From patchwork Wed Sep 4 06:51:33 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Walter Wu X-Patchwork-Id: 11129457 Return-Path: Received: from mail.kernel.org (pdx-korg-mail-1.web.codeaurora.org [172.30.200.123]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id A7CFE13B1 for ; Wed, 4 Sep 2019 06:51:47 +0000 (UTC) Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by mail.kernel.org (Postfix) with ESMTP id 7528D2339D for ; Wed, 4 Sep 2019 06:51:47 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org 7528D2339D Authentication-Results: mail.kernel.org; dmarc=fail (p=none dis=none) header.from=mediatek.com Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=owner-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix) id ABCAA6B0003; Wed, 4 Sep 2019 02:51:46 -0400 (EDT) Delivered-To: linux-mm-outgoing@kvack.org Received: by kanga.kvack.org (Postfix, from userid 40) id A47496B0006; Wed, 4 Sep 2019 02:51:46 -0400 (EDT) X-Original-To: int-list-linux-mm@kvack.org X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 9348D6B0007; Wed, 4 Sep 2019 02:51:46 -0400 (EDT) X-Original-To: linux-mm@kvack.org X-Delivered-To: linux-mm@kvack.org Received: from forelay.hostedemail.com (smtprelay0021.hostedemail.com [216.40.44.21]) by kanga.kvack.org (Postfix) with ESMTP id 6CEBB6B0003 for ; Wed, 4 Sep 2019 02:51:46 -0400 (EDT) Received: from smtpin05.hostedemail.com (10.5.19.251.rfc1918.com [10.5.19.251]) by forelay03.hostedemail.com (Postfix) with SMTP id 172B3824CA3F for ; Wed, 4 Sep 2019 06:51:46 +0000 (UTC) X-FDA: 75896317812.05.flock68_83a4457826e0e X-Spam-Summary: 2,0,0,e758379b79780ddd,d41d8cd98f00b204,walter-zh.wu@mediatek.com,:aryabinin@virtuozzo.com:glider@google.com:dvyukov@google.com:matthias.bgg@gmail.com:akpm@linux-foundation.org:schwidefsky@de.ibm.com:arnd@arndb.de:kasan-dev@googlegroups.com::linux-kernel@vger.kernel.org:linux-arm-kernel@lists.infradead.org:linux-mediatek@lists.infradead.org:wsd_upstream@mediatek.com:walter-zh.wu@mediatek.com,RULES_HIT:41:355:379:541:800:960:965:966:967:973:988:989:1260:1277:1313:1314:1345:1437:1516:1518:1535:1543:1711:1730:1747:1777:1792:2196:2198:2199:2200:2393:2525:2553:2559:2563:2682:2685:2693:2731:2859:2892:2902:2933:2937:2939:2942:2945:2947:2951:2954:3022:3138:3139:3140:3141:3142:3354:3865:3866:3867:3870:3871:3872:3934:3936:3938:3941:3944:3947:3950:3953:3956:3959:4250:4321:4385:4390:4395:5007:6261:7903:7904:8603:8957:8985:9025:10004:10400:11026:11473:11658:11854:11914:12043:12048:12295:12296:12297:12438:12521:12555:12679:12698:12737:12895:14093:14096:14097:14181:14394:147 21:21080 X-HE-Tag: flock68_83a4457826e0e X-Filterd-Recvd-Size: 5021 Received: from mailgw02.mediatek.com (unknown [210.61.82.184]) by imf50.hostedemail.com (Postfix) with ESMTP for ; Wed, 4 Sep 2019 06:51:44 +0000 (UTC) X-UUID: d6949eddd6d848458f0e91f382beab44-20190904 X-UUID: d6949eddd6d848458f0e91f382beab44-20190904 Received: from mtkexhb02.mediatek.inc [(172.21.101.103)] by mailgw02.mediatek.com (envelope-from ) (Cellopoint E-mail Firewall v4.1.10 Build 0809 with TLS) with ESMTP id 4046662; Wed, 04 Sep 2019 14:51:38 +0800 Received: from mtkcas07.mediatek.inc (172.21.101.84) by mtkmbs08n2.mediatek.inc (172.21.101.56) with Microsoft SMTP Server (TLS) id 15.0.1395.4; Wed, 4 Sep 2019 14:51:35 +0800 Received: from mtksdccf07.mediatek.inc (172.21.84.99) by mtkcas07.mediatek.inc (172.21.101.73) with Microsoft SMTP Server id 15.0.1395.4 via Frontend Transport; Wed, 4 Sep 2019 14:51:35 +0800 From: Walter Wu To: Andrey Ryabinin , Alexander Potapenko , Dmitry Vyukov , Matthias Brugger , Andrew Morton , Martin Schwidefsky , Arnd Bergmann CC: , , , , , , Walter Wu Subject: [PATCH 1/2] mm/kasan: dump alloc/free stack for page allocator Date: Wed, 4 Sep 2019 14:51:33 +0800 Message-ID: <20190904065133.20268-1-walter-zh.wu@mediatek.com> X-Mailer: git-send-email 2.18.0 MIME-Version: 1.0 X-TM-SNTS-SMTP: E693BB34C42D4B73B3B2B12EEB54C8F30BF059021EA46B52BEF177F393CF9F522000:8 X-MTK: N X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: This patch is KASAN report adds the alloc/free stacks for page allocator in order to help programmer to see memory corruption caused by page. By default, KASAN doesn't record alloc/free stack for page allocator. It is difficult to fix up page use-after-free issue. This feature depends on page owner to record the last stack of pages. It is very helpful for solving the page use-after-free or out-of-bound. KASAN report will show the last stack of page, it may be: a) If page is in-use state, then it prints alloc stack. It is useful to fix up page out-of-bound issue. BUG: KASAN: slab-out-of-bounds in kmalloc_pagealloc_oob_right+0x88/0x90 Write of size 1 at addr ffffffc0d64ea00a by task cat/115 ... Allocation stack of page: prep_new_page+0x1a0/0x1d8 get_page_from_freelist+0xd78/0x2748 __alloc_pages_nodemask+0x1d4/0x1978 kmalloc_order+0x28/0x58 kmalloc_order_trace+0x28/0xe0 kmalloc_pagealloc_oob_right+0x2c/0x90 b) If page is freed state, then it prints free stack. It is useful to fix up page use-after-free issue. BUG: KASAN: use-after-free in kmalloc_pagealloc_uaf+0x70/0x80 Write of size 1 at addr ffffffc0d651c000 by task cat/115 ... Free stack of page: kasan_free_pages+0x68/0x70 __free_pages_ok+0x3c0/0x1328 __free_pages+0x50/0x78 kfree+0x1c4/0x250 kmalloc_pagealloc_uaf+0x38/0x80 This has been discussed, please refer below link. https://bugzilla.kernel.org/show_bug.cgi?id=203967 Signed-off-by: Walter Wu --- lib/Kconfig.kasan | 9 +++++++++ mm/kasan/common.c | 6 ++++++ 2 files changed, 15 insertions(+) diff --git a/lib/Kconfig.kasan b/lib/Kconfig.kasan index 4fafba1a923b..ba17f706b5f8 100644 --- a/lib/Kconfig.kasan +++ b/lib/Kconfig.kasan @@ -135,6 +135,15 @@ config KASAN_S390_4_LEVEL_PAGING to 3TB of RAM with KASan enabled). This options allows to force 4-level paging instead. +config KASAN_DUMP_PAGE + bool "Dump the page last stack information" + depends on KASAN && PAGE_OWNER + help + By default, KASAN doesn't record alloc/free stack for page allocator. + It is difficult to fix up page use-after-free issue. + This feature depends on page owner to record the last stack of page. + It is very helpful for solving the page use-after-free or out-of-bound. + config TEST_KASAN tristate "Module for testing KASAN for bug detection" depends on m && KASAN diff --git a/mm/kasan/common.c b/mm/kasan/common.c index 2277b82902d8..2a32474efa74 100644 --- a/mm/kasan/common.c +++ b/mm/kasan/common.c @@ -35,6 +35,7 @@ #include #include #include +#include #include "kasan.h" #include "../slab.h" @@ -227,6 +228,11 @@ void kasan_alloc_pages(struct page *page, unsigned int order) void kasan_free_pages(struct page *page, unsigned int order) { +#ifdef CONFIG_KASAN_DUMP_PAGE + gfp_t gfp_flags = GFP_KERNEL; + + set_page_owner(page, order, gfp_flags); +#endif if (likely(!PageHighMem(page))) kasan_poison_shadow(page_address(page), PAGE_SIZE << order, From patchwork Wed Sep 4 06:57:36 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Walter Wu X-Patchwork-Id: 11129467 Return-Path: Received: from mail.kernel.org (pdx-korg-mail-1.web.codeaurora.org [172.30.200.123]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id 8848513B1 for ; Wed, 4 Sep 2019 06:57:44 +0000 (UTC) Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by mail.kernel.org (Postfix) with ESMTP id 5EA24233A1 for ; Wed, 4 Sep 2019 06:57:44 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org 5EA24233A1 Authentication-Results: mail.kernel.org; dmarc=fail (p=none dis=none) header.from=mediatek.com Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=owner-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix) id 9A7936B0008; Wed, 4 Sep 2019 02:57:43 -0400 (EDT) Delivered-To: linux-mm-outgoing@kvack.org Received: by kanga.kvack.org (Postfix, from userid 40) id 958316B000A; Wed, 4 Sep 2019 02:57:43 -0400 (EDT) X-Original-To: int-list-linux-mm@kvack.org X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 86DF06B000C; Wed, 4 Sep 2019 02:57:43 -0400 (EDT) X-Original-To: linux-mm@kvack.org X-Delivered-To: linux-mm@kvack.org Received: from forelay.hostedemail.com (smtprelay0088.hostedemail.com [216.40.44.88]) by kanga.kvack.org (Postfix) with ESMTP id 670586B0008 for ; Wed, 4 Sep 2019 02:57:43 -0400 (EDT) Received: from smtpin10.hostedemail.com (10.5.19.251.rfc1918.com [10.5.19.251]) by forelay05.hostedemail.com (Postfix) with SMTP id 0851C181AC9BA for ; Wed, 4 Sep 2019 06:57:43 +0000 (UTC) X-FDA: 75896332806.10.smile71_261b59cb4bf0f X-Spam-Summary: 2,0,0,98ae670b43829643,d41d8cd98f00b204,walter-zh.wu@mediatek.com,:aryabinin@virtuozzo.com:glider@google.com:dvyukov@google.com:matthias.bgg@gmail.com:akpm@linux-foundation.org:tglx@linutronix.de:mhocko@suse.com:jpoimboe@redhat.com:gregkh@linuxfoundation.org:linux-kernel@vger.kernel.org:kasan-dev@googlegroups.com::linux-arm-kernel@lists.infradead.org:linux-mediatek@lists.infradead.org:wsd_upstream@mediatek.com:walter-zh.wu@mediatek.com,RULES_HIT:41:355:379:541:800:960:966:973:988:989:1260:1277:1313:1314:1345:1437:1516:1518:1534:1540:1711:1714:1730:1747:1777:1792:2196:2198:2199:2200:2393:2559:2562:2693:2731:3138:3139:3140:3141:3142:3350:3865:3866:3867:3871:4385:5007:6261:10004:10400:11026:11473:11658:11914:12043:12048:12114:12296:12297:12438:12521:12555:12895:13069:13255:13311:13357:14181:14394:14721:21080:21451:21627:30045:30054,0,RBL:210.61.82.184:@mediatek.com:.lbl8.mailshell.net-62.2.12.100 64.100.201.201,CacheIP:none,Bayesian:0.5,0.5,0.5,Netcheck:none,Doma inCache: X-HE-Tag: smile71_261b59cb4bf0f X-Filterd-Recvd-Size: 2873 Received: from mailgw02.mediatek.com (unknown [210.61.82.184]) by imf17.hostedemail.com (Postfix) with ESMTP for ; Wed, 4 Sep 2019 06:57:41 +0000 (UTC) X-UUID: 0f275d29c86d4783ab7c06ab9ad722f7-20190904 X-UUID: 0f275d29c86d4783ab7c06ab9ad722f7-20190904 Received: from mtkcas07.mediatek.inc [(172.21.101.84)] by mailgw02.mediatek.com (envelope-from ) (Cellopoint E-mail Firewall v4.1.10 Build 0809 with TLS) with ESMTP id 879257244; Wed, 04 Sep 2019 14:57:38 +0800 Received: from mtkcas07.mediatek.inc (172.21.101.84) by mtkmbs08n1.mediatek.inc (172.21.101.55) with Microsoft SMTP Server (TLS) id 15.0.1395.4; Wed, 4 Sep 2019 14:57:36 +0800 Received: from mtksdccf07.mediatek.inc (172.21.84.99) by mtkcas07.mediatek.inc (172.21.101.73) with Microsoft SMTP Server id 15.0.1395.4 via Frontend Transport; Wed, 4 Sep 2019 14:57:36 +0800 From: Walter Wu To: Andrey Ryabinin , Alexander Potapenko , Dmitry Vyukov , Matthias Brugger , Andrew Morton , Thomas Gleixner , Michal Hocko , Josh Poimboeuf , Greg Kroah-Hartman CC: , , , , , , Walter Wu Subject: [PATCH 2/2] mm/page_owner: determine the last stack state of page with CONFIG_KASAN_DUMP_PAGE=y Date: Wed, 4 Sep 2019 14:57:36 +0800 Message-ID: <20190904065736.20736-1-walter-zh.wu@mediatek.com> X-Mailer: git-send-email 2.18.0 MIME-Version: 1.0 X-MTK: N X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: When enable CONFIG_KASAN_DUMP_PAGE, then page_owner will record last stack, So we need to know the last stack is allocation or free state. Signed-off-by: Walter Wu --- mm/page_owner.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/mm/page_owner.c b/mm/page_owner.c index addcbb2ae4e4..2756adca250e 100644 --- a/mm/page_owner.c +++ b/mm/page_owner.c @@ -418,6 +418,12 @@ void __dump_page_owner(struct page *page) nr_entries = stack_depot_fetch(handle, &entries); pr_alert("page allocated via order %u, migratetype %s, gfp_mask %#x(%pGg)\n", page_owner->order, migratetype_names[mt], gfp_mask, &gfp_mask); +#ifdef CONFIG_KASAN_DUMP_PAGE + if ((unsigned long)page->flags & PAGE_FLAGS_CHECK_AT_PREP) + pr_info("Allocation stack of page:\n"); + else + pr_info("Free stack of page:\n"); +#endif stack_trace_print(entries, nr_entries, 0); if (page_owner->last_migrate_reason != -1)