From patchwork Wed Sep 4 06:51:33 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Walter Wu X-Patchwork-Id: 11129461 Return-Path: Received: from mail.kernel.org (pdx-korg-mail-1.web.codeaurora.org [172.30.200.123]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id 553361398 for ; Wed, 4 Sep 2019 06:52:15 +0000 (UTC) Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.133]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPS id 32D0022CED for ; Wed, 4 Sep 2019 06:52:15 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=pass (2048-bit key) header.d=lists.infradead.org header.i=@lists.infradead.org header.b="Lv5Jq3nd" DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org 32D0022CED Authentication-Results: mail.kernel.org; dmarc=fail (p=none dis=none) header.from=mediatek.com Authentication-Results: mail.kernel.org; spf=none smtp.mailfrom=linux-arm-kernel-bounces+patchwork-linux-arm=patchwork.kernel.org@lists.infradead.org DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20170209; h=Sender: Content-Transfer-Encoding:Content-Type:Cc:List-Subscribe:List-Help:List-Post: List-Archive:List-Unsubscribe:List-Id:MIME-Version:Message-ID:Date:Subject:To :From:Reply-To:Content-ID:Content-Description:Resent-Date:Resent-From: Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:In-Reply-To:References: List-Owner; bh=NrIzX4LYTOzuYvot4jX2ZzHkneY41xGpOFg852YP6rc=; b=Lv5Jq3ndvaH1UB Hy5YEqL3ZWUcM7w2fFcL2qI0F8v0iFM0cal5j3HL9e9VeZ66ahNiFjxiUNaOW0pbvg2+8EXx50+E0 vQVk0g1ihY0wwDSEUtymzNr2hOBP3YHDrJga/V2Kl0uiotkYqOWeFwEwv/ZCSjMlYYc1VGEbUWpmV CDxxzfQH7ALT2iszP/S3KjhOxmXMeUZK9OPtb74nLE0zy8KDrTfQbYzzCtj8HcH061Hvg30VIcMHE AZMo44j6hXIh/GL4bhftE37UbhGEvuCcj7XZPekqIZY8E5ANDShi4lnj98Q5gwnx1LMjG/h3Q47CN fXeYj1psAmjihvTd2tTg==; Received: from localhost ([127.0.0.1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.92 #3 (Red Hat Linux)) id 1i5P96-0006Bv-Vg; Wed, 04 Sep 2019 06:52:01 +0000 Received: from mailgw02.mediatek.com ([216.200.240.185]) by bombadil.infradead.org with esmtps (Exim 4.92 #3 (Red Hat Linux)) id 1i5P8y-0006Ae-LS; Wed, 04 Sep 2019 06:51:55 +0000 X-UUID: ff165684df6f43eb881b4630506eac6c-20190903 X-UUID: ff165684df6f43eb881b4630506eac6c-20190903 Received: from mtkcas66.mediatek.inc [(172.29.193.44)] by mailgw02.mediatek.com (envelope-from ) (musrelay.mediatek.com ESMTP with TLS) with ESMTP id 1057701984; Tue, 03 Sep 2019 22:51:45 -0800 Received: from mtkmbs08n2.mediatek.inc (172.21.101.56) by MTKMBS62DR.mediatek.inc (172.29.94.18) with Microsoft SMTP Server (TLS) id 15.0.1395.4; Tue, 3 Sep 2019 23:51:43 -0700 Received: from mtkcas07.mediatek.inc (172.21.101.84) by mtkmbs08n2.mediatek.inc (172.21.101.56) with Microsoft SMTP Server (TLS) id 15.0.1395.4; Wed, 4 Sep 2019 14:51:35 +0800 Received: from mtksdccf07.mediatek.inc (172.21.84.99) by mtkcas07.mediatek.inc (172.21.101.73) with Microsoft SMTP Server id 15.0.1395.4 via Frontend Transport; Wed, 4 Sep 2019 14:51:35 +0800 From: Walter Wu To: Andrey Ryabinin , Alexander Potapenko , Dmitry Vyukov , Matthias Brugger , Andrew Morton , "Martin Schwidefsky" , Arnd Bergmann Subject: [PATCH 1/2] mm/kasan: dump alloc/free stack for page allocator Date: Wed, 4 Sep 2019 14:51:33 +0800 Message-ID: <20190904065133.20268-1-walter-zh.wu@mediatek.com> X-Mailer: git-send-email 2.18.0 MIME-Version: 1.0 X-TM-SNTS-SMTP: E693BB34C42D4B73B3B2B12EEB54C8F30BF059021EA46B52BEF177F393CF9F522000:8 X-MTK: N X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20190903_235152_712226_79F39E7E X-CRM114-Status: GOOD ( 10.72 ) X-Spam-Score: 0.0 (/) X-Spam-Report: SpamAssassin version 3.4.2 on bombadil.infradead.org summary: Content analysis details: (0.0 points) pts rule name description ---- ---------------------- -------------------------------------------------- 0.0 SPF_HELO_NONE SPF: HELO does not publish an SPF Record -0.0 SPF_PASS SPF: sender matches SPF record 0.0 UNPARSEABLE_RELAY Informational: message has unparseable relay lines X-BeenThere: linux-arm-kernel@lists.infradead.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Walter Wu , wsd_upstream@mediatek.com, linux-kernel@vger.kernel.org, kasan-dev@googlegroups.com, linux-mm@kvack.org, linux-mediatek@lists.infradead.org, linux-arm-kernel@lists.infradead.org Sender: "linux-arm-kernel" Errors-To: linux-arm-kernel-bounces+patchwork-linux-arm=patchwork.kernel.org@lists.infradead.org This patch is KASAN report adds the alloc/free stacks for page allocator in order to help programmer to see memory corruption caused by page. By default, KASAN doesn't record alloc/free stack for page allocator. It is difficult to fix up page use-after-free issue. This feature depends on page owner to record the last stack of pages. It is very helpful for solving the page use-after-free or out-of-bound. KASAN report will show the last stack of page, it may be: a) If page is in-use state, then it prints alloc stack. It is useful to fix up page out-of-bound issue. BUG: KASAN: slab-out-of-bounds in kmalloc_pagealloc_oob_right+0x88/0x90 Write of size 1 at addr ffffffc0d64ea00a by task cat/115 ... Allocation stack of page: prep_new_page+0x1a0/0x1d8 get_page_from_freelist+0xd78/0x2748 __alloc_pages_nodemask+0x1d4/0x1978 kmalloc_order+0x28/0x58 kmalloc_order_trace+0x28/0xe0 kmalloc_pagealloc_oob_right+0x2c/0x90 b) If page is freed state, then it prints free stack. It is useful to fix up page use-after-free issue. BUG: KASAN: use-after-free in kmalloc_pagealloc_uaf+0x70/0x80 Write of size 1 at addr ffffffc0d651c000 by task cat/115 ... Free stack of page: kasan_free_pages+0x68/0x70 __free_pages_ok+0x3c0/0x1328 __free_pages+0x50/0x78 kfree+0x1c4/0x250 kmalloc_pagealloc_uaf+0x38/0x80 This has been discussed, please refer below link. https://bugzilla.kernel.org/show_bug.cgi?id=203967 Signed-off-by: Walter Wu --- lib/Kconfig.kasan | 9 +++++++++ mm/kasan/common.c | 6 ++++++ 2 files changed, 15 insertions(+) diff --git a/lib/Kconfig.kasan b/lib/Kconfig.kasan index 4fafba1a923b..ba17f706b5f8 100644 --- a/lib/Kconfig.kasan +++ b/lib/Kconfig.kasan @@ -135,6 +135,15 @@ config KASAN_S390_4_LEVEL_PAGING to 3TB of RAM with KASan enabled). This options allows to force 4-level paging instead. +config KASAN_DUMP_PAGE + bool "Dump the page last stack information" + depends on KASAN && PAGE_OWNER + help + By default, KASAN doesn't record alloc/free stack for page allocator. + It is difficult to fix up page use-after-free issue. + This feature depends on page owner to record the last stack of page. + It is very helpful for solving the page use-after-free or out-of-bound. + config TEST_KASAN tristate "Module for testing KASAN for bug detection" depends on m && KASAN diff --git a/mm/kasan/common.c b/mm/kasan/common.c index 2277b82902d8..2a32474efa74 100644 --- a/mm/kasan/common.c +++ b/mm/kasan/common.c @@ -35,6 +35,7 @@ #include #include #include +#include #include "kasan.h" #include "../slab.h" @@ -227,6 +228,11 @@ void kasan_alloc_pages(struct page *page, unsigned int order) void kasan_free_pages(struct page *page, unsigned int order) { +#ifdef CONFIG_KASAN_DUMP_PAGE + gfp_t gfp_flags = GFP_KERNEL; + + set_page_owner(page, order, gfp_flags); +#endif if (likely(!PageHighMem(page))) kasan_poison_shadow(page_address(page), PAGE_SIZE << order, From patchwork Wed Sep 4 06:57:36 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Walter Wu X-Patchwork-Id: 11129471 Return-Path: Received: from mail.kernel.org (pdx-korg-mail-1.web.codeaurora.org [172.30.200.123]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id C91591398 for ; Wed, 4 Sep 2019 06:57:51 +0000 (UTC) Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.133]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPS id A677C22CED for ; Wed, 4 Sep 2019 06:57:51 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=pass (2048-bit key) header.d=lists.infradead.org header.i=@lists.infradead.org header.b="GrxGR1z5" DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org A677C22CED Authentication-Results: mail.kernel.org; dmarc=fail (p=none dis=none) header.from=mediatek.com Authentication-Results: mail.kernel.org; spf=none smtp.mailfrom=linux-arm-kernel-bounces+patchwork-linux-arm=patchwork.kernel.org@lists.infradead.org DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20170209; h=Sender: Content-Transfer-Encoding:Content-Type:Cc:List-Subscribe:List-Help:List-Post: List-Archive:List-Unsubscribe:List-Id:MIME-Version:Message-ID:Date:Subject:To :From:Reply-To:Content-ID:Content-Description:Resent-Date:Resent-From: Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:In-Reply-To:References: List-Owner; bh=/BLAieP6SbKsfZGyVE21D/GTrM9YgA5cXvz7K0ejbbk=; b=GrxGR1z53fbu6y lZdkC0P4qHobm52WYfOe6Uhxro/J3fmFpekx11524pK3NH/MsjfGDYiC6fPzagMpi7Us1qC2KvUOi 3K3kynJEJzvWSdXeJP3OClJhzQ7B5GHDc3CX0hG4v8AEJZWGinUPcbUtmGum/15DfS3vjJYurhjd6 cOh/x7AuvDy+wfS9YqhDY8RsYWr4ymStx7Wr8uH7XZlnM2MqH0qW7uxHWIWlTxDNzGX5REnhINxJ2 6+wbTFMw8oYY9TjNdpZM2sRlDjQm5lhWKBmBNU5Zw2gJl+gTjy5LiAuzSL/64Im8dJDhb/bE9nQEA zMDc8JHopyzFLsK3hO4g==; Received: from localhost ([127.0.0.1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.92 #3 (Red Hat Linux)) id 1i5PEh-0008N2-MV; Wed, 04 Sep 2019 06:57:47 +0000 Received: from mailgw02.mediatek.com ([216.200.240.185]) by bombadil.infradead.org with esmtps (Exim 4.92 #3 (Red Hat Linux)) id 1i5PEd-0008Lc-Mq; Wed, 04 Sep 2019 06:57:44 +0000 X-UUID: 93fe7781352746ed99b6afc9713f20b3-20190903 X-UUID: 93fe7781352746ed99b6afc9713f20b3-20190903 Received: from mtkcas67.mediatek.inc [(172.29.193.45)] by mailgw02.mediatek.com (envelope-from ) (musrelay.mediatek.com ESMTP with TLS) with ESMTP id 269693652; Tue, 03 Sep 2019 22:57:39 -0800 Received: from mtkmbs08n1.mediatek.inc (172.21.101.55) by MTKMBS62N1.mediatek.inc (172.29.193.41) with Microsoft SMTP Server (TLS) id 15.0.1395.4; Tue, 3 Sep 2019 23:57:38 -0700 Received: from mtkcas07.mediatek.inc (172.21.101.84) by mtkmbs08n1.mediatek.inc (172.21.101.55) with Microsoft SMTP Server (TLS) id 15.0.1395.4; Wed, 4 Sep 2019 14:57:36 +0800 Received: from mtksdccf07.mediatek.inc (172.21.84.99) by mtkcas07.mediatek.inc (172.21.101.73) with Microsoft SMTP Server id 15.0.1395.4 via Frontend Transport; Wed, 4 Sep 2019 14:57:36 +0800 From: Walter Wu To: Andrey Ryabinin , Alexander Potapenko , Dmitry Vyukov , Matthias Brugger , Andrew Morton , "Thomas Gleixner" , Michal Hocko , Josh Poimboeuf , Greg Kroah-Hartman Subject: [PATCH 2/2] mm/page_owner: determine the last stack state of page with CONFIG_KASAN_DUMP_PAGE=y Date: Wed, 4 Sep 2019 14:57:36 +0800 Message-ID: <20190904065736.20736-1-walter-zh.wu@mediatek.com> X-Mailer: git-send-email 2.18.0 MIME-Version: 1.0 X-MTK: N X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20190903_235743_764313_99940735 X-CRM114-Status: UNSURE ( 7.33 ) X-CRM114-Notice: Please train this message. X-Spam-Score: 0.0 (/) X-Spam-Report: SpamAssassin version 3.4.2 on bombadil.infradead.org summary: Content analysis details: (0.0 points) pts rule name description ---- ---------------------- -------------------------------------------------- 0.0 SPF_HELO_NONE SPF: HELO does not publish an SPF Record -0.0 SPF_PASS SPF: sender matches SPF record 0.0 UNPARSEABLE_RELAY Informational: message has unparseable relay lines X-BeenThere: linux-arm-kernel@lists.infradead.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Walter Wu , wsd_upstream@mediatek.com, linux-kernel@vger.kernel.org, kasan-dev@googlegroups.com, linux-mm@kvack.org, linux-mediatek@lists.infradead.org, linux-arm-kernel@lists.infradead.org Sender: "linux-arm-kernel" Errors-To: linux-arm-kernel-bounces+patchwork-linux-arm=patchwork.kernel.org@lists.infradead.org When enable CONFIG_KASAN_DUMP_PAGE, then page_owner will record last stack, So we need to know the last stack is allocation or free state. Signed-off-by: Walter Wu --- mm/page_owner.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/mm/page_owner.c b/mm/page_owner.c index addcbb2ae4e4..2756adca250e 100644 --- a/mm/page_owner.c +++ b/mm/page_owner.c @@ -418,6 +418,12 @@ void __dump_page_owner(struct page *page) nr_entries = stack_depot_fetch(handle, &entries); pr_alert("page allocated via order %u, migratetype %s, gfp_mask %#x(%pGg)\n", page_owner->order, migratetype_names[mt], gfp_mask, &gfp_mask); +#ifdef CONFIG_KASAN_DUMP_PAGE + if ((unsigned long)page->flags & PAGE_FLAGS_CHECK_AT_PREP) + pr_info("Allocation stack of page:\n"); + else + pr_info("Free stack of page:\n"); +#endif stack_trace_print(entries, nr_entries, 0); if (page_owner->last_migrate_reason != -1)