU but instead every kfree() in the cache was a kfree_rcu(). This is gated behind a config flag that is supposed to only be enabled in fuzzing/testing builds where the performance impact doesn't matter. Output of the new kunit testcase I added to the KASAN test suite: ================================================================== BUG: KASAN: slab-use-after-free in kmem_cache_rcu_uaf+0x3ae/0x4d0 Read of size 1 at addr ffff888106224000 by task kunit_try_catch/224 CPU: 7 PID: 224 Comm: kunit_try_catch Tainted: G B N 6.10.0-00003-g065427d4b87f #430 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 Call Trace: dump_stack_lvl+0x53/0x70 print_report+0xce/0x670 [...] kasan_report+0xa5/0xe0 [...] kmem_cache_rcu_uaf+0x3ae/0x4d0 [...] kunit_try_run_case+0x1b3/0x490 [...] kunit_generic_run_threadfn_adapter+0x80/0xe0 kthread+0x2a5/0x370 [...] ret_from_fork+0x34/0x70 [...] ret_from_fork_asm+0x1a/0x30 Allocated by task 224: kasan_save_stack+0x33/0x60 kasan_save_track+0x14/0x30 __kasan_slab_alloc+0x6e/0x70 kmem_cache_alloc_noprof+0xef/0x2b0 kmem_cache_rcu_uaf+0x10d/0x4d0 kunit_try_run_case+0x1b3/0x490 kunit_generic_run_threadfn_adapter+0x80/0xe0 kthread+0x2a5/0x370 ret_from_fork+0x34/0x70 ret_from_fork_asm+0x1a/0x30 Freed by task 0: kasan_save_stack+0x33/0x60 kasan_save_track+0x14/0x30 kasan_save_free_info+0x3b/0x60 __kasan_slab_free+0x57/0x80 slab_free_after_rcu_debug+0xe3/0x220 rcu_core+0x676/0x15b0 handle_softirqs+0x22f/0x690 irq_exit_rcu+0x84/0xb0 sysvec_apic_timer_interrupt+0x6a/0x80 asm_sysvec_apic_timer_interrupt+0x1a/0x20 Last potentially related work creation: kasan_save_stack+0x33/0x60 __kasan_record_aux_stack+0x8e/0xa0 kmem_cache_free+0x10c/0x420 kmem_cache_rcu_uaf+0x16e/0x4d0 kunit_try_run_case+0x1b3/0x490 kunit_generic_run_threadfn_adapter+0x80/0xe0 kthread+0x2a5/0x370 ret_from_fork+0x34/0x70 ret_from_fork_asm+0x1a/0x30 The buggy address belongs to the object at ffff888106224000 which belongs to the cache test_cache of size 200 The buggy address is located 0 bytes inside of freed 200-byte region [ffff888106224000, ffff8881062240c8) The buggy address belongs to the physical page: page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x106224 head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 flags: 0x200000000000040(head|node=0|zone=2) page_type: 0xffffefff(slab) raw: 0200000000000040 ffff88810621c140 dead000000000122 0000000000000000 raw: 0000000000000000 00000000801f001f 00000001ffffefff 0000000000000000 head: 0200000000000040 ffff88810621c140 dead000000000122 0000000000000000 head: 0000000000000000 00000000801f001f 00000001ffffefff 0000000000000000 head: 0200000000000001 ffffea0004188901 ffffffffffffffff 0000000000000000 head: 0000000000000002 0000000000000000 00000000ffffffff 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff888106223f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffff888106223f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc >ffff888106224000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff888106224080: fb fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc ffff888106224100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ================================================================== ok 38 kmem_cache_rcu_uaf Signed-off-by: Jann Horn --- Changes in v8: - in patch 2/2: - move rcu_barrier() out of locked region (vbabka) - rearrange code in slab_free_after_rcu_debug (vbabka) - Link to v7: https://lore.kernel.org/r/20240808-kasan-tsbrcu-v7-0-0d0590c54ae6@google.com Changes in v7: - in patch 2/2: - clarify kconfig comment (Marco) - fix memory leak (vbabka and dsterba) - move rcu_barrier() call up into kmem_cache_destroy() to hopefully make the merge conflict with vbabka's https://lore.kernel.org/all/20240807-b4-slab-kfree_rcu-destroy-v2-1-ea79102f428c@suse.cz/ easier to deal with - Link to v6: https://lore.kernel.org/r/20240802-kasan-tsbrcu-v6-0-60d86ea78416@google.com Changes in v6: - in patch 1/2: - fix commit message (Andrey) - change comments (Andrey) - fix mempool handling of kfence objects (Andrey) - in patch 2/2: - fix is_kfence_address argument (syzbot and Marco) - refactor slab_free_hook() to create "still_accessible" variable - change kasan_slab_free() hook argument to "still_accessible" - add documentation to kasan_slab_free() hook - Link to v5: https://lore.kernel.org/r/20240730-kasan-tsbrcu-v5-0-48d3cbdfccc5@google.com Changes in v5: - rebase to latest origin/master (akpm), no other changes from v4 - Link to v4: https://lore.kernel.org/r/20240729-kasan-tsbrcu-v4-0-57ec85ef80c6@google.com Changes in v4: - note I kept vbabka's ack for the SLUB changes in patch 1/2 since the SLUB part didn't change, even though I refactored a bunch of the KASAN parts - in patch 1/2 (major rework): - fix commit message (Andrey) - add doc comments in header (Andrey) - remove "ip" argument from __kasan_slab_free() - rework the whole check_slab_free() thing and move code around (Andrey) - in patch 2/2: - kconfig description and dependency changes (Andrey) - remove useless linebreak (Andrey) - fix comment style (Andrey) - fix do_slab_free() invocation (kernel test robot) - Link to v3: https://lore.kernel.org/r/20240725-kasan-tsbrcu-v3-0-51c92f8f1101@google.com Changes in v3: - in patch 1/2, integrate akpm's fix for !CONFIG_KASAN build failure - in patch 2/2, as suggested by vbabka, use dynamically allocated rcu_head to avoid having to add slab metadata - in patch 2/2, add a warning in the kconfig help text that objects can be recycled immediately under memory pressure - Link to v2: https://lore.kernel.org/r/20240724-kasan-tsbrcu-v2-0-45f898064468@google.com Changes in v2: Patch 1/2 is new; it's some necessary prep work for the main patch to work, though the KASAN integration maybe is a bit ugly. Patch 2/2 is a rebased version of the old patch, with some changes to how the config is wired up, with poison/unpoison logic added as suggested by dvyukov@ back then, with cache destruction fixed using rcu_barrier() as pointed out by dvyukov@ and the test robot, and a test added as suggested by elver@. --- Jann Horn (2): kasan: catch invalid free before SLUB reinitializes the object slub: Introduce CONFIG_SLUB_RCU_DEBUG include/linux/kasan.h | 63 ++++++++++++++++++++++++++++++++++--- mm/Kconfig.debug | 32 +++++++++++++++++++ mm/kasan/common.c | 62 ++++++++++++++++++++++--------------- mm/kasan/kasan_test.c | 46 +++++++++++++++++++++++++++ mm/slab_common.c | 16 ++++++++++ mm/slub.c | 86 ++++++++++++++++++++++++++++++++++++++++++++++----- 6 files changed, 267 insertions(+), 38 deletions(-) --- base-commit: 94ede2a3e9135764736221c080ac7c0ad993dc2d change-id: 20240723-kasan-tsbrcu-b715a901f776