From patchwork Tue Dec 19 22:28:53 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: andrey.konovalov@linux.dev X-Patchwork-Id: 13499302 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id 33FACC46CD3 for ; Tue, 19 Dec 2023 22:30:25 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id 2C9068D000C; Tue, 19 Dec 2023 17:30:23 -0500 (EST) Received: by kanga.kvack.org (Postfix, from userid 40) id 202AD8D000D; Tue, 19 Dec 2023 17:30:23 -0500 (EST) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id EFA858D000C; Tue, 19 Dec 2023 17:30:22 -0500 (EST) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0013.hostedemail.com [216.40.44.13]) by kanga.kvack.org (Postfix) with ESMTP id E0FFF8D0009 for ; Tue, 19 Dec 2023 17:30:22 -0500 (EST) Received: from smtpin16.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay07.hostedemail.com (Postfix) with ESMTP id BB0771603B8 for ; Tue, 19 Dec 2023 22:30:22 +0000 (UTC) X-FDA: 81585012684.16.5AE7A1F Received: from out-170.mta0.migadu.com (out-170.mta0.migadu.com [91.218.175.170]) by imf12.hostedemail.com (Postfix) with ESMTP id EDE544001B for ; Tue, 19 Dec 2023 22:30:20 +0000 (UTC) Authentication-Results: imf12.hostedemail.com; dkim=pass header.d=linux.dev header.s=key1 header.b=TbFrSJjR; dmarc=pass (policy=none) header.from=linux.dev; spf=pass (imf12.hostedemail.com: domain of andrey.konovalov@linux.dev designates 91.218.175.170 as permitted sender) smtp.mailfrom=andrey.konovalov@linux.dev ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1703025021; a=rsa-sha256; cv=none; b=qOb00lI4iNoD6q7cFZvOURPxncZjvLTzPHK7XAvoRfLRuDMm+YUZOxh3nksQ0Y9HqsvrEO 3zEVN2rc99fnNVnzJYQz33Wth1q17mlvK9kYGEjkJAtcVOPnAP5FD5zqkmZ5WgDto9AskO HDtCOPRhVCROvmoqHHaa2i+N6Yjj3Bw= ARC-Authentication-Results: i=1; imf12.hostedemail.com; dkim=pass header.d=linux.dev header.s=key1 header.b=TbFrSJjR; dmarc=pass (policy=none) header.from=linux.dev; spf=pass (imf12.hostedemail.com: domain of andrey.konovalov@linux.dev designates 91.218.175.170 as permitted sender) smtp.mailfrom=andrey.konovalov@linux.dev ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1703025021; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references:dkim-signature; bh=hXURpFT5cXmxHd6E+IlRMk2ARDz23DTQrTWld5qdG1E=; b=aMZqFKPO5kez1TWgYm9hsQQe8Xh2J4S9bm2xAOUrzCUI2KBI1clvowz93H1e1OWmle4ufv 0R68muk5PKnhN93J4Su8Q/WfFE5hQXbCgffPLO+aPCXYZLJorSQA9mWzLxp5ZcECs6ShCg UTAD3vazBDjq6+y7kU4U2q134gz58QM= X-Report-Abuse: Please report any abuse attempt to abuse@migadu.com and include these headers. DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linux.dev; s=key1; t=1703025019; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=hXURpFT5cXmxHd6E+IlRMk2ARDz23DTQrTWld5qdG1E=; b=TbFrSJjRFEHr11m9ihb+YpF44WT4zDOU6SR/gpiWxNk2O2ewimYty9RDE8JeT2bHHQsmaJ 7iHSxvOfzi3HpU9gwdbmyAE7I1nnRqLM1ejSraTyzN977wLeS1qdGvxzBLEl1QotjPd3vl vMCPpPc3Z0zUFBC41bC95eXG8vcuwiQ= From: andrey.konovalov@linux.dev To: Marco Elver , Alexander Potapenko Cc: Andrey Konovalov , Dmitry Vyukov , Andrey Ryabinin , kasan-dev@googlegroups.com, Evgenii Stepanov , Breno Leitao , Alexander Lobakin , Andrew Morton , linux-mm@kvack.org, linux-kernel@vger.kernel.org, Andrey Konovalov Subject: [PATCH mm 09/21] kasan: save free stack traces for slab mempools Date: Tue, 19 Dec 2023 23:28:53 +0100 Message-Id: <413a7c7c3344fb56809853339ffaabc9e4905e94.1703024586.git.andreyknvl@google.com> In-Reply-To: References: MIME-Version: 1.0 X-Migadu-Flow: FLOW_OUT X-Rspam-User: X-Rspamd-Server: rspam06 X-Rspamd-Queue-Id: EDE544001B X-Stat-Signature: d7pnim8guxrcf9usei6b38mbtxk36xp6 X-HE-Tag: 1703025020-200606 X-HE-Meta: U2FsdGVkX1/ou4Tx4dL7y85txrf8iex9Uf84RzTdAm0OgmTyYcaJF7fomVeqCwz7tA7BWYH7JLgGgCH6zWVDCGmd5z7Mm6bemho/RVx0mMXAwTdvXxFPhwV4lltr6EB/+Rt/8Wegx84+HrRrBGkLZMsloViE/kafqtZR+7cwBsmpZfuJD05rolbJ9P5wzTkw+QO63l4+lCmsTc+3rHx6O7A6xscWStXpD7YR2dCjgcXEj5YZ+bap+u0rUilFMzre9h9gUZL2oJX5qZ50LhJYx7HxK9mN7K428dlVa0ZVuyDACs6wt3hlin92xr+eTKFSRODjaEru16uswAgrpWyd9HmHTFxWclW4AOy7m3dlZnYokKqwSQXv08Nqa7DEir3jOCPlWtgnuOaMpbkZW6ESmIhNjAQVNvpsywYcl5JtsH8o0lmVFMTYj9VFe5KNw2wZVW6g2hBbSw609TR2TIvEryQWTXyrvG0JgyDo8rQd9+2lz6wp337SI0i5pa91VPpoG3xiAIsbrzksOutbdnC1F6mECItdtgtYoMp9NQ9eqquKglvXlDd6F0baayPaQYw6D8o79hL1o9RYyVD7+ar5g3UOtF7ybreLovt9ow2O1hhBSowIY/Ru3xJQC86cLOjl7hJsgbW11g8YeqbVaaK4a1jWdrN7+Li3k0xbkGzr8EOObi9+3rBkKBDobAcHg8emhUcyV0PqVdNBVj0tCNxc97H1BAyT/XQeAFKLNRr42uvxHFT37dvZAtsVwSku1jUgJpH2oIiVqkodqZasLAQ8kGXsY012VT6ikWmv/svjGyqPhxLQn1Hbwuignj9cEPqnazUonWyyecpj/I/d1tPw2iIF1SpV+qkxb+YS+RmJFT8cSw3O5FohroPWr36wc8luwscXhnQLSlRcgyFwAQzUmFDEIq53ca3E3iteYrlpCpG/ldGcCRmgTruqNXffBCvzf0zfd88Hpvt8ZWBdKqu GMRLqz4r m6p1deUKIE9FFEByDRA63uBd/MDeduwJEFbAM8u0WRoqa+p1tE/c7FCePwEW+W3xafcwnZTzzqqgsUoRcj8UCm74tS1ygfmS25HFsHpgiTVg+q6PvOww7jvA23yOZ58dLk+//xdQzzBWvSnqhoF210fLXp3dxOhyu7oTW X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: List-Subscribe: List-Unsubscribe: From: Andrey Konovalov Make kasan_mempool_poison_object save free stack traces for slab and kmalloc mempools when the object is freed into the mempool. Also simplify and rename ____kasan_slab_free to poison_slab_object and do a few other reability changes. Signed-off-by: Andrey Konovalov --- include/linux/kasan.h | 5 +++-- mm/kasan/common.c | 20 +++++++++----------- 2 files changed, 12 insertions(+), 13 deletions(-) diff --git a/include/linux/kasan.h b/include/linux/kasan.h index f8ebde384bd7..e636a00e26ba 100644 --- a/include/linux/kasan.h +++ b/include/linux/kasan.h @@ -268,8 +268,9 @@ bool __kasan_mempool_poison_object(void *ptr, unsigned long ip); * to reuse them instead of freeing them back to the slab allocator (e.g. * mempool). * - * This function poisons a slab allocation without initializing its memory and - * without putting it into the quarantine (for the Generic mode). + * This function poisons a slab allocation and saves a free stack trace for it + * without initializing the allocation's memory and without putting it into the + * quarantine (for the Generic mode). * * This function also performs checks to detect double-free and invalid-free * bugs and reports them. The caller can use the return value of this function diff --git a/mm/kasan/common.c b/mm/kasan/common.c index 3f4a1ed69e03..59146886e57d 100644 --- a/mm/kasan/common.c +++ b/mm/kasan/common.c @@ -207,8 +207,8 @@ void * __must_check __kasan_init_slab_obj(struct kmem_cache *cache, return (void *)object; } -static inline bool ____kasan_slab_free(struct kmem_cache *cache, void *object, - unsigned long ip, bool quarantine, bool init) +static inline bool poison_slab_object(struct kmem_cache *cache, void *object, + unsigned long ip, bool init) { void *tagged_object; @@ -221,13 +221,12 @@ static inline bool ____kasan_slab_free(struct kmem_cache *cache, void *object, if (is_kfence_address(object)) return false; - if (unlikely(nearest_obj(cache, virt_to_slab(object), object) != - object)) { + if (unlikely(nearest_obj(cache, virt_to_slab(object), object) != object)) { kasan_report_invalid_free(tagged_object, ip, KASAN_REPORT_INVALID_FREE); return true; } - /* RCU slabs could be legally used after free within the RCU period */ + /* RCU slabs could be legally used after free within the RCU period. */ if (unlikely(cache->flags & SLAB_TYPESAFE_BY_RCU)) return false; @@ -239,19 +238,18 @@ static inline bool ____kasan_slab_free(struct kmem_cache *cache, void *object, kasan_poison(object, round_up(cache->object_size, KASAN_GRANULE_SIZE), KASAN_SLAB_FREE, init); - if ((IS_ENABLED(CONFIG_KASAN_GENERIC) && !quarantine)) - return false; - if (kasan_stack_collection_enabled()) kasan_save_free_info(cache, tagged_object); - return kasan_quarantine_put(cache, object); + return false; } bool __kasan_slab_free(struct kmem_cache *cache, void *object, unsigned long ip, bool init) { - return ____kasan_slab_free(cache, object, ip, true, init); + bool buggy_object = poison_slab_object(cache, object, ip, init); + + return buggy_object ? true : kasan_quarantine_put(cache, object); } static inline bool check_page_allocation(void *ptr, unsigned long ip) @@ -472,7 +470,7 @@ bool __kasan_mempool_poison_object(void *ptr, unsigned long ip) } slab = folio_slab(folio); - return !____kasan_slab_free(slab->slab_cache, ptr, ip, false, false); + return !poison_slab_object(slab->slab_cache, ptr, ip, false); } void __kasan_mempool_unpoison_object(void *ptr, size_t size, unsigned long ip)