From patchwork Wed Apr 15 17:55:30 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Kees Cook X-Patchwork-Id: 11491783 Return-Path: Received: from mail.kernel.org (pdx-korg-mail-1.web.codeaurora.org [172.30.200.123]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id B03C892C for ; Wed, 15 Apr 2020 17:55:36 +0000 (UTC) Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by mail.kernel.org (Postfix) with ESMTP id 7CFCF208E4 for ; Wed, 15 Apr 2020 17:55:36 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=pass (1024-bit key) header.d=chromium.org header.i=@chromium.org header.b="nDBmuWGL" DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org 7CFCF208E4 Authentication-Results: mail.kernel.org; dmarc=fail (p=none dis=none) header.from=chromium.org Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=owner-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix) id A4E208E002E; Wed, 15 Apr 2020 13:55:35 -0400 (EDT) Delivered-To: linux-mm-outgoing@kvack.org Received: by kanga.kvack.org (Postfix, from userid 40) id 9D7968E0001; Wed, 15 Apr 2020 13:55:35 -0400 (EDT) X-Original-To: int-list-linux-mm@kvack.org X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 8C6A68E002E; Wed, 15 Apr 2020 13:55:35 -0400 (EDT) X-Original-To: linux-mm@kvack.org X-Delivered-To: linux-mm@kvack.org Received: from forelay.hostedemail.com (smtprelay0091.hostedemail.com [216.40.44.91]) by kanga.kvack.org (Postfix) with ESMTP id 726FD8E0001 for ; Wed, 15 Apr 2020 13:55:35 -0400 (EDT) Received: from smtpin05.hostedemail.com (10.5.19.251.rfc1918.com [10.5.19.251]) by forelay03.hostedemail.com (Postfix) with ESMTP id 33A2B824556B for ; Wed, 15 Apr 2020 17:55:35 +0000 (UTC) X-FDA: 76710841830.05.flock18_30b73d6f3b051 X-Spam-Summary: 2,0,0,f4ca6823d0a5aafa,d41d8cd98f00b204,keescook@chromium.org,,RULES_HIT:41:355:379:800:960:965:966:967:973:981:988:989:1260:1277:1312:1313:1314:1345:1437:1516:1518:1519:1534:1542:1593:1594:1595:1596:1711:1730:1747:1777:1792:2194:2196:2198:2199:2200:2201:2393:2525:2553:2559:2563:2682:2685:2731:2859:2890:2902:2933:2937:2939:2942:2945:2947:2951:2954:3022:3138:3139:3140:3141:3142:3353:3865:3866:3867:3871:3872:3874:3934:3936:3938:3941:3944:3947:3950:3953:3956:3959:4042:4321:4385:4390:4395:5007:6261:6653:8603:9025:10004:10400:11026:11232:11473:11658:11914:12043:12296:12297:12517:12519:12555:12679:12696:12737:12895:12986:13161:13221:13229:13439:13846:13895:14093:14096:14097:14181:14394:14721:21063:21080:21444:21450:21451:21627:21749:21811:21939:22047:30001:30025:30054:30070:30090,0,RBL:209.85.216.67:@chromium.org:.lbl8.mailshell.net-62.2.0.100 66.100.201.201,CacheIP:none,Bayesian:0.5,0.5,0.5,Netcheck:none,DomainCache:0,MSF:not bulk,SPF:fp,MSBL:0,DNSBL:neutral,Custom _rules:0 X-HE-Tag: flock18_30b73d6f3b051 X-Filterd-Recvd-Size: 4826 Received: from mail-pj1-f67.google.com (mail-pj1-f67.google.com [209.85.216.67]) by imf41.hostedemail.com (Postfix) with ESMTP for ; Wed, 15 Apr 2020 17:55:34 +0000 (UTC) Received: by mail-pj1-f67.google.com with SMTP id b7so172360pju.0 for ; Wed, 15 Apr 2020 10:55:34 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=chromium.org; s=google; h=date:from:to:cc:subject:message-id:mime-version:content-disposition; bh=WknHuSsMv5PZIolEyRt8fzItA0jcsProAC7yJPzp7k4=; b=nDBmuWGLKCO2b/2H3Eg7fuNSI0hhyvNr8N1Q3txVfEtfoojywuD5oY4C9EEbR4Jj+I x+RZqc5v9tmdbUboOysxB2lEk81n50KXM2XHhUJq2oH4bpmvVejNxSyD6vy/bPaxMdlo iIs8Kka8G3S4OJScn6jfe8YMVVer0A1f4CpdI= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:date:from:to:cc:subject:message-id:mime-version :content-disposition; bh=WknHuSsMv5PZIolEyRt8fzItA0jcsProAC7yJPzp7k4=; b=ZjCdBIBuw+CHR827YULn2rJWyvdMSpBRV+PRxvTqqCcAX0ykNeyz56l3UouZdpCVfe Sp2le0Z7LGAJo4Oi7klp9oqovHl50n03kmwpuXpPe7YI9NiiwEmQn7TOeG8NjwEEwjR5 9/wvUGASD8mgcv3201v/3sow7e+e7dWXpYOPIYMWlR9ltiEclCOtQ/+bH1w9InrvyDbi m1q/5iCuTJr1QDLFnJmPoF+74Daoel6sXesRuULw2oTtkzG6nvMEwKNLYm7GXTDsCX1J mY7HcMa9zH/6Wf2YeQSK18aNYZw3dspUtst21UrJvm7yWzGYYUwHFMNDpoWrwC+alrMw ywUw== X-Gm-Message-State: AGi0PubpfEm9xxAn0QuTp8uwcGpFMS58mV6e/B4auRbkivzZODy7C6d1 LUyiuCmtyCI1vSeT4WNoYGk9pQ== X-Google-Smtp-Source: APiQypJq7k4/MnAu3XXlcJmYNYMeOnaI3/KkXDgFGyoSc/dzG6EoQ4klxQczruF3S4zVhyJACGAUTg== X-Received: by 2002:a17:902:b284:: with SMTP id u4mr5638708plr.97.1586973333588; Wed, 15 Apr 2020 10:55:33 -0700 (PDT) Received: from www.outflux.net (smtp.outflux.net. [198.145.64.163]) by smtp.gmail.com with ESMTPSA id d5sm14476337pfa.59.2020.04.15.10.55.30 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 15 Apr 2020 10:55:32 -0700 (PDT) Date: Wed, 15 Apr 2020 10:55:30 -0700 From: Kees Cook To: Andrew Morton , Marco Elver Cc: Christoph Lameter , Pekka Enberg , David Rientjes , Joonsoo Kim , linux-mm@kvack.org, linux-kernel@vger.kernel.org Subject: [PATCH] slub: Avoid redzone when choosing freepointer location Message-ID: <202004151054.BD695840@keescook> MIME-Version: 1.0 Content-Disposition: inline X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: Marco Elver reported system crashes when booting with "slub_debug=Z". The freepointer location (s->offset) was not taking into account that the "inuse" size that includes the redzone area should not be used by the freelist pointer. Change the calculation to save the area of the object that an inline freepointer may be written into. Reported-by: Marco Elver Link: https://lore.kernel.org/linux-mm/20200415164726.GA234932@google.com Fixes: 3202fa62fb43 ("slub: relocate freelist pointer to middle of object") Signed-off-by: Kees Cook Tested-by: Marco Elver --- mm/slub.c | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) diff --git a/mm/slub.c b/mm/slub.c index 332d4b459a90..9bf44955c4f1 100644 --- a/mm/slub.c +++ b/mm/slub.c @@ -3533,6 +3533,7 @@ static int calculate_sizes(struct kmem_cache *s, int forced_order) { slab_flags_t flags = s->flags; unsigned int size = s->object_size; + unsigned int freepointer_area; unsigned int order; /* @@ -3541,6 +3542,13 @@ static int calculate_sizes(struct kmem_cache *s, int forced_order) * the possible location of the free pointer. */ size = ALIGN(size, sizeof(void *)); + /* + * This is the area of the object where a freepointer can be + * safely written. If redzoning adds more to the inuse size, we + * can't use that portion for writing the freepointer, so + * s->offset must be limited within this for the general case. + */ + freepointer_area = size; #ifdef CONFIG_SLUB_DEBUG /* @@ -3582,13 +3590,13 @@ static int calculate_sizes(struct kmem_cache *s, int forced_order) */ s->offset = size; size += sizeof(void *); - } else if (size > sizeof(void *)) { + } else if (freepointer_area > sizeof(void *)) { /* * Store freelist pointer near middle of object to keep * it away from the edges of the object to avoid small * sized over/underflows from neighboring allocations. */ - s->offset = ALIGN(size / 2, sizeof(void *)); + s->offset = ALIGN(freepointer_area / 2, sizeof(void *)); } #ifdef CONFIG_SLUB_DEBUG