From patchwork Sun Apr 24 10:59:49 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Shaobo Huang X-Patchwork-Id: 12824858 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id 5F1E6C433F5 for ; Sun, 24 Apr 2022 11:00:33 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id C60346B0074; Sun, 24 Apr 2022 07:00:32 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id C102C6B0075; Sun, 24 Apr 2022 07:00:32 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id AD63B6B0078; Sun, 24 Apr 2022 07:00:32 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (relay.hostedemail.com [64.99.140.28]) by kanga.kvack.org (Postfix) with ESMTP id 9AB436B0074 for ; Sun, 24 Apr 2022 07:00:32 -0400 (EDT) Received: from smtpin06.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay12.hostedemail.com (Postfix) with ESMTP id A64E0122A22 for ; Sun, 24 Apr 2022 11:00:31 +0000 (UTC) X-FDA: 79391479062.06.1C86EA7 Received: from szxga02-in.huawei.com (szxga02-in.huawei.com [45.249.212.188]) by imf25.hostedemail.com (Postfix) with ESMTP id D2A6BA0039 for ; Sun, 24 Apr 2022 11:00:24 +0000 (UTC) Received: from kwepemi100005.china.huawei.com (unknown [172.30.72.54]) by szxga02-in.huawei.com (SkyGuard) with ESMTP id 4KmQCc1z70zhYT6; Sun, 24 Apr 2022 19:00:12 +0800 (CST) Received: from kwepemm600020.china.huawei.com (7.193.23.147) by kwepemi100005.china.huawei.com (7.221.188.155) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.2375.24; Sun, 24 Apr 2022 19:00:26 +0800 Received: from DESKTOP-E0KHRBE.china.huawei.com (10.67.111.5) by kwepemm600020.china.huawei.com (7.193.23.147) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.2375.24; Sun, 24 Apr 2022 19:00:25 +0800 From: Shaobo Huang To: , , , , , , CC: , , , , , , , Subject: [PATCH v2] kfence: enable check kfence canary in panic via boot param Date: Sun, 24 Apr 2022 18:59:49 +0800 Message-ID: <20220424105949.50016-1-huangshaobo6@huawei.com> X-Mailer: git-send-email 2.21.0.windows.1 MIME-Version: 1.0 X-Originating-IP: [10.67.111.5] X-ClientProxiedBy: dggems702-chm.china.huawei.com (10.3.19.179) To kwepemm600020.china.huawei.com (7.193.23.147) X-CFilter-Loop: Reflected Authentication-Results: imf25.hostedemail.com; dkim=none; spf=pass (imf25.hostedemail.com: domain of huangshaobo6@huawei.com designates 45.249.212.188 as permitted sender) smtp.mailfrom=huangshaobo6@huawei.com; dmarc=pass (policy=quarantine) header.from=huawei.com X-Rspam-User: X-Rspamd-Server: rspam05 X-Rspamd-Queue-Id: D2A6BA0039 X-Stat-Signature: ng47341cjqyg4uuwhq5rn54bctmuoady X-HE-Tag: 1650798024-501924 X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: From: huangshaobo when writing out of bounds to the red zone, it can only be detected at kfree. However, the system may have been reset before freeing the memory, which would result in undetected oob. Therefore, it is necessary to detect oob behavior in panic. Since only the allocated mem call stack is available, it may be difficult to find the oob maker. Therefore, this feature is disabled by default and can only be enabled via boot parameter. Suggested-by: chenzefeng Signed-off-by: huangshaobo --- v2: - it is only detected in panic. - it is disabled by default. - can only be enabled via boot parameter. - the code is moved to the specified partition. Thanks to Marco for the valuable modification suggestion. --- mm/kfence/core.c | 33 +++++++++++++++++++++++++++++++++ 1 file changed, 33 insertions(+) diff --git a/mm/kfence/core.c b/mm/kfence/core.c index 9b2b5f56f4ae..0b2b934a1666 100644 --- a/mm/kfence/core.c +++ b/mm/kfence/core.c @@ -29,6 +29,8 @@ #include #include #include +#include +#include #include @@ -99,6 +101,10 @@ module_param_named(skip_covered_thresh, kfence_skip_covered_thresh, ulong, 0644) static bool kfence_deferrable __read_mostly = IS_ENABLED(CONFIG_KFENCE_DEFERRABLE); module_param_named(deferrable, kfence_deferrable, bool, 0444); +/* If true, check kfence canary in panic. */ +static bool kfence_check_on_panic; +module_param_named(check_on_panic, kfence_check_on_panic, bool, 0444); + /* The pool of pages used for guard pages and objects. */ char *__kfence_pool __read_mostly; EXPORT_SYMBOL(__kfence_pool); /* Export for test modules. */ @@ -727,6 +733,30 @@ static int __init kfence_debugfs_init(void) late_initcall(kfence_debugfs_init); +/* === Panic Notifier ====================================================== */ +static void kfence_check_all_canary(void) +{ + int i; + + for (i = 0; i < CONFIG_KFENCE_NUM_OBJECTS; i++) { + struct kfence_metadata *meta = &kfence_metadata[i]; + + if (meta->state == KFENCE_OBJECT_ALLOCATED) + for_each_canary(meta, check_canary_byte); + } +} + +static int kfence_check_canary_callback(struct notifier_block *nb, + unsigned long reason, void *arg) +{ + kfence_check_all_canary(); + return NOTIFY_OK; +} + +static struct notifier_block kfence_check_canary_notifier = { + .notifier_call = kfence_check_canary_callback, +}; + /* === Allocation Gate Timer ================================================ */ static struct delayed_work kfence_timer; @@ -804,6 +834,9 @@ static void kfence_init_enable(void) else INIT_DELAYED_WORK(&kfence_timer, toggle_allocation_gate); + if (kfence_check_on_panic) + atomic_notifier_chain_register(&panic_notifier_list, &kfence_check_canary_notifier); + WRITE_ONCE(kfence_enabled, true); queue_delayed_work(system_unbound_wq, &kfence_timer, 0);