From patchwork Tue Jul 11 13:46:24 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Vlastimil Babka X-Patchwork-Id: 13308765 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 8C103C001DD for ; Tue, 11 Jul 2023 13:46:42 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S232226AbjGKNql (ORCPT ); Tue, 11 Jul 2023 09:46:41 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:60152 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S230163AbjGKNqi (ORCPT ); Tue, 11 Jul 2023 09:46:38 -0400 Received: from smtp-out2.suse.de (smtp-out2.suse.de [IPv6:2001:67c:2178:6::1d]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 71D12E6A; Tue, 11 Jul 2023 06:46:36 -0700 (PDT) Received: from imap2.suse-dmz.suse.de (imap2.suse-dmz.suse.de [192.168.254.74]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-521) server-digest SHA512) (No client certificate requested) by smtp-out2.suse.de (Postfix) with ESMTPS id 0FF911FDA0; Tue, 11 Jul 2023 13:46:35 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=suse.cz; s=susede2_rsa; t=1689083195; h=from:from:reply-to:date:date:message-id:message-id:to:to:cc:cc: mime-version:mime-version: content-transfer-encoding:content-transfer-encoding; bh=RXHIYdVmdQJX5tnkNjy37yeBssRnaU5MoOmNGkfF484=; b=DVO93ktxjFk3VzkffNtwh1rU0QfweANLsy9oVYvFPGIeNVcpRdrrIpFNYcej2rYKY7sNDM bKjN4dQau8CtiYI7D6FON8xDb/M5h8wTke2ei4xM5jMAt+o+bwDX12JNsoetppguRUTmiI 3TOWlE4qXwwHHyr5h/3JYzS4DmEamL4= DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/relaxed; d=suse.cz; s=susede2_ed25519; t=1689083195; h=from:from:reply-to:date:date:message-id:message-id:to:to:cc:cc: mime-version:mime-version: content-transfer-encoding:content-transfer-encoding; bh=RXHIYdVmdQJX5tnkNjy37yeBssRnaU5MoOmNGkfF484=; b=EJTlIqxlmAlFa+9Nk7qpsjsA6kWKHmE0gNx/pb6blh/Evb+jPLWa82Nz2lgRY5oF1+D5vB AEpWeIfOau7q79BA== Received: from imap2.suse-dmz.suse.de (imap2.suse-dmz.suse.de [192.168.254.74]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-521) server-digest SHA512) (No client certificate requested) by imap2.suse-dmz.suse.de (Postfix) with ESMTPS id C1D2D1390F; Tue, 11 Jul 2023 13:46:34 +0000 (UTC) Received: from dovecot-director2.suse.de ([192.168.254.65]) by imap2.suse-dmz.suse.de with ESMTPSA id NXqMLjpdrWTSYwAAMHmgww (envelope-from ); Tue, 11 Jul 2023 13:46:34 +0000 From: Vlastimil Babka To: Christoph Lameter , David Rientjes , Pekka Enberg , Joonsoo Kim Cc: Hyeonggon Yoo <42.hyeyoo@gmail.com>, Roman Gushchin , linux-mm@kvack.org, patches@lists.linux.dev, linux-kernel@vger.kernel.org, Matteo Rizzo , Jann Horn , Andrey Konovalov , Marco Elver , Alexander Potapenko , kasan-dev@googlegroups.com, Kees Cook , linux-hardening@vger.kernel.org, Vlastimil Babka Subject: [PATCH 1/2] mm/slub: remove redundant kasan_reset_tag() from freelist_ptr calculations Date: Tue, 11 Jul 2023 15:46:24 +0200 Message-ID: <20230711134623.12695-3-vbabka@suse.cz> X-Mailer: git-send-email 2.41.0 MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: linux-hardening@vger.kernel.org Commit d36a63a943e3 ("kasan, slub: fix more conflicts with CONFIG_SLAB_FREELIST_HARDENED") has introduced kasan_reset_tags() to freelist_ptr() encoding/decoding when CONFIG_SLAB_FREELIST_HARDENED is enabled to resolve issues when passing tagged or untagged pointers inconsistently would lead to incorrect calculations. Later, commit aa1ef4d7b3f6 ("kasan, mm: reset tags when accessing metadata") made sure all pointers have tags reset regardless of CONFIG_SLAB_FREELIST_HARDENED, because there was no other way to access the freepointer metadata safely with hw tag-based KASAN. Therefore the kasan_reset_tag() usage in freelist_ptr_encode()/decode() is now redundant, as all callers use kasan_reset_tag() unconditionally when constructing ptr_addr. Remove the redundant calls and simplify the code and remove obsolete comments. Also in freelist_ptr_encode() introduce an 'encoded' variable to make the lines shorter and make it similar to the _decode() one. Signed-off-by: Vlastimil Babka Acked-by: Kees Cook Reviewed-by: Andrey Konovalov --- These 2 patches build on top of: https://lore.kernel.org/all/20230704135834.3884421-1-matteorizzo@google.com/ mm/slub.c | 22 ++++++---------------- 1 file changed, 6 insertions(+), 16 deletions(-) diff --git a/mm/slub.c b/mm/slub.c index f8cc47eff742..07edad305512 100644 --- a/mm/slub.c +++ b/mm/slub.c @@ -374,22 +374,14 @@ typedef struct { unsigned long v; } freeptr_t; static inline freeptr_t freelist_ptr_encode(const struct kmem_cache *s, void *ptr, unsigned long ptr_addr) { + unsigned long encoded; + #ifdef CONFIG_SLAB_FREELIST_HARDENED - /* - * When CONFIG_KASAN_SW/HW_TAGS is enabled, ptr_addr might be tagged. - * Normally, this doesn't cause any issues, as both set_freepointer() - * and get_freepointer() are called with a pointer with the same tag. - * However, there are some issues with CONFIG_SLUB_DEBUG code. For - * example, when __free_slub() iterates over objects in a cache, it - * passes untagged pointers to check_object(). check_object() in turns - * calls get_freepointer() with an untagged pointer, which causes the - * freepointer to be restored incorrectly. - */ - return (freeptr_t){.v = (unsigned long)ptr ^ s->random ^ - swab((unsigned long)kasan_reset_tag((void *)ptr_addr))}; + encoded = (unsigned long)ptr ^ s->random ^ swab(ptr_addr); #else - return (freeptr_t){.v = (unsigned long)ptr}; + encoded = (unsigned long)ptr; #endif + return (freeptr_t){.v = encoded}; } static inline void *freelist_ptr_decode(const struct kmem_cache *s, @@ -398,9 +390,7 @@ static inline void *freelist_ptr_decode(const struct kmem_cache *s, void *decoded; #ifdef CONFIG_SLAB_FREELIST_HARDENED - /* See the comment in freelist_ptr_encode */ - decoded = (void *)(ptr.v ^ s->random ^ - swab((unsigned long)kasan_reset_tag((void *)ptr_addr))); + decoded = (void *)(ptr.v ^ s->random ^ swab(ptr_addr)); #else decoded = (void *)ptr.v; #endif From patchwork Tue Jul 11 13:46:25 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Vlastimil Babka X-Patchwork-Id: 13308764 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 7F696C0015E for ; Tue, 11 Jul 2023 13:46:43 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S230021AbjGKNqm (ORCPT ); Tue, 11 Jul 2023 09:46:42 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:60164 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S232487AbjGKNqj (ORCPT ); Tue, 11 Jul 2023 09:46:39 -0400 Received: from smtp-out1.suse.de (smtp-out1.suse.de [IPv6:2001:67c:2178:6::1c]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id A8C6610C7; Tue, 11 Jul 2023 06:46:36 -0700 (PDT) Received: from imap2.suse-dmz.suse.de (imap2.suse-dmz.suse.de [192.168.254.74]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-521) server-digest SHA512) (No client certificate requested) by smtp-out1.suse.de (Postfix) with ESMTPS id 4C55622194; Tue, 11 Jul 2023 13:46:35 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=suse.cz; s=susede2_rsa; t=1689083195; h=from:from:reply-to:date:date:message-id:message-id:to:to:cc:cc: mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=tmUBux5e1ki7qsINZJpfH2z48bDyzUotuR1CpySUCaQ=; b=acou4bQDVy0hM/ezQGCbnhuyyCV9OLbnLgbSiZoPMwqDjzfAzSHDOEQJjm6aYd3JfDHlVj r0Fjy37Mqysf4/J2PoT1S7cvQ9QWZfg748Z2/30rFo/RHgBkBJZci40fZkmnVpjUCqi2ny KmklcGac+XrfSY+ck1hbZkSPX3VBgyY= DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/relaxed; d=suse.cz; s=susede2_ed25519; t=1689083195; h=from:from:reply-to:date:date:message-id:message-id:to:to:cc:cc: mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=tmUBux5e1ki7qsINZJpfH2z48bDyzUotuR1CpySUCaQ=; b=Zi00M2H/+Fsp5apSaRxx6+D9RGOqEN/LSG9K6C5JqftooNT+gO4g1U1LZpCEJeqiKToo7C UbXejMpQOCshQ7Cw== Received: from imap2.suse-dmz.suse.de (imap2.suse-dmz.suse.de [192.168.254.74]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-521) server-digest SHA512) (No client certificate requested) by imap2.suse-dmz.suse.de (Postfix) with ESMTPS id 10FBB13A63; Tue, 11 Jul 2023 13:46:35 +0000 (UTC) Received: from dovecot-director2.suse.de ([192.168.254.65]) by imap2.suse-dmz.suse.de with ESMTPSA id iPqDAztdrWTSYwAAMHmgww (envelope-from ); Tue, 11 Jul 2023 13:46:35 +0000 From: Vlastimil Babka To: Christoph Lameter , David Rientjes , Pekka Enberg , Joonsoo Kim Cc: Hyeonggon Yoo <42.hyeyoo@gmail.com>, Roman Gushchin , linux-mm@kvack.org, patches@lists.linux.dev, linux-kernel@vger.kernel.org, Matteo Rizzo , Jann Horn , Andrey Konovalov , Marco Elver , Alexander Potapenko , kasan-dev@googlegroups.com, Kees Cook , linux-hardening@vger.kernel.org, Vlastimil Babka Subject: [PATCH 2/2] mm/slub: remove freelist_dereference() Date: Tue, 11 Jul 2023 15:46:25 +0200 Message-ID: <20230711134623.12695-4-vbabka@suse.cz> X-Mailer: git-send-email 2.41.0 In-Reply-To: <20230711134623.12695-3-vbabka@suse.cz> References: <20230711134623.12695-3-vbabka@suse.cz> MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: linux-hardening@vger.kernel.org freelist_dereference() is a one-liner only used from get_freepointer(). Remove it and make get_freepointer() call freelist_ptr_decode() directly to make the code easier to follow. Signed-off-by: Vlastimil Babka Acked-by: Kees Cook --- mm/slub.c | 16 ++++++---------- 1 file changed, 6 insertions(+), 10 deletions(-) diff --git a/mm/slub.c b/mm/slub.c index 07edad305512..c4556a5dab4b 100644 --- a/mm/slub.c +++ b/mm/slub.c @@ -397,18 +397,14 @@ static inline void *freelist_ptr_decode(const struct kmem_cache *s, return decoded; } -/* Returns the freelist pointer recorded at location ptr_addr. */ -static inline void *freelist_dereference(const struct kmem_cache *s, - void *ptr_addr) -{ - return freelist_ptr_decode(s, *(freeptr_t *)(ptr_addr), - (unsigned long)ptr_addr); -} - static inline void *get_freepointer(struct kmem_cache *s, void *object) { - object = kasan_reset_tag(object); - return freelist_dereference(s, (freeptr_t *)(object + s->offset)); + unsigned long ptr_addr; + freeptr_t p; + + ptr_addr = ((unsigned long)kasan_reset_tag(object)) + s->offset; + p = *(freeptr_t *)(ptr_addr); + return freelist_ptr_decode(s, p, ptr_addr); } #ifndef CONFIG_SLUB_TINY