From patchwork Tue Dec 19 22:28:45 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: andrey.konovalov@linux.dev X-Patchwork-Id: 13499295 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id 6ECD3C46CCD for ; Tue, 19 Dec 2023 22:29:17 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id D4DFF8D0001; Tue, 19 Dec 2023 17:29:16 -0500 (EST) Received: by kanga.kvack.org (Postfix, from userid 40) id CFE986B0096; Tue, 19 Dec 2023 17:29:16 -0500 (EST) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id BC5328D0001; Tue, 19 Dec 2023 17:29:16 -0500 (EST) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0015.hostedemail.com [216.40.44.15]) by kanga.kvack.org (Postfix) with ESMTP id A50466B0095 for ; Tue, 19 Dec 2023 17:29:16 -0500 (EST) Received: from smtpin14.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay01.hostedemail.com (Postfix) with ESMTP id 6554F1C108C for ; Tue, 19 Dec 2023 22:29:16 +0000 (UTC) X-FDA: 81585009912.14.8409FBC Received: from out-183.mta1.migadu.com (out-183.mta1.migadu.com [95.215.58.183]) by imf30.hostedemail.com (Postfix) with ESMTP id EC09D80022 for ; Tue, 19 Dec 2023 22:29:13 +0000 (UTC) Authentication-Results: imf30.hostedemail.com; dkim=pass header.d=linux.dev header.s=key1 header.b=qtqOsejh; dmarc=pass (policy=none) header.from=linux.dev; spf=pass (imf30.hostedemail.com: domain of andrey.konovalov@linux.dev designates 95.215.58.183 as permitted sender) smtp.mailfrom=andrey.konovalov@linux.dev ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1703024954; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references:dkim-signature; bh=65Nj55va0LyidH/qJFPAhjUaSN3kZxL0lL8iCsNvyX4=; b=iilQsaLTz6EHwb1w0gTbbuUO98W0UIBQ1uG9N3FOT28ZVUC9V+WFwjjiEvdGWgKx0HVDtM Slw65Eux6qZiJupK63LQTrDSM1ueVQsEO+bU8QViPIN4cg5ygZnlP0aC+gqzjxpWLeVExE Lo3rC816p7/cJCWDZ6xqMuryuigXM0g= ARC-Authentication-Results: i=1; imf30.hostedemail.com; dkim=pass header.d=linux.dev header.s=key1 header.b=qtqOsejh; dmarc=pass (policy=none) header.from=linux.dev; spf=pass (imf30.hostedemail.com: domain of andrey.konovalov@linux.dev designates 95.215.58.183 as permitted sender) smtp.mailfrom=andrey.konovalov@linux.dev ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1703024954; a=rsa-sha256; cv=none; b=8nsozKxQw2xfY/aZ8+J1s2tbE59Gh18FF3qjH5xdawWeEupu2fPKYuowo9pKksQbL7lkIa Vp5f25L0k3DGFlTT2HqgGJIp+Hj0WFnqAU36Z/dcKIGsTnx1mQJll2loq03FJP+agR9PV/ Pb9aB7NTS4BKdoDCDGDXukvxIF/hfdc= X-Report-Abuse: Please report any abuse attempt to abuse@migadu.com and include these headers. DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linux.dev; s=key1; t=1703024952; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=65Nj55va0LyidH/qJFPAhjUaSN3kZxL0lL8iCsNvyX4=; b=qtqOsejhFRAQXz/SAXNo9IB1G73IEgw3a9jUz4FGb8dWQiMSemlTQ9pIavZ+Zr7zX4kUJ8 0olVIm0l45jMoaa0ZeX7DsQotFdRhNCybCgNQh0s4gGlUfcs17lifVGwAZhMGf9p4P7gCO LcI0++R63ENC8BHKVFsfmjkGqnOvA4Y= From: andrey.konovalov@linux.dev To: Marco Elver , Alexander Potapenko Cc: Andrey Konovalov , Dmitry Vyukov , Andrey Ryabinin , kasan-dev@googlegroups.com, Evgenii Stepanov , Breno Leitao , Alexander Lobakin , Andrew Morton , linux-mm@kvack.org, linux-kernel@vger.kernel.org, Andrey Konovalov Subject: [PATCH mm 01/21] kasan: rename kasan_slab_free_mempool to kasan_mempool_poison_object Date: Tue, 19 Dec 2023 23:28:45 +0100 Message-Id: In-Reply-To: References: MIME-Version: 1.0 X-Migadu-Flow: FLOW_OUT X-Rspam-User: X-Rspamd-Server: rspam12 X-Rspamd-Queue-Id: EC09D80022 X-Stat-Signature: wfakeeuasrea4i7zsfhk7gmzrwoqn3w4 X-HE-Tag: 1703024953-257281 X-HE-Meta: U2FsdGVkX1+dyQON7DwrJcbkpLr2jWF/MIAKQd+VvZ8JdISnkmrdxlY44mBtjZR/JdPx1d/7vDWW5K1aijVQhKmLPgk+tWt92fPlfXjxAYPwV8SUciIbZTvrAnfxQ6xC2QBoUL7yBKA6n0xHsA3LQhT5UAEFFY8McJpra2hWHteNN0J/IP4RKGLpwis5h7hUnhl2e8dS7IETW5oyOhaPvFs3AST06gdn46GFJvoMrGO3x60MRHGdMLsGtvk3weSVCJrZO1LKgAG7NKzEmIyQOZ26hnfxLtE3qGNJP/tSRy6uc5WROxQhp7IMb+EXXh4Mbo3R+YvE7kytL2qBVRwJhH4W+420fDiu7SGsxogjtt/zpKyuBl2DXZOvPZFw5gm6oF8H/wWy7rdiA+AHkNH34cuQRQSpxFu9Mo95SbT1nHHWtsYwg18BiIAC9XESPDAw9Fjmlia7R7Lq5H8azr0nEmuW0KdVNGj7eqoXD+5fB6xYsqCB+qZHP6NnuUW5KiPaiMOIU4buVvey2sN9YitcuRhpEmHb08b2JEsOKOZkWM9d7DQgfguFRobxh235xia9lwAxHEjDmOYIQAy95s4k1LW3icHNDl7HxcI6F0vb/F+x3SKFUieh61m6HMQJoPhSYXWGgi9DkPxUKCoBmnbiFspRMVsNjcAw/XEdIGXIhz//lzX2bPfBeTXJDRHxlmajO8Y9dr39BqwZJyqyXVKOY6N8P/BnGD43v9I98dygtobDFdL8WwXbAdAMAyUcJz9uUGb/bYDnBls/gU3XmpLa+Jl4E1ObZ+y9R5olo72DKKFcgfMjxzVfLdAbc01fBYTGpk+FluxOj1HRACIjKimXnNJYbdULSZxD+r78n0vmsQGB2cFmL5TiUcNBdQUC0UjCMpYMhB791+x/UuApWuiFoL9MFnnUDK5M2yuoYsrznj8k8d8Jf2OwTDqSJlBPeL3yawOw8Ic4lHckUMuXGh3 9xFlbQQJ hNXoxXc4S+RyLXVdt5bT0YucDOA81Ag9jB0tr0TeSce2uL/zS/Zv75nGFwhKHzRR3lRDtqLX7lrz/b6Ybahv1PeP63bOfKIHcjl7E2bk1RTC0rt1ldrmrkffXuFzplAznZetSd3s1vLLWIo0V1AqfuWCO7C8/bgOCZn6lyoRC+KKoT4sutYAIrZSoWpBnsnETmehi3L1iRNqjw9l87piHOia4EA== X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: List-Subscribe: List-Unsubscribe: From: Andrey Konovalov Rename kasan_slab_free_mempool to kasan_mempool_poison_object. kasan_slab_free_mempool is a slightly confusing name: it is unclear whether this function poisons the object when it is freed into mempool or does something when the object is freed from mempool to the underlying allocator. The new name also aligns with other mempool-related KASAN hooks added in the following patches in this series. Signed-off-by: Andrey Konovalov --- include/linux/kasan.h | 8 ++++---- io_uring/alloc_cache.h | 3 +-- mm/kasan/common.c | 4 ++-- mm/mempool.c | 2 +- 4 files changed, 8 insertions(+), 9 deletions(-) diff --git a/include/linux/kasan.h b/include/linux/kasan.h index 72cb693b075b..6310435f528b 100644 --- a/include/linux/kasan.h +++ b/include/linux/kasan.h @@ -172,11 +172,11 @@ static __always_inline void kasan_kfree_large(void *ptr) __kasan_kfree_large(ptr, _RET_IP_); } -void __kasan_slab_free_mempool(void *ptr, unsigned long ip); -static __always_inline void kasan_slab_free_mempool(void *ptr) +void __kasan_mempool_poison_object(void *ptr, unsigned long ip); +static __always_inline void kasan_mempool_poison_object(void *ptr) { if (kasan_enabled()) - __kasan_slab_free_mempool(ptr, _RET_IP_); + __kasan_mempool_poison_object(ptr, _RET_IP_); } void * __must_check __kasan_slab_alloc(struct kmem_cache *s, @@ -256,7 +256,7 @@ static inline bool kasan_slab_free(struct kmem_cache *s, void *object, bool init return false; } static inline void kasan_kfree_large(void *ptr) {} -static inline void kasan_slab_free_mempool(void *ptr) {} +static inline void kasan_mempool_poison_object(void *ptr) {} static inline void *kasan_slab_alloc(struct kmem_cache *s, void *object, gfp_t flags, bool init) { diff --git a/io_uring/alloc_cache.h b/io_uring/alloc_cache.h index 241245cb54a6..8de0414e8efe 100644 --- a/io_uring/alloc_cache.h +++ b/io_uring/alloc_cache.h @@ -16,8 +16,7 @@ static inline bool io_alloc_cache_put(struct io_alloc_cache *cache, if (cache->nr_cached < cache->max_cached) { cache->nr_cached++; wq_stack_add_head(&entry->node, &cache->list); - /* KASAN poisons object */ - kasan_slab_free_mempool(entry); + kasan_mempool_poison_object(entry); return true; } return false; diff --git a/mm/kasan/common.c b/mm/kasan/common.c index fe6c4b43ad9f..e0394d0ee7f1 100644 --- a/mm/kasan/common.c +++ b/mm/kasan/common.c @@ -271,7 +271,7 @@ static inline bool ____kasan_kfree_large(void *ptr, unsigned long ip) /* * The object will be poisoned by kasan_poison_pages() or - * kasan_slab_free_mempool(). + * kasan_mempool_poison_object(). */ return false; @@ -282,7 +282,7 @@ void __kasan_kfree_large(void *ptr, unsigned long ip) ____kasan_kfree_large(ptr, ip); } -void __kasan_slab_free_mempool(void *ptr, unsigned long ip) +void __kasan_mempool_poison_object(void *ptr, unsigned long ip) { struct folio *folio; diff --git a/mm/mempool.c b/mm/mempool.c index b3d2084fd989..7e1c729f292b 100644 --- a/mm/mempool.c +++ b/mm/mempool.c @@ -107,7 +107,7 @@ static inline void poison_element(mempool_t *pool, void *element) static __always_inline void kasan_poison_element(mempool_t *pool, void *element) { if (pool->alloc == mempool_alloc_slab || pool->alloc == mempool_kmalloc) - kasan_slab_free_mempool(element); + kasan_mempool_poison_object(element); else if (pool->alloc == mempool_alloc_pages) kasan_poison_pages(element, (unsigned long)pool->pool_data, false); From patchwork Tue Dec 19 22:28:46 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: andrey.konovalov@linux.dev X-Patchwork-Id: 13499297 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id ABF2EC46CD3 for ; Tue, 19 Dec 2023 22:29:21 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id 782B86B0083; Tue, 19 Dec 2023 17:29:17 -0500 (EST) Received: by kanga.kvack.org (Postfix, from userid 40) id 7332E6B0099; Tue, 19 Dec 2023 17:29:17 -0500 (EST) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 3FD946B0083; Tue, 19 Dec 2023 17:29:17 -0500 (EST) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0010.hostedemail.com [216.40.44.10]) by kanga.kvack.org (Postfix) with ESMTP id 183CC6B0083 for ; Tue, 19 Dec 2023 17:29:17 -0500 (EST) Received: from smtpin15.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay10.hostedemail.com (Postfix) with ESMTP id C7A18C094A for ; Tue, 19 Dec 2023 22:29:16 +0000 (UTC) X-FDA: 81585009912.15.98EBED6 Received: from out-185.mta1.migadu.com (out-185.mta1.migadu.com [95.215.58.185]) by imf10.hostedemail.com (Postfix) with ESMTP id BA736C0036 for ; Tue, 19 Dec 2023 22:29:14 +0000 (UTC) Authentication-Results: imf10.hostedemail.com; dkim=pass header.d=linux.dev header.s=key1 header.b=UmTZEubK; dmarc=pass (policy=none) header.from=linux.dev; spf=pass (imf10.hostedemail.com: domain of andrey.konovalov@linux.dev designates 95.215.58.185 as permitted sender) smtp.mailfrom=andrey.konovalov@linux.dev ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1703024955; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references:dkim-signature; bh=UD/Zwt/pPZV96U3h6ZFDRBLd7zSWBzdFKqeEs3HVWEE=; b=cZQVuGWwjrxoywH2tedye3jK0uXM0JJwZQH0ecHoyzc2xIqKSO4WqTi/iZ3W75kd5bgqFK qBY+d7ZmeqGih6oLUMHeKRvKk1UPbz0nTA5vSYEZETdT4ETD2ruhaqIR0pX6HIYOxJID86 8gvnLLDgPbDz19FnoD2/hVe8XyWEF3g= ARC-Authentication-Results: i=1; imf10.hostedemail.com; dkim=pass header.d=linux.dev header.s=key1 header.b=UmTZEubK; dmarc=pass (policy=none) header.from=linux.dev; spf=pass (imf10.hostedemail.com: domain of andrey.konovalov@linux.dev designates 95.215.58.185 as permitted sender) smtp.mailfrom=andrey.konovalov@linux.dev ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1703024955; a=rsa-sha256; cv=none; b=kYMgsPq2zZ91lu1FTZCb65zAXezV1DS8IuyaTXVSAGThRp5qpxG1w77++dz5X3fNS3sV2V QkA4jv0P+AdyG2tEps5/iSKdUjk3Wxw1ZgSve2PLcCRW0tQlxUhyfhShwhrLKyGkZ/doIq w0BdPaEneijpY4MtTse+aE/C+DHQmDY= X-Report-Abuse: Please report any abuse attempt to abuse@migadu.com and include these headers. DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linux.dev; s=key1; t=1703024953; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=UD/Zwt/pPZV96U3h6ZFDRBLd7zSWBzdFKqeEs3HVWEE=; b=UmTZEubKzQoH/lyQhsn4scksM491Jqbo0EpqojoHRU0E+cXktICkazzTkFV4YlK3P70GL4 dgY6Fs06IrKmOBcUEU27QhbAyaN4aO/daowtIz1mMORsloednidVgfydYvYT7U3SjZHFk/ +5imE9/lInyqZ2hSS3qnfUmxERlUWdM= From: andrey.konovalov@linux.dev To: Marco Elver , Alexander Potapenko Cc: Andrey Konovalov , Dmitry Vyukov , Andrey Ryabinin , kasan-dev@googlegroups.com, Evgenii Stepanov , Breno Leitao , Alexander Lobakin , Andrew Morton , linux-mm@kvack.org, linux-kernel@vger.kernel.org, Andrey Konovalov Subject: [PATCH mm 02/21] kasan: move kasan_mempool_poison_object Date: Tue, 19 Dec 2023 23:28:46 +0100 Message-Id: <23ea215409f43c13cdf9ecc454501a264c107d67.1703024586.git.andreyknvl@google.com> In-Reply-To: References: MIME-Version: 1.0 X-Migadu-Flow: FLOW_OUT X-Rspam-User: X-Rspamd-Server: rspam12 X-Rspamd-Queue-Id: BA736C0036 X-Stat-Signature: hnz9baotddi8im5g1xmciydrm1hij8pw X-HE-Tag: 1703024954-994241 X-HE-Meta: U2FsdGVkX1+e6C0Rr6c4N/rWvuRjWkyaz7GZKd19GpL7/JjQ9Rb1ijBuR8NWp6OQL7S2ydJO515eKqBowUDbyKFs5Em5wd20IDDtAkfUNM0zVhbKLSXZOLRW+yXSA2vGbYzgIP6xuPABObY4Mw1nKxYjpFu6mYaxnTfow8w6UWHUUgkIP7ZLR4RUu+RwPaBOY+O+eT7QjX4KV/3YWolxJM9K5vmQ2a09265NWBjwCi0vgpwNzajKxdYdCABvyIcWOdomvFvN/fPCxsnOI0yhOGwVIA3lnTaUqs9yJcgSlm+dMtizoYcL/WlxSYJ2MYA/kbAF4tTK/AP9NMQs9WbHLuXBQVhXjNQVZhCTbdscwpDfZ5HEX5xehopVHTa5kqJon8iQnLB3TTwUHral4ZvHK74Mly8QF5ZG13U03SH6GIYeiPJ0wW50/tiSBT4eNe7vtZqnyrTGbczs1A5DS6vNfxTVIxL0QNM6hrz46q5TgE2G3eE1DJ/7aGURkenNjldictzJ57slexl0hkIyIp3ceJ/dldpzYTfWRxyHlCS199r+Rm+IBM4CJr5Spg6lPv5LGsZ/Qb2QGX+Lv9IAHFy7ClK/bUOMEKpt+CGFD77d9Ko2zvyGLdsB77l4FCD1BMtvR+ntiAn8D4z1Ayz7XJ/AHvZSGTQIfOFcnlQrhAYnGesGXfO7s71bVk7USuwWmumXbDZNSFfqR6g2AIVxgeBRk2wSoU8fbUxcLKl7EsPmSFHQWCvst98H7Y0CzdaNPkpQmgFIYSwub63fyGD0f/xFDyg2xYZ49SSEjMydjW/VuNBRdfwmc4hW7ec1L6Rf3KiG+nJ1lb0tb1dfP9yD97rqkWVjdXsGL73tgA8wez2efiCoNvz56Kw1bO9OZlTDSWiKKcYxhWsvGJrOwF/R/0vLDyGm6AqHaQ3LrdnR8jme8LoKI+P8F7jOObiAzvXBsknjl6Lw5UK9xiU7e193NHx i+5s5h7K 9o5eDU+YakWHq22MitwORK8ACV34TBEJbfp64v8JSPSXJb7LWITGsSFY18Zk+VMwrQQPBsSswoj+OP0ISlVi40vTQTfTtUu1OUC9YaUKdpok+AKfmnuRtd8Akaj1EnafJbxp6p++0NywjKUIZrNV46UbwNxeYcNsh7M85SFq0BZdRXswvObE6xRWV2gkjHBrhKFuDJG0tcAApYo0i4WtxLttCLjgInEAT2kHv X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: List-Subscribe: List-Unsubscribe: From: Andrey Konovalov Move kasan_mempool_poison_object after all slab-related KASAN hooks. This is a preparatory change for the following patches in this series. No functional changes. Signed-off-by: Andrey Konovalov --- include/linux/kasan.h | 16 +++++++-------- mm/kasan/common.c | 46 +++++++++++++++++++++---------------------- 2 files changed, 31 insertions(+), 31 deletions(-) diff --git a/include/linux/kasan.h b/include/linux/kasan.h index 6310435f528b..0d1f925c136d 100644 --- a/include/linux/kasan.h +++ b/include/linux/kasan.h @@ -172,13 +172,6 @@ static __always_inline void kasan_kfree_large(void *ptr) __kasan_kfree_large(ptr, _RET_IP_); } -void __kasan_mempool_poison_object(void *ptr, unsigned long ip); -static __always_inline void kasan_mempool_poison_object(void *ptr) -{ - if (kasan_enabled()) - __kasan_mempool_poison_object(ptr, _RET_IP_); -} - void * __must_check __kasan_slab_alloc(struct kmem_cache *s, void *object, gfp_t flags, bool init); static __always_inline void * __must_check kasan_slab_alloc( @@ -219,6 +212,13 @@ static __always_inline void * __must_check kasan_krealloc(const void *object, return (void *)object; } +void __kasan_mempool_poison_object(void *ptr, unsigned long ip); +static __always_inline void kasan_mempool_poison_object(void *ptr) +{ + if (kasan_enabled()) + __kasan_mempool_poison_object(ptr, _RET_IP_); +} + /* * Unlike kasan_check_read/write(), kasan_check_byte() is performed even for * the hardware tag-based mode that doesn't rely on compiler instrumentation. @@ -256,7 +256,6 @@ static inline bool kasan_slab_free(struct kmem_cache *s, void *object, bool init return false; } static inline void kasan_kfree_large(void *ptr) {} -static inline void kasan_mempool_poison_object(void *ptr) {} static inline void *kasan_slab_alloc(struct kmem_cache *s, void *object, gfp_t flags, bool init) { @@ -276,6 +275,7 @@ static inline void *kasan_krealloc(const void *object, size_t new_size, { return (void *)object; } +static inline void kasan_mempool_poison_object(void *ptr) {} static inline bool kasan_check_byte(const void *address) { return true; diff --git a/mm/kasan/common.c b/mm/kasan/common.c index e0394d0ee7f1..fc7f711607e1 100644 --- a/mm/kasan/common.c +++ b/mm/kasan/common.c @@ -282,29 +282,6 @@ void __kasan_kfree_large(void *ptr, unsigned long ip) ____kasan_kfree_large(ptr, ip); } -void __kasan_mempool_poison_object(void *ptr, unsigned long ip) -{ - struct folio *folio; - - folio = virt_to_folio(ptr); - - /* - * Even though this function is only called for kmem_cache_alloc and - * kmalloc backed mempool allocations, those allocations can still be - * !PageSlab() when the size provided to kmalloc is larger than - * KMALLOC_MAX_SIZE, and kmalloc falls back onto page_alloc. - */ - if (unlikely(!folio_test_slab(folio))) { - if (____kasan_kfree_large(ptr, ip)) - return; - kasan_poison(ptr, folio_size(folio), KASAN_PAGE_FREE, false); - } else { - struct slab *slab = folio_slab(folio); - - ____kasan_slab_free(slab->slab_cache, ptr, ip, false, false); - } -} - void * __must_check __kasan_slab_alloc(struct kmem_cache *cache, void *object, gfp_t flags, bool init) { @@ -452,6 +429,29 @@ void * __must_check __kasan_krealloc(const void *object, size_t size, gfp_t flag return ____kasan_kmalloc(slab->slab_cache, object, size, flags); } +void __kasan_mempool_poison_object(void *ptr, unsigned long ip) +{ + struct folio *folio; + + folio = virt_to_folio(ptr); + + /* + * Even though this function is only called for kmem_cache_alloc and + * kmalloc backed mempool allocations, those allocations can still be + * !PageSlab() when the size provided to kmalloc is larger than + * KMALLOC_MAX_SIZE, and kmalloc falls back onto page_alloc. + */ + if (unlikely(!folio_test_slab(folio))) { + if (____kasan_kfree_large(ptr, ip)) + return; + kasan_poison(ptr, folio_size(folio), KASAN_PAGE_FREE, false); + } else { + struct slab *slab = folio_slab(folio); + + ____kasan_slab_free(slab->slab_cache, ptr, ip, false, false); + } +} + bool __kasan_check_byte(const void *address, unsigned long ip) { if (!kasan_byte_accessible(address)) { From patchwork Tue Dec 19 22:28:47 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: andrey.konovalov@linux.dev X-Patchwork-Id: 13499296 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id 97B17C41535 for ; Tue, 19 Dec 2023 22:29:19 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id 400946B0096; Tue, 19 Dec 2023 17:29:17 -0500 (EST) Received: by kanga.kvack.org (Postfix, from userid 40) id 3AF186B009A; Tue, 19 Dec 2023 17:29:17 -0500 (EST) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 1B5CE6B0096; Tue, 19 Dec 2023 17:29:17 -0500 (EST) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0017.hostedemail.com [216.40.44.17]) by kanga.kvack.org (Postfix) with ESMTP id E02948D0009 for ; Tue, 19 Dec 2023 17:29:16 -0500 (EST) Received: from smtpin05.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay01.hostedemail.com (Postfix) with ESMTP id B7B7A1C108C for ; Tue, 19 Dec 2023 22:29:16 +0000 (UTC) X-FDA: 81585009912.05.C42A26A Received: from out-176.mta1.migadu.com (out-176.mta1.migadu.com [95.215.58.176]) by imf12.hostedemail.com (Postfix) with ESMTP id EC7F140031 for ; Tue, 19 Dec 2023 22:29:14 +0000 (UTC) Authentication-Results: imf12.hostedemail.com; dkim=pass header.d=linux.dev header.s=key1 header.b=C4rzmgvl; spf=pass (imf12.hostedemail.com: domain of andrey.konovalov@linux.dev designates 95.215.58.176 as permitted sender) smtp.mailfrom=andrey.konovalov@linux.dev; dmarc=pass (policy=none) header.from=linux.dev ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1703024955; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references:dkim-signature; bh=nDVhwjjwJnVTlqgIL3b0i6xOOMbmQ8bjgeF5HzBvdls=; b=t1fEJCAjAdlmRrRQli8Oo5QUC+EyE/Q5Y/bl9AnotHpQjmV+PviiVFanK1pT0TjYMnQE7L kKei9kXONHkLmOJsv4NYA4JnBdxRgVtG0F863H730w6HLZcf71r5F2omj0Zl1pslVXX72+ QUoBv7yqTNwC+eh0Nz+0OosmylXLDb0= ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1703024955; a=rsa-sha256; cv=none; b=EMOELbqgjWqXXANGUieD14KlWaOlzcP+n+E7I9rHdtrQcUWzAuWqwiNhnOVPasdTzusLgH kTTzNn8Ht9fxcJgWiRHs+QYCu46srMFdSzUSymSUx9X7VziHw6iL/VLt9lzGnvFhEyit53 EN+ZW+zrq7hnK57hO6NyTN5viPtbL40= ARC-Authentication-Results: i=1; imf12.hostedemail.com; dkim=pass header.d=linux.dev header.s=key1 header.b=C4rzmgvl; spf=pass (imf12.hostedemail.com: domain of andrey.konovalov@linux.dev designates 95.215.58.176 as permitted sender) smtp.mailfrom=andrey.konovalov@linux.dev; dmarc=pass (policy=none) header.from=linux.dev X-Report-Abuse: Please report any abuse attempt to abuse@migadu.com and include these headers. DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linux.dev; s=key1; t=1703024953; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=nDVhwjjwJnVTlqgIL3b0i6xOOMbmQ8bjgeF5HzBvdls=; b=C4rzmgvlL10DUVbNDtuc0Rxs46Curn42ZGKpKom91VOpoIt4fpkrs/ypbw6AsjfsBn5cAV f4+a7vAj+bLJwhOfAkOj0ot52A4kwU/QGW9g6mUQ3jTBsZTJ9qMcuEm6y1mZK7xk4PDRQ1 qJLgEpIfbiitBegq2Oh+ysHOy3abWJw= From: andrey.konovalov@linux.dev To: Marco Elver , Alexander Potapenko Cc: Andrey Konovalov , Dmitry Vyukov , Andrey Ryabinin , kasan-dev@googlegroups.com, Evgenii Stepanov , Breno Leitao , Alexander Lobakin , Andrew Morton , linux-mm@kvack.org, linux-kernel@vger.kernel.org, Andrey Konovalov Subject: [PATCH mm 03/21] kasan: document kasan_mempool_poison_object Date: Tue, 19 Dec 2023 23:28:47 +0100 Message-Id: In-Reply-To: References: MIME-Version: 1.0 X-Migadu-Flow: FLOW_OUT X-Rspamd-Queue-Id: EC7F140031 X-Rspam-User: X-Stat-Signature: xdt1xpoahmz6df3t1gib9oeq81xy86ws X-Rspamd-Server: rspam03 X-HE-Tag: 1703024954-466487 X-HE-Meta: U2FsdGVkX1+oHCSOHONRiPAUnoQQxlXW1hR2/u1czLJvThdNdVP8LEBDiOkAQLUh/Z7/+v6IwdGp7cRreZ1hSBWiPKZpv8YQ0LPYh2nPx07t5Ig1+4fKfOMjY02rmFXxeTWLbV9WgbytucMZIvJhCLJTcqA1aL7lIKwAHlaw/YsNS6oY4+JB17GV08aBmTQ7g8SM/928TwLE61V91qxzHviEKXvdlckCo0wk6MMALp3CfgUQTRdHRxUuvDTq1uLYTDJfpDjlhjjzRrsc4HTAroIvUE4l1k2etbtcKeJkrvJwY44UmTabGvyyFC6kuUoD068x4jJI+jIumyZz4BxQxhM3Z3hXTltkurRRmM7fZQE5JYv8GwXyj5Kh/DG6+HIXZOAprZ+8wxfdhF2RD6hSdc6do5qHXy+WIPVqiTc4y9Lx3zW1x1Usi9Wng43ZXd2D4tjrQ6hyNCa0iUz2r9ERlnS5CzWn+s1YOwO6Z79OIO0p4oqKdIyjydlTqOnDVLAOe/8PPMTZkJzOYBF9FWYHcpUHM/THsDZOXROOixmUjlkb/cMHnMOYaBWj5uhSUSuL0zzTX02N8vruyPSIlCmpKJ66eagL8uypXCdkAqWZPTYdwl65rilytQLHusF/TBkvlfH9bEWwJnsHq1qt+8PQMMB9D3ZVc0P2Yq2i4LpefH/PUcx6l5hmm4Tc9bzXD4tPTGTCCd6el8DEVdOUny6S2ShoLCmU1DRl9oEUkuwn5Xxnyf0AA6RX5e2cuDlHZFU1OREWY+SQgqVnj/H4PbTBbZUW6eqbZFkGhH3+wZAMog5YPb5Af5R3oWHt7PHLpgW+Z33VtFnpSIdW5f9e/A+HRSOQHHa2f4kEaWgcSSTrLeB+TP40EPcyQ+CwhL5WK4emo0YpwEl7S+mpb10st2R8eCpWf5nC6RNToNEM1F5Y9vPIrMshgECsA4+aHPlsSYNueVcRLN28H9jfFIyGjG5 +VVZbxpA eY9jYS4VgbC4BxHYeOoiccwyIhjC4ZNxLfBqnyDlY3fuDUYpANBp/pwigUYogC2zRVsvnDV7mYbla6FTXz8oGQnSMtrhzd4I5/8VZ9BS0+e/1IOQ/QNldHy3Rk+qf3KN3dQoAXotsBRFeZC7R22RzghCn/xIAwzdWG0vR93XpVovNEScRqqwHF1+kihF/nBTgieGBML5frzmUVAq1Qq1EzUFodw== X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: List-Subscribe: List-Unsubscribe: From: Andrey Konovalov Add documentation comment for kasan_mempool_poison_object. Signed-off-by: Andrey Konovalov --- include/linux/kasan.h | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+) diff --git a/include/linux/kasan.h b/include/linux/kasan.h index 0d1f925c136d..bbf6e2fa4ffd 100644 --- a/include/linux/kasan.h +++ b/include/linux/kasan.h @@ -213,6 +213,24 @@ static __always_inline void * __must_check kasan_krealloc(const void *object, } void __kasan_mempool_poison_object(void *ptr, unsigned long ip); +/** + * kasan_mempool_poison_object - Check and poison a mempool slab allocation. + * @ptr: Pointer to the slab allocation. + * + * This function is intended for kernel subsystems that cache slab allocations + * to reuse them instead of freeing them back to the slab allocator (e.g. + * mempool). + * + * This function poisons a slab allocation without initializing its memory and + * without putting it into the quarantine (for the Generic mode). + * + * This function also performs checks to detect double-free and invalid-free + * bugs and reports them. + * + * This function operates on all slab allocations including large kmalloc + * allocations (the ones returned by kmalloc_large() or by kmalloc() with the + * size > KMALLOC_MAX_SIZE). + */ static __always_inline void kasan_mempool_poison_object(void *ptr) { if (kasan_enabled()) From patchwork Tue Dec 19 22:28:48 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: andrey.konovalov@linux.dev X-Patchwork-Id: 13499299 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id 2F9DFC41535 for ; Tue, 19 Dec 2023 22:29:27 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id D4F456B009A; Tue, 19 Dec 2023 17:29:19 -0500 (EST) Received: by kanga.kvack.org (Postfix, from userid 40) id D00128D000A; Tue, 19 Dec 2023 17:29:19 -0500 (EST) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id B77B38D0009; Tue, 19 Dec 2023 17:29:19 -0500 (EST) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0012.hostedemail.com [216.40.44.12]) by kanga.kvack.org (Postfix) with ESMTP id A0CEF6B009A for ; Tue, 19 Dec 2023 17:29:19 -0500 (EST) Received: from smtpin08.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay04.hostedemail.com (Postfix) with ESMTP id 6A9951A0711 for ; Tue, 19 Dec 2023 22:29:19 +0000 (UTC) X-FDA: 81585010038.08.1FFDFBE Received: from out-175.mta1.migadu.com (out-175.mta1.migadu.com [95.215.58.175]) by imf29.hostedemail.com (Postfix) with ESMTP id D61A0120019 for ; Tue, 19 Dec 2023 22:29:15 +0000 (UTC) Authentication-Results: imf29.hostedemail.com; dkim=pass header.d=linux.dev header.s=key1 header.b=dzo5xM0U; dmarc=pass (policy=none) header.from=linux.dev; spf=pass (imf29.hostedemail.com: domain of andrey.konovalov@linux.dev designates 95.215.58.175 as permitted sender) smtp.mailfrom=andrey.konovalov@linux.dev ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1703024956; a=rsa-sha256; cv=none; b=n8AcK602tGdtzG2mz/2lZ1Xm56TOef2Tmj9wxA1xGttqnTaS2QAWv6Tdlek2IRYrZo2jG5 6dSN9moUiQEkApejYe8XtzuVa+qD875LZ6V8E/WLvE18PI+uM4763DX3X9AhGTZpt0Gi51 Ve1ZVqvpUAqZ6zd28S1wl6DI6C+r+2k= ARC-Authentication-Results: i=1; imf29.hostedemail.com; dkim=pass header.d=linux.dev header.s=key1 header.b=dzo5xM0U; dmarc=pass (policy=none) header.from=linux.dev; spf=pass (imf29.hostedemail.com: domain of andrey.konovalov@linux.dev designates 95.215.58.175 as permitted sender) smtp.mailfrom=andrey.konovalov@linux.dev ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1703024956; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references:dkim-signature; bh=W+GO4UdeS5AdNTnDLBObG20S1KoxsxGlKzUPAgkpjho=; b=iLHk6tK9VNihrZObXftGcPvPWoVki8XhZHEhRz/lw6lpVA8UmqJjfX9IAVUCA2tEFuSSZz SiTvGbdgmJ0R1qUCWxHBH4v22xKFBWFEzjhsmdVeE6J0a7Ey/fncMWR8Nd0+Hf2j7+IDfQ UIkz3j7SSgCT6TPbUZ37dvSdc3BnsLg= X-Report-Abuse: Please report any abuse attempt to abuse@migadu.com and include these headers. DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linux.dev; s=key1; t=1703024954; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=W+GO4UdeS5AdNTnDLBObG20S1KoxsxGlKzUPAgkpjho=; b=dzo5xM0U129ISs8wP5QYvHL5occ5Ub/oL2lz1qj/FqHB9brhX1Gfjk4Uw9COo67ZEnW8ww KhbMK460okwgrIt1sc0CA8v8HSc2psAxv4a5/jCjrofVYNGNlcaua/Ot8Y8/UKGJ7gqOyM 9nt9J9X1zm2DTKxesXWV16ZmBqZDjO0= From: andrey.konovalov@linux.dev To: Marco Elver , Alexander Potapenko Cc: Andrey Konovalov , Dmitry Vyukov , Andrey Ryabinin , kasan-dev@googlegroups.com, Evgenii Stepanov , Breno Leitao , Alexander Lobakin , Andrew Morton , linux-mm@kvack.org, linux-kernel@vger.kernel.org, Andrey Konovalov Subject: [PATCH mm 04/21] kasan: add return value for kasan_mempool_poison_object Date: Tue, 19 Dec 2023 23:28:48 +0100 Message-Id: <618af65273875fb9f56954285443279b15f1fcd9.1703024586.git.andreyknvl@google.com> In-Reply-To: References: MIME-Version: 1.0 X-Migadu-Flow: FLOW_OUT X-Rspam-User: X-Rspamd-Server: rspam06 X-Rspamd-Queue-Id: D61A0120019 X-Stat-Signature: nq8ds8caox4i6zc9umksozbjcsjkajpj X-HE-Tag: 1703024955-59970 X-HE-Meta: U2FsdGVkX1+KcRxei8/H4g4LFr0OEJDtWqIUEECm/kXTIcFDnrlx6Uy6o3NNMDEsMR7JySFgO9yGlxKayBq+eRv4bKbGADKmHa4fM4k/slmOWpf/J1epM89RaCtUEjaQ5k4KrauG1p0/vtnAz0IzRjJNYhAWst7sUZTFfrvbDxtPJ788OVVVPQ8lspoQyuH/00IEXSoXPRTbnM/YVepcFreJwU6BSF46gm1J/b8zTF9o+zV+3MS2zXu5T4bj/Y8i5PNfsF3SXzcrF72vC68ZMugsWDdZVGqC9Lw5UYgj6/SytrO69KyOVXyWdphbAwPps9nmdoOoKxpHd4TOK7dYzhEG5H9CPO3D/KWAIxjqNO2gZGbPB3MWeOaaTRRsPlZ/W2P0auLYM98/KnFMAhuPZOj3vbLYF9X3S5Mir/50uIihgoxzjJYDUafJwxFKWJf6ry4Y+8LVrLKwA6PFNBJw2LecmwNw/r9uncIUiUCBQR23zrgA1LsioFG4JrARkvU37EJrjIypfD8Un63QFn3akuPOJy2rl3+sfauNMU+MTOJKUOH26cH+JuOTTthclqHMDp6rZqbPrivBU/HokB3+VspzWGtt33Rdf33xrQv7Xt8TIlXQLJmRxQaUvMCQZ86Aa20M8Xn+pUCl2QoMZvVheMiydwCjqODcwATpPY6yNvpItahLtYUbfoSaqT2Re2sPgfnE1AmrWbakZT4jl3sUeWI9asEIRlfkyu1GGptxaxJg2ne4/6xoSTLJrweY/182GCfqy+zcBEIv2NrBwPqLhUL87ep3c0T2u1x6xFm3cvpu5Eyo1qefTOvg3/0Q/s4IxAq/1HYmOFMTW755KYOh9hE/68FEUdwc7uG2E0/FuGiK8Igzc3b8e+N1E9aUISalW0cBbXAwJJ4pSy0ycBzvv+S2wdIs7Z0bOujVSivmafaSz9VlLQKrMJ3ylgZrO16T8ldz0cFYaCEB4gfxD9V ZrpmhOYz HXPsyiMq0flr41hcjkOpa5yWYKjD/MzMabAXknSrMuKi/pIMSu7rxFStRz8wrtYHx2Q7JTu5ASCjf1cuQydIZY0Ee9kpsGEqkhOPCa5Bt/xS9Yu+Fb4AnP3gtKmUjZE77ocRJtEEASd40JJ/4VpJ6KGSGEmvVh3b4G9Baz1ciM4bfylBoHlZXi8/dDtCcErUN50uaA1GLrfXCj8mhyDCrhzKZZUQxwQwTqm1b X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: List-Subscribe: List-Unsubscribe: From: Andrey Konovalov Add a return value for kasan_mempool_poison_object that lets the caller know whether the allocation is affected by a double-free or an invalid-free bug. The caller can use this return value to stop operating on the object. Also introduce a check_page_allocation helper function to improve the code readability. Signed-off-by: Andrey Konovalov --- include/linux/kasan.h | 17 ++++++++++++----- mm/kasan/common.c | 21 ++++++++++----------- 2 files changed, 22 insertions(+), 16 deletions(-) diff --git a/include/linux/kasan.h b/include/linux/kasan.h index bbf6e2fa4ffd..33387e254caa 100644 --- a/include/linux/kasan.h +++ b/include/linux/kasan.h @@ -212,7 +212,7 @@ static __always_inline void * __must_check kasan_krealloc(const void *object, return (void *)object; } -void __kasan_mempool_poison_object(void *ptr, unsigned long ip); +bool __kasan_mempool_poison_object(void *ptr, unsigned long ip); /** * kasan_mempool_poison_object - Check and poison a mempool slab allocation. * @ptr: Pointer to the slab allocation. @@ -225,16 +225,20 @@ void __kasan_mempool_poison_object(void *ptr, unsigned long ip); * without putting it into the quarantine (for the Generic mode). * * This function also performs checks to detect double-free and invalid-free - * bugs and reports them. + * bugs and reports them. The caller can use the return value of this function + * to find out if the allocation is buggy. * * This function operates on all slab allocations including large kmalloc * allocations (the ones returned by kmalloc_large() or by kmalloc() with the * size > KMALLOC_MAX_SIZE). + * + * Return: true if the allocation can be safely reused; false otherwise. */ -static __always_inline void kasan_mempool_poison_object(void *ptr) +static __always_inline bool kasan_mempool_poison_object(void *ptr) { if (kasan_enabled()) - __kasan_mempool_poison_object(ptr, _RET_IP_); + return __kasan_mempool_poison_object(ptr, _RET_IP_); + return true; } /* @@ -293,7 +297,10 @@ static inline void *kasan_krealloc(const void *object, size_t new_size, { return (void *)object; } -static inline void kasan_mempool_poison_object(void *ptr) {} +static inline bool kasan_mempool_poison_object(void *ptr) +{ + return true; +} static inline bool kasan_check_byte(const void *address) { return true; diff --git a/mm/kasan/common.c b/mm/kasan/common.c index fc7f711607e1..2b4869de4985 100644 --- a/mm/kasan/common.c +++ b/mm/kasan/common.c @@ -254,7 +254,7 @@ bool __kasan_slab_free(struct kmem_cache *cache, void *object, return ____kasan_slab_free(cache, object, ip, true, init); } -static inline bool ____kasan_kfree_large(void *ptr, unsigned long ip) +static inline bool check_page_allocation(void *ptr, unsigned long ip) { if (!kasan_arch_is_ready()) return false; @@ -269,17 +269,14 @@ static inline bool ____kasan_kfree_large(void *ptr, unsigned long ip) return true; } - /* - * The object will be poisoned by kasan_poison_pages() or - * kasan_mempool_poison_object(). - */ - return false; } void __kasan_kfree_large(void *ptr, unsigned long ip) { - ____kasan_kfree_large(ptr, ip); + check_page_allocation(ptr, ip); + + /* The object will be poisoned by kasan_poison_pages(). */ } void * __must_check __kasan_slab_alloc(struct kmem_cache *cache, @@ -429,7 +426,7 @@ void * __must_check __kasan_krealloc(const void *object, size_t size, gfp_t flag return ____kasan_kmalloc(slab->slab_cache, object, size, flags); } -void __kasan_mempool_poison_object(void *ptr, unsigned long ip) +bool __kasan_mempool_poison_object(void *ptr, unsigned long ip) { struct folio *folio; @@ -442,13 +439,15 @@ void __kasan_mempool_poison_object(void *ptr, unsigned long ip) * KMALLOC_MAX_SIZE, and kmalloc falls back onto page_alloc. */ if (unlikely(!folio_test_slab(folio))) { - if (____kasan_kfree_large(ptr, ip)) - return; + if (check_page_allocation(ptr, ip)) + return false; kasan_poison(ptr, folio_size(folio), KASAN_PAGE_FREE, false); + return true; } else { struct slab *slab = folio_slab(folio); - ____kasan_slab_free(slab->slab_cache, ptr, ip, false, false); + return !____kasan_slab_free(slab->slab_cache, ptr, ip, + false, false); } } From patchwork Tue Dec 19 22:28:49 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: andrey.konovalov@linux.dev X-Patchwork-Id: 13499298 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id 6C697C46CCD for ; Tue, 19 Dec 2023 22:29:24 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id C3D5D6B0098; Tue, 19 Dec 2023 17:29:18 -0500 (EST) Received: by kanga.kvack.org (Postfix, from userid 40) id BEC136B0099; Tue, 19 Dec 2023 17:29:18 -0500 (EST) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id A66468D0009; Tue, 19 Dec 2023 17:29:18 -0500 (EST) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0016.hostedemail.com [216.40.44.16]) by kanga.kvack.org (Postfix) with ESMTP id 909FD6B0098 for ; Tue, 19 Dec 2023 17:29:18 -0500 (EST) Received: from smtpin08.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay01.hostedemail.com (Postfix) with ESMTP id 552191C121F for ; Tue, 19 Dec 2023 22:29:18 +0000 (UTC) X-FDA: 81585009996.08.EA7483F Received: from out-178.mta1.migadu.com (out-178.mta1.migadu.com [95.215.58.178]) by imf22.hostedemail.com (Postfix) with ESMTP id 58C36C003A for ; Tue, 19 Dec 2023 22:29:16 +0000 (UTC) Authentication-Results: imf22.hostedemail.com; dkim=pass header.d=linux.dev header.s=key1 header.b="F86/EPhH"; spf=pass (imf22.hostedemail.com: domain of andrey.konovalov@linux.dev designates 95.215.58.178 as permitted sender) smtp.mailfrom=andrey.konovalov@linux.dev; dmarc=pass (policy=none) header.from=linux.dev ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1703024956; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references:dkim-signature; bh=DO8tjmS9YVd+JQvWum2ppGekXJiIG6c57s1H7fN9b9c=; b=G4zL+v/QUoxBYAcMdbbqjSd1IntvmOlkjZ6zumQPnmBnclbjDuehdwuUvlPcQdxFG6Gbxu c5hv3GLJe+IhVswxilLcv/lxvGnJiefrTB4LldJdGlyRj6hu5Rnf977m3PsHH0eFET/Qc4 NpPHw++yJ7ZAwwtxyVeNFEqE4pfgt6c= ARC-Authentication-Results: i=1; imf22.hostedemail.com; dkim=pass header.d=linux.dev header.s=key1 header.b="F86/EPhH"; spf=pass (imf22.hostedemail.com: domain of andrey.konovalov@linux.dev designates 95.215.58.178 as permitted sender) smtp.mailfrom=andrey.konovalov@linux.dev; dmarc=pass (policy=none) header.from=linux.dev ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1703024956; a=rsa-sha256; cv=none; b=1N3lGkC3jmFskGDrD0vJa40PpFoLRzsz/yTfLtP7cJkBM5ijPWLciA/pUC1acPVoWrrUTJ bmnIFKRo8wlDlEhzkccgNshPqEMQdlNAZcyEGOGVHT0URKIYl8bA725N8Rowc2K+yzYHUJ jqosBoHSnSj1w4b8Un8OhY/RCd/C6/g= X-Report-Abuse: Please report any abuse attempt to abuse@migadu.com and include these headers. DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linux.dev; s=key1; t=1703024954; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=DO8tjmS9YVd+JQvWum2ppGekXJiIG6c57s1H7fN9b9c=; b=F86/EPhH4w6/WbWrDENKsFnnUYgyTxWsWcPGWpBY23pYkD6fHfvr174y/cag/gCnwWPUSr 5v6xLH4KEmbEYh1Enf/9T6dx3MnCR1H0deL92bZhphAwsZ5re8vi40q1doi4AozQsFx4SP 8eXPaY9dqKTzvnqybENGUX0YdLOqPQA= From: andrey.konovalov@linux.dev To: Marco Elver , Alexander Potapenko Cc: Andrey Konovalov , Dmitry Vyukov , Andrey Ryabinin , kasan-dev@googlegroups.com, Evgenii Stepanov , Breno Leitao , Alexander Lobakin , Andrew Morton , linux-mm@kvack.org, linux-kernel@vger.kernel.org, Andrey Konovalov Subject: [PATCH mm 05/21] kasan: introduce kasan_mempool_unpoison_object Date: Tue, 19 Dec 2023 23:28:49 +0100 Message-Id: In-Reply-To: References: MIME-Version: 1.0 X-Migadu-Flow: FLOW_OUT X-Rspamd-Queue-Id: 58C36C003A X-Rspam-User: X-Stat-Signature: cdnpo56wh1sqw34bpqstatyzs1rpsa9h X-Rspamd-Server: rspam01 X-HE-Tag: 1703024956-946804 X-HE-Meta: U2FsdGVkX1+RO4ecfJ5Ju/FluegD93NPgE570InWi0NTBoi0nntTG+LA/JGBQFqENTkA1YSl0m3chsYGBeHGVIgnAIqZ6RPeRMXOPnfwC4iLavQam+NSK0HEgFwLrVfsJSHMmSsdAVEyJKoaPAlUcLb0U/GgZrsXdk9BRYQhBU7LhBSQTlqPovCfQCyYYEf4ZdVtH7o8loByB8AkL2F6eHbv5QMoksPgPP1/OJUmqPtBHDuPGHBHL3Jtu94Sm17jdRworBQL7rQ466X29XFWGB2+QWA487EoUtKOD547houpHIgOXv5x4JwDQMSAKmny3xd0WOdFXWVyasDqWhFHDUIYZWkc4qbY7OXvzq1srNeZrVPwz7kYsUAR7EopuVdl1Xo4JkugcAXaln4o6fE1DWCNRYhjf3IUwYsVEGcw+h9w7cvOjvekNcU541/TjgK7wcY/UfAoig92/V79Bs2GQSlH6Os3oHbzPVY2FLMJkyBAcPzDLa7QZGflhLCFngOD9O2tDPeWhH8xUs1tihoE4qAhyepYUAs0ZXhoMhEvXZTtLwUqhX6MQ6sCVx9KV5KrT7emr1WOwF+GS3SHYwirN35xm9mhtBQnFqpZzRcwz8JC5dIiyC1XlYZxshJBuoPnw78pePfGJYSj8wfOiQPFqa3hfvnOOpT4k9cfs9Vsp6TgGxMmKn5O4R5jKY35CYj3SkcpBlwbYytdUlbeBd95tcS8P5f4ArBBT2PQzGcaJDAqCr4YmdIKmlE+x6iJgkOn4jM682nScY3qjrdq4kK6GC7FHKeiZltOSzF6quMjHWNISYCBNYviGh6caq1suxTmdt3iW3mAS/z+QdlQwCdxonjzrn/YI7qLB35nvguKm+Jihd1KyGMWW7WuX3oda9gJwg2GYG8nqk3l1qLB+jIHzktz2d3/yzL7PU+Ux+Ye5NjV3WZo/Z06D/tkLzLHkAj+15jPW5Ko1xAgC2Z+Jdj iuC5e2Ac 5+4hBqgIJMQGfbEWpuCC9il0NZLRe8sdl89/cn2EyQsRSscuRoUUqLCWRHQV9DYW8P3Yw3Hwg3r5Fd9IgAgDnmEiNBGIZSb9KnCERB3eRWbvGGU8/+ufrOGIkRV7pTTrG2T2N2Cz6ygrHH2RX8uzrHjfZynnHInpgApHBOSPUNOBn9uJJPVZJM0Zpzjy9OgbXql8kFDFZD8HUG/Dm/0QuZGZN/Q== X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: List-Subscribe: List-Unsubscribe: From: Andrey Konovalov Introduce and document a kasan_mempool_unpoison_object hook. This hook serves as a replacement for the generic kasan_unpoison_range that the mempool code relies on right now. mempool will be updated to use the new hook in one of the following patches. For now, define the new hook to be identical to kasan_unpoison_range. One of the following patches will update it to add stack trace collection. Signed-off-by: Andrey Konovalov --- include/linux/kasan.h | 31 +++++++++++++++++++++++++++++++ mm/kasan/common.c | 5 +++++ 2 files changed, 36 insertions(+) diff --git a/include/linux/kasan.h b/include/linux/kasan.h index 33387e254caa..c5fe303bc1c2 100644 --- a/include/linux/kasan.h +++ b/include/linux/kasan.h @@ -228,6 +228,9 @@ bool __kasan_mempool_poison_object(void *ptr, unsigned long ip); * bugs and reports them. The caller can use the return value of this function * to find out if the allocation is buggy. * + * Before the poisoned allocation can be reused, it must be unpoisoned via + * kasan_mempool_unpoison_object(). + * * This function operates on all slab allocations including large kmalloc * allocations (the ones returned by kmalloc_large() or by kmalloc() with the * size > KMALLOC_MAX_SIZE). @@ -241,6 +244,32 @@ static __always_inline bool kasan_mempool_poison_object(void *ptr) return true; } +void __kasan_mempool_unpoison_object(void *ptr, size_t size, unsigned long ip); +/** + * kasan_mempool_unpoison_object - Unpoison a mempool slab allocation. + * @ptr: Pointer to the slab allocation. + * @size: Size to be unpoisoned. + * + * This function is intended for kernel subsystems that cache slab allocations + * to reuse them instead of freeing them back to the slab allocator (e.g. + * mempool). + * + * This function unpoisons a slab allocation that was previously poisoned via + * kasan_mempool_poison_object() without initializing its memory. For the + * tag-based modes, this function does not assign a new tag to the allocation + * and instead restores the original tags based on the pointer value. + * + * This function operates on all slab allocations including large kmalloc + * allocations (the ones returned by kmalloc_large() or by kmalloc() with the + * size > KMALLOC_MAX_SIZE). + */ +static __always_inline void kasan_mempool_unpoison_object(void *ptr, + size_t size) +{ + if (kasan_enabled()) + __kasan_mempool_unpoison_object(ptr, size, _RET_IP_); +} + /* * Unlike kasan_check_read/write(), kasan_check_byte() is performed even for * the hardware tag-based mode that doesn't rely on compiler instrumentation. @@ -301,6 +330,8 @@ static inline bool kasan_mempool_poison_object(void *ptr) { return true; } +static inline void kasan_mempool_unpoison_object(void *ptr, size_t size) {} + static inline bool kasan_check_byte(const void *address) { return true; diff --git a/mm/kasan/common.c b/mm/kasan/common.c index 2b4869de4985..4b85d35bb8ab 100644 --- a/mm/kasan/common.c +++ b/mm/kasan/common.c @@ -451,6 +451,11 @@ bool __kasan_mempool_poison_object(void *ptr, unsigned long ip) } } +void __kasan_mempool_unpoison_object(void *ptr, size_t size, unsigned long ip) +{ + kasan_unpoison(ptr, size, false); +} + bool __kasan_check_byte(const void *address, unsigned long ip) { if (!kasan_byte_accessible(address)) { From patchwork Tue Dec 19 22:28:50 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: andrey.konovalov@linux.dev X-Patchwork-Id: 13499303 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id E1042C41535 for ; Tue, 19 Dec 2023 22:30:26 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id 592D38D0009; Tue, 19 Dec 2023 17:30:23 -0500 (EST) Received: by kanga.kvack.org (Postfix, from userid 40) id 50F8E8D000E; Tue, 19 Dec 2023 17:30:23 -0500 (EST) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 2C6148D0009; Tue, 19 Dec 2023 17:30:23 -0500 (EST) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0017.hostedemail.com [216.40.44.17]) by kanga.kvack.org (Postfix) with ESMTP id F32958D0009 for ; Tue, 19 Dec 2023 17:30:22 -0500 (EST) Received: from smtpin21.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay10.hostedemail.com (Postfix) with ESMTP id CBA61C03F4 for ; Tue, 19 Dec 2023 22:30:22 +0000 (UTC) X-FDA: 81585012684.21.6875A47 Received: from out-171.mta0.migadu.com (out-171.mta0.migadu.com [91.218.175.171]) by imf08.hostedemail.com (Postfix) with ESMTP id E745116001D for ; Tue, 19 Dec 2023 22:30:19 +0000 (UTC) Authentication-Results: imf08.hostedemail.com; dkim=pass header.d=linux.dev header.s=key1 header.b=qKyzmQgF; dmarc=pass (policy=none) header.from=linux.dev; spf=pass (imf08.hostedemail.com: domain of andrey.konovalov@linux.dev designates 91.218.175.171 as permitted sender) smtp.mailfrom=andrey.konovalov@linux.dev ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1703025020; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references:dkim-signature; bh=uNoAVP0QdjYefiRU2LrZ1wqxo2WmCMSn1BBV5oc4/p4=; b=4yTbi447S04aahNnDDwVuB8hrpTXWjmHYvBXJOcqXojbUoRCWQYoR51QNxe5X7XAk3swnE sb7zflcOrmKp+B6Ud888jEq+sP/aRUU5qcZtLGBWZcMKDYBMF/i62m0wN02t71XvuY8Xku zpT2F8Rrn0qL0uNU7exQbf6bBCJajDA= ARC-Authentication-Results: i=1; imf08.hostedemail.com; dkim=pass header.d=linux.dev header.s=key1 header.b=qKyzmQgF; dmarc=pass (policy=none) header.from=linux.dev; spf=pass (imf08.hostedemail.com: domain of andrey.konovalov@linux.dev designates 91.218.175.171 as permitted sender) smtp.mailfrom=andrey.konovalov@linux.dev ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1703025020; a=rsa-sha256; cv=none; b=8rSXu/gwo46dJlcLbWWkbfJ07Vt3KGceVlRMdjebSDCic4Q476453Nc0eLc0TEO9+S37yC cctoI0THpTkVPejfPelgXfzl134HmXPZfvzngBnqtsfmxz6EYCs2U9phiGCg/nYT5bJVUi EgdFCbfVTgjygFSSvWywlK2D0BqNNnc= X-Report-Abuse: Please report any abuse attempt to abuse@migadu.com and include these headers. DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linux.dev; s=key1; t=1703025017; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=uNoAVP0QdjYefiRU2LrZ1wqxo2WmCMSn1BBV5oc4/p4=; b=qKyzmQgFg/Y7DFx/QocHdWjJrVPMWCP48LD0cbTxo/AvGFiyJYN91o7BgFE+N8U+w/yHzN C6OjPdLT2mHcpxPkyqBEu2zYClKYdujcJMMPKEyXb1+/NggG2ze+zsPE+2stPIX/Yx9tta GpLx/JGbzJYPzm4QqujIB6NjsTUMg1k= From: andrey.konovalov@linux.dev To: Marco Elver , Alexander Potapenko Cc: Andrey Konovalov , Dmitry Vyukov , Andrey Ryabinin , kasan-dev@googlegroups.com, Evgenii Stepanov , Breno Leitao , Alexander Lobakin , Andrew Morton , linux-mm@kvack.org, linux-kernel@vger.kernel.org, Andrey Konovalov Subject: [PATCH mm 06/21] kasan: introduce kasan_mempool_poison_pages Date: Tue, 19 Dec 2023 23:28:50 +0100 Message-Id: <88dc7340cce28249abf789f6e0c792c317df9ba5.1703024586.git.andreyknvl@google.com> In-Reply-To: References: MIME-Version: 1.0 X-Migadu-Flow: FLOW_OUT X-Rspamd-Queue-Id: E745116001D X-Rspam-User: X-Rspamd-Server: rspam05 X-Stat-Signature: pa3eho1nkpepq5i6jehoc4ec4zz74wjp X-HE-Tag: 1703025019-348941 X-HE-Meta: U2FsdGVkX18yYiyU17sPL80HbrUsSXUiEvC4FYcYCKDYtKujXsiGFhC+KS+bBqlAlPN2Q3u0AoTqhGH8iirSIBOVTp41PVjRs1vQsCYaqXurq9wG1ApSGjxv8NZGoZMc+yN44APHCO5N4VIfVKp50c7Wa4E8uQRsY6K/LCI8ZymeVfhXSau735XtJY0eTZKRy5NGvh78tVibdTRb/GImMyHwazfPUrKwvND8bUK9FhWccbANESz8t+6y+FnyKSKqL9uqXJxoaK1vEr8kXyb1W/3+7C5BDeHEloOvkXILfdj6zraILiNS1S0/2pUG0LYDquo94GNXjoKGuELtOcYkzbsesDwThGmBtM5MC4g+mXakeoaPsrcWG7VYe/9P5lLl4u7VWbx3t6CS/bruI7BRM6yrdOsSPm/8dXT1X7wn5ABPpWZE2+Rlj2vH4t9L1oq6HSKJnsyeL0FFciaGFGuLC9e31WjUYLNTX146DQQLH3q+xEHgIhCv3395MpYOsuA7okmSHLHQYHYeEjv1+Tlm+eWqWi0whA9IWIGSFi1dRcqpqgvj460WkN87qAq2kvW+klyBXnKOjCCPCtxyE9MlFqPbP7TSuh2ll3StyzM2sGirZwEHdE8gyxNQA/yCgK2rTCUsXmzUylcIBDd/NziHLRx8MW3hPcMd4AurroS9ccySYGBhrvd/UVQaM4ZXzy1fED/burOQZ0Cu5TEBs3jMToRMRhkHIECuS+/d4S0+2FEqHvgmdt8qW051Wuq2wkVTrJF+albijPqxLwO9p/ZGoMtwgN2E0EtRTpaHUpqZsUwK4Z8i1o03ql/j5uiAQgcHWl9qcdZ+kmv4ajCSg/3o4O45NcWCzxvex3Mkd3X3d5BGDJ8GKTG9Kk6cFDVauM689tIfei2mqoaynpBaBd7raqMaA78P0vWc/gLCOIIb0TgLxKXzJ/T37cAHqPAa0x/s6t3vJEpSw0Y3LYkcjCL jsYzG5Bo ErMDgf8nlMQ2/Qi9XklGekV4KCfouoRIUk6JkiihRZDM7TQiPQ0NbG+65crRQvYy0x7k1d/eO0vy7sWa/zbsBivRw0YIWyHgFW037y5xh1BKLT6OCXh6tWW/C4S7dzNcfVBmfK7ML3UPYir2yuFlmY39GeQjBmTteaj8K7quXmdXConicouPMk2USJGUQz51MUkOlv/hblbbTjJ5GG4c7JzDKEUpfR8IZHV0I X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: List-Subscribe: List-Unsubscribe: From: Andrey Konovalov Introduce and document a kasan_mempool_poison_pages hook to be used by the mempool code instead of kasan_poison_pages. Compated to kasan_poison_pages, the new hook: 1. For the tag-based modes, skips checking and poisoning allocations that were not tagged due to sampling. 2. Checks for double-free and invalid-free bugs. In the future, kasan_poison_pages can also be updated to handle #2, but this is out-of-scope of this series. Signed-off-by: Andrey Konovalov --- include/linux/kasan.h | 27 +++++++++++++++++++++++++++ mm/kasan/common.c | 23 +++++++++++++++++++++++ 2 files changed, 50 insertions(+) diff --git a/include/linux/kasan.h b/include/linux/kasan.h index c5fe303bc1c2..de2a695ad34d 100644 --- a/include/linux/kasan.h +++ b/include/linux/kasan.h @@ -212,6 +212,29 @@ static __always_inline void * __must_check kasan_krealloc(const void *object, return (void *)object; } +bool __kasan_mempool_poison_pages(struct page *page, unsigned int order, + unsigned long ip); +/** + * kasan_mempool_poison_pages - Check and poison a mempool page allocation. + * @page: Pointer to the page allocation. + * @order: Order of the allocation. + * + * This function is intended for kernel subsystems that cache page allocations + * to reuse them instead of freeing them back to page_alloc (e.g. mempool). + * + * This function is similar to kasan_mempool_poison_object() but operates on + * page allocations. + * + * Return: true if the allocation can be safely reused; false otherwise. + */ +static __always_inline bool kasan_mempool_poison_pages(struct page *page, + unsigned int order) +{ + if (kasan_enabled()) + return __kasan_mempool_poison_pages(page, order, _RET_IP_); + return true; +} + bool __kasan_mempool_poison_object(void *ptr, unsigned long ip); /** * kasan_mempool_poison_object - Check and poison a mempool slab allocation. @@ -326,6 +349,10 @@ static inline void *kasan_krealloc(const void *object, size_t new_size, { return (void *)object; } +static inline bool kasan_mempool_poison_pages(struct page *page, unsigned int order) +{ + return true; +} static inline bool kasan_mempool_poison_object(void *ptr) { return true; diff --git a/mm/kasan/common.c b/mm/kasan/common.c index 4b85d35bb8ab..b416f4c265a4 100644 --- a/mm/kasan/common.c +++ b/mm/kasan/common.c @@ -426,6 +426,29 @@ void * __must_check __kasan_krealloc(const void *object, size_t size, gfp_t flag return ____kasan_kmalloc(slab->slab_cache, object, size, flags); } +bool __kasan_mempool_poison_pages(struct page *page, unsigned int order, + unsigned long ip) +{ + unsigned long *ptr; + + if (unlikely(PageHighMem(page))) + return true; + + /* Bail out if allocation was excluded due to sampling. */ + if (!IS_ENABLED(CONFIG_KASAN_GENERIC) && + page_kasan_tag(page) == KASAN_TAG_KERNEL) + return true; + + ptr = page_address(page); + + if (check_page_allocation(ptr, ip)) + return false; + + kasan_poison(ptr, PAGE_SIZE << order, KASAN_PAGE_FREE, false); + + return true; +} + bool __kasan_mempool_poison_object(void *ptr, unsigned long ip) { struct folio *folio; From patchwork Tue Dec 19 22:28:51 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: andrey.konovalov@linux.dev X-Patchwork-Id: 13499300 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id 56AAEC41535 for ; Tue, 19 Dec 2023 22:30:22 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id EADA38D000A; Tue, 19 Dec 2023 17:30:21 -0500 (EST) Received: by kanga.kvack.org (Postfix, from userid 40) id E5DD98D0009; Tue, 19 Dec 2023 17:30:21 -0500 (EST) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id D269B8D000A; Tue, 19 Dec 2023 17:30:21 -0500 (EST) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0012.hostedemail.com [216.40.44.12]) by kanga.kvack.org (Postfix) with ESMTP id C2E0D8D0009 for ; Tue, 19 Dec 2023 17:30:21 -0500 (EST) Received: from smtpin09.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay04.hostedemail.com (Postfix) with ESMTP id 95D751A07EE for ; Tue, 19 Dec 2023 22:30:21 +0000 (UTC) X-FDA: 81585012642.09.377977B Received: from out-174.mta0.migadu.com (out-174.mta0.migadu.com [91.218.175.174]) by imf28.hostedemail.com (Postfix) with ESMTP id 14816C001A for ; Tue, 19 Dec 2023 22:30:19 +0000 (UTC) Authentication-Results: imf28.hostedemail.com; dkim=pass header.d=linux.dev header.s=key1 header.b=mmCEXgMa; spf=pass (imf28.hostedemail.com: domain of andrey.konovalov@linux.dev designates 91.218.175.174 as permitted sender) smtp.mailfrom=andrey.konovalov@linux.dev; dmarc=pass (policy=none) header.from=linux.dev ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1703025020; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references:dkim-signature; bh=WvnDVDl+9gd8JY/2icI2mu85dJxeSXpMDACLsdprvYg=; b=lRQEdqFOqiOyeHrrtJeYpQCdahmod/YGPL41+feMK8VCg3ySOeHpSSI6Cy5ydBksPFayjl H+WlwsSpF2M4JoyAnW7DuwxWf45iYAj8dOzrlhHEzNcScTg3J3KdCn6bD7Yv57hBFTT1iC PGFZ/rEZo6hfr/oxnVAHP1X4q9FXNZs= ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1703025020; a=rsa-sha256; cv=none; b=cthS6jHRh6BrnSor1EIGKB9okrlyNXAB3MqGcyRuJek4aDh0921IF8XZ9FU5/qvin+266Z QlwUqf7V43n+sxq+hIu0hM9WyvwLe9a0fU+xf18TUHppnCWcLnoi4vCe4w91B40uxg7+tb NdwXpjqkUFcw8ewcIominkfrywqgc6s= ARC-Authentication-Results: i=1; imf28.hostedemail.com; dkim=pass header.d=linux.dev header.s=key1 header.b=mmCEXgMa; spf=pass (imf28.hostedemail.com: domain of andrey.konovalov@linux.dev designates 91.218.175.174 as permitted sender) smtp.mailfrom=andrey.konovalov@linux.dev; dmarc=pass (policy=none) header.from=linux.dev X-Report-Abuse: Please report any abuse attempt to abuse@migadu.com and include these headers. DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linux.dev; s=key1; t=1703025018; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=WvnDVDl+9gd8JY/2icI2mu85dJxeSXpMDACLsdprvYg=; b=mmCEXgMaxz3LTDhN5Aelii+nb4wwQAwSPgj8RLHqQ7+wmGOwxjtSh8dT+vmH5EYV5C6oSg QM5LoKW2tweYqFLGq6U5930x/xHPsIBo/zhwS0iRxm/r+0RSCb6zBs2bH9dNdRzIbXalym qshEQaM+itGw4MLCZQr6zHqTS6ub/qA= From: andrey.konovalov@linux.dev To: Marco Elver , Alexander Potapenko Cc: Andrey Konovalov , Dmitry Vyukov , Andrey Ryabinin , kasan-dev@googlegroups.com, Evgenii Stepanov , Breno Leitao , Alexander Lobakin , Andrew Morton , linux-mm@kvack.org, linux-kernel@vger.kernel.org, Andrey Konovalov Subject: [PATCH mm 07/21] kasan: introduce kasan_mempool_unpoison_pages Date: Tue, 19 Dec 2023 23:28:51 +0100 Message-Id: <239bd9af6176f2cc59f5c25893eb36143184daff.1703024586.git.andreyknvl@google.com> In-Reply-To: References: MIME-Version: 1.0 X-Migadu-Flow: FLOW_OUT X-Stat-Signature: h8e8ncczaz968k9g4e39uz17gtxqbspf X-Rspamd-Server: rspam10 X-Rspamd-Queue-Id: 14816C001A X-Rspam-User: X-HE-Tag: 1703025019-527414 X-HE-Meta: U2FsdGVkX18EetFwCmI13Psq5mmrkh4mR11b21MGNN9gcwJ/eQJec96u6G5Q1lakUTGw/VxLcTw/5BJMSUcBO//xvdrIAVI4gmyrxxdwXnu6Y6uTrDFuePelVRaBHW/ITQGQzcqOVg5lqRpz+Aaut4H3J1Zye5ODeWIygXUVfXDUHPmABlWgx74N1TCFGT4rrYou1PyUHEhm7+ZGQPXUEXsYPn/7QrnbqiktDHx4ur6B8ZeyIlydff8JsB4lXxvhTv4A0FifcSpdhkVsUt77zjhAHZmzg4pjKZBDGTxCV7N1GKjxa7R7YeQ+6nj63vcaq0v58Q3aakUiYJRKrAeEx0dUCCm9SL2N320OoVEW+FO1XQKTLN0aSzBR2z8EJlRjGrLHODROMwT8Y77GwkQgUNMbLmK+J8ethToIAZxjZoobQcLmuUFgxyi1/uGGfgkbr7kLPdasgn7WAXHDL19Id1J+2INpwh7TXjZUqpc8jGpojnm0M0k9HTPbW4AQaRfr7NUXCJm0Pl3hxPdsabG1ANOuheCP+mWjf0F+A/wM0mio+ORokaCazSK0r708dqnoFbasj/FJejvVCB+e0V2tNp9QFSrsca1qfaCOenUrkhltCI/fYUGKZmy7B4HLPaMss7Gn90Nydzp9iN50j1pmIlY+/B50Ia0HRikv1cBRcoUtASiUOvRJ398Z1nhBtay3mKHs8HsFLtUJQ7hRvscjzTSh+IajXItqDgciJXHyZ0fh1QzSCBW2Qz/6i66JxPx2BGtG0JEdxT6UxhUc1D73Qiqru70lvDVtA5o5Da8NSdoSFntkQzS91UtqQtJdwgh6MHYHsC9l4vPK5kKIK0fg5B3Q1S6oOoSsnNf/XF7AqjBfYAXalxXPiIDlxxB0gqynO2XObFHQRAdd2MyB5zJNvChc9Q/DI52u7Zp5M0v7jbWyq9BqBmNRgPlldA90D7je5p8nml9wWaI= X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: List-Subscribe: List-Unsubscribe: From: Andrey Konovalov Introduce and document a new kasan_mempool_unpoison_pages hook to be used by the mempool code instead of kasan_unpoison_pages. This hook is not functionally different from kasan_unpoison_pages, but using it improves the mempool code readability. Signed-off-by: Andrey Konovalov --- include/linux/kasan.h | 25 +++++++++++++++++++++++++ mm/kasan/common.c | 6 ++++++ 2 files changed, 31 insertions(+) diff --git a/include/linux/kasan.h b/include/linux/kasan.h index de2a695ad34d..f8ebde384bd7 100644 --- a/include/linux/kasan.h +++ b/include/linux/kasan.h @@ -225,6 +225,9 @@ bool __kasan_mempool_poison_pages(struct page *page, unsigned int order, * This function is similar to kasan_mempool_poison_object() but operates on * page allocations. * + * Before the poisoned allocation can be reused, it must be unpoisoned via + * kasan_mempool_unpoison_pages(). + * * Return: true if the allocation can be safely reused; false otherwise. */ static __always_inline bool kasan_mempool_poison_pages(struct page *page, @@ -235,6 +238,27 @@ static __always_inline bool kasan_mempool_poison_pages(struct page *page, return true; } +void __kasan_mempool_unpoison_pages(struct page *page, unsigned int order, + unsigned long ip); +/** + * kasan_mempool_unpoison_pages - Unpoison a mempool page allocation. + * @page: Pointer to the page allocation. + * @order: Order of the allocation. + * + * This function is intended for kernel subsystems that cache page allocations + * to reuse them instead of freeing them back to page_alloc (e.g. mempool). + * + * This function unpoisons a page allocation that was previously poisoned by + * kasan_mempool_poison_pages() without zeroing the allocation's memory. For + * the tag-based modes, this function assigns a new tag to the allocation. + */ +static __always_inline void kasan_mempool_unpoison_pages(struct page *page, + unsigned int order) +{ + if (kasan_enabled()) + __kasan_mempool_unpoison_pages(page, order, _RET_IP_); +} + bool __kasan_mempool_poison_object(void *ptr, unsigned long ip); /** * kasan_mempool_poison_object - Check and poison a mempool slab allocation. @@ -353,6 +377,7 @@ static inline bool kasan_mempool_poison_pages(struct page *page, unsigned int or { return true; } +static inline void kasan_mempool_unpoison_pages(struct page *page, unsigned int order) {} static inline bool kasan_mempool_poison_object(void *ptr) { return true; diff --git a/mm/kasan/common.c b/mm/kasan/common.c index b416f4c265a4..7ebc001d0fcd 100644 --- a/mm/kasan/common.c +++ b/mm/kasan/common.c @@ -449,6 +449,12 @@ bool __kasan_mempool_poison_pages(struct page *page, unsigned int order, return true; } +void __kasan_mempool_unpoison_pages(struct page *page, unsigned int order, + unsigned long ip) +{ + __kasan_unpoison_pages(page, order, false); +} + bool __kasan_mempool_poison_object(void *ptr, unsigned long ip) { struct folio *folio; From patchwork Tue Dec 19 22:28:52 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: andrey.konovalov@linux.dev X-Patchwork-Id: 13499301 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id 3C996C46CCD for ; Tue, 19 Dec 2023 22:30:23 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id 9CE608D000B; Tue, 19 Dec 2023 17:30:22 -0500 (EST) Received: by kanga.kvack.org (Postfix, from userid 40) id 8E0D68D0009; Tue, 19 Dec 2023 17:30:22 -0500 (EST) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 781128D000B; Tue, 19 Dec 2023 17:30:22 -0500 (EST) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0016.hostedemail.com [216.40.44.16]) by kanga.kvack.org (Postfix) with ESMTP id 5F2D28D0009 for ; Tue, 19 Dec 2023 17:30:22 -0500 (EST) Received: from smtpin29.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay02.hostedemail.com (Postfix) with ESMTP id 2516012095D for ; Tue, 19 Dec 2023 22:30:22 +0000 (UTC) X-FDA: 81585012684.29.A803063 Received: from out-170.mta0.migadu.com (out-170.mta0.migadu.com [91.218.175.170]) by imf20.hostedemail.com (Postfix) with ESMTP id 661F31C002F for ; Tue, 19 Dec 2023 22:30:20 +0000 (UTC) Authentication-Results: imf20.hostedemail.com; dkim=pass header.d=linux.dev header.s=key1 header.b=aMTrQUR0; spf=pass (imf20.hostedemail.com: domain of andrey.konovalov@linux.dev designates 91.218.175.170 as permitted sender) smtp.mailfrom=andrey.konovalov@linux.dev; dmarc=pass (policy=none) header.from=linux.dev ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1703025020; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references:dkim-signature; bh=xReOl/oREsxJLQ8k6aIhVhARLuZMnM3hsCknlxTDelk=; b=w/v/DmigBUwrwUUScAXwczfCKn5efJ+dju0CSqWGwr3QD9p0J/xeB1mZ60jgOigbsxlN4I DqlOb09xLWZP/I/Jp+TOT2GYOvFtmXRJq7Z0vnU+jstF25im8MLaW3qYEoVI+79H5AIc4J c2smyOBccAiqIVYA+xNO0UcBBmv8uCE= ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1703025020; a=rsa-sha256; cv=none; b=Okop2RaXskWYX2Flp+mj9LjHBC8gCMbqMYIMAaOSGKFDWj92w0noD+H+V3B9VhQkpyQh4M 8TK+BgZqKyBfeDKLFKMabb8RVJpNBNezslejxaul3cDJHKx7FU1AevaWdkctujN3Lgijec 1NCgLbTNq69WiB/QJFWT6qto4VBqUd8= ARC-Authentication-Results: i=1; imf20.hostedemail.com; dkim=pass header.d=linux.dev header.s=key1 header.b=aMTrQUR0; spf=pass (imf20.hostedemail.com: domain of andrey.konovalov@linux.dev designates 91.218.175.170 as permitted sender) smtp.mailfrom=andrey.konovalov@linux.dev; dmarc=pass (policy=none) header.from=linux.dev X-Report-Abuse: Please report any abuse attempt to abuse@migadu.com and include these headers. DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linux.dev; s=key1; t=1703025019; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=xReOl/oREsxJLQ8k6aIhVhARLuZMnM3hsCknlxTDelk=; b=aMTrQUR0xLK7BplxYFtE4/Xbs25JDCetJWE5YR0p8XlsH+LA6uU4fkxqdQROa6y+LmxS6E H6/bMd8AJ43AJZtjVMsIrilr90PtruFOb4TzM1ChHIK5W2TnGpASFi8QvV447DisyRfhwH u+nqgpjQtRh+bJSPL6UUsX9RcwPAdbI= From: andrey.konovalov@linux.dev To: Marco Elver , Alexander Potapenko Cc: Andrey Konovalov , Dmitry Vyukov , Andrey Ryabinin , kasan-dev@googlegroups.com, Evgenii Stepanov , Breno Leitao , Alexander Lobakin , Andrew Morton , linux-mm@kvack.org, linux-kernel@vger.kernel.org, Andrey Konovalov Subject: [PATCH mm 08/21] kasan: clean up __kasan_mempool_poison_object Date: Tue, 19 Dec 2023 23:28:52 +0100 Message-Id: <4f6fc8840512286c1a96e16e86901082c671677d.1703024586.git.andreyknvl@google.com> In-Reply-To: References: MIME-Version: 1.0 X-Migadu-Flow: FLOW_OUT X-Rspamd-Queue-Id: 661F31C002F X-Rspam-User: X-Stat-Signature: mq1b8h9uz1qqz9rywcisazwj4ufiipn6 X-Rspamd-Server: rspam03 X-HE-Tag: 1703025020-986907 X-HE-Meta: U2FsdGVkX1+Y9YSFyUK5bo1UevsgYRWLtJHrByZCHI5f2y5eDKzMLkYW+AbcdtUJscuHR/dX/DnS2HBqT7nUvqDgBus6chXaG3UVEg5VrJ6Xs1H0ug75X5ru8O8WTYw6QvN+xTgALlYf9WIE62BqAV8JTpHgWIvEm6NouP5S4Ve13DmFq5rKc9c0t3MQ/DdDYPku08Msq1YZ49ykttFBPiAn6CdzgjfyW5hRu/o/ONGT7o3iQitB+2ck3HDxcz0gmrKOZ7nnsgXi98qYE8baUV/tMhCi2IpVOPCEQuUPqPaBfTOf0q5va0pXCatMJW7BgdohZ3sLOnuMIUzE6PiCk8rqSixRFhZO8P1Lh9LvUAzV7AY/fCMrwOLwFCMOuIbzPeKHTrH29D9xmhcpGho4LyaG3J9aZNjEtiDiR5vu4KnMpJqcTAokLiiJ7GR2iPUV6B5owCXUteDDlBojMkNSrdEDQ89SbO9t9lNb++6gmjo9hPCLcKg62VEDPpp4ov1q4tCK9njOoe74EEYj466IpE8aQ6+1LNrkLrQH5wlzJcLWIZ6nR7467eYbq32KaxC6nUg+0AgtIbesnySygTgAMt1LOozhvhQbHMtZM7ff16TziwGUpeZqB9VW0SPIsuRpksZtHIAVVIXSaB7VwQqNo5K9Vlas30vvOctneAMYNBqp8HyFPQ/1PDGVqIQ2vs/wdA0ykVvO1g3tjum2Cxh23/bTHCT5jcmmf7I5A018Rr6o4PAZcaM0q8h2Kt+7q9VFLPpj3xBlvX+mVyLxxogfiXgWyOMu892/kD8Ha/zsCoILr/Cly+M5TYAC0eBjsLLvSCNhJw0bPjAQgOqJXoqOdQTrwoVIvee/3ClazBsgs0Yp9GQHEi0AGLZpSchUJmrhCkhywmsPI1LateFZ2v35/7XQcJaINYJTWUt831O7mxouR6lCwjtSvhpAj437f5j83qeKE1sE4yNEnqKvBkU +lEJfHtu 9Fl/p4l5MbOBB6e9UB6XoMUjcODl59UIUhSM7hhOB32ZbuvSzHSKYIVzwtPRa6rxqSCmiYnXST8BoI9d0pjI23r8PP/2GyrDP9tBMjxBKfwSKrvU1DjfGPhZ3wwzlQ5VFVlyZdFU57FzBxsuL1i0qlZSOcPoouaV65C4HbJ/H4H1T13e/pXLrfpbupBF4L5jN2Sza+xHdx/Qaom56aj2U8noPsLwxMVuSJ6aJ X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: List-Subscribe: List-Unsubscribe: From: Andrey Konovalov Reorganize the code and reword the comment in __kasan_mempool_poison_object to improve the code readability. Signed-off-by: Andrey Konovalov --- mm/kasan/common.c | 19 +++++++------------ 1 file changed, 7 insertions(+), 12 deletions(-) diff --git a/mm/kasan/common.c b/mm/kasan/common.c index 7ebc001d0fcd..3f4a1ed69e03 100644 --- a/mm/kasan/common.c +++ b/mm/kasan/common.c @@ -457,27 +457,22 @@ void __kasan_mempool_unpoison_pages(struct page *page, unsigned int order, bool __kasan_mempool_poison_object(void *ptr, unsigned long ip) { - struct folio *folio; - - folio = virt_to_folio(ptr); + struct folio *folio = virt_to_folio(ptr); + struct slab *slab; /* - * Even though this function is only called for kmem_cache_alloc and - * kmalloc backed mempool allocations, those allocations can still be - * !PageSlab() when the size provided to kmalloc is larger than - * KMALLOC_MAX_SIZE, and kmalloc falls back onto page_alloc. + * This function can be called for large kmalloc allocation that get + * their memory from page_alloc. Thus, the folio might not be a slab. */ if (unlikely(!folio_test_slab(folio))) { if (check_page_allocation(ptr, ip)) return false; kasan_poison(ptr, folio_size(folio), KASAN_PAGE_FREE, false); return true; - } else { - struct slab *slab = folio_slab(folio); - - return !____kasan_slab_free(slab->slab_cache, ptr, ip, - false, false); } + + slab = folio_slab(folio); + return !____kasan_slab_free(slab->slab_cache, ptr, ip, false, false); } void __kasan_mempool_unpoison_object(void *ptr, size_t size, unsigned long ip) From patchwork Tue Dec 19 22:28:53 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: andrey.konovalov@linux.dev X-Patchwork-Id: 13499302 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id 33FACC46CD3 for ; Tue, 19 Dec 2023 22:30:25 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id 2C9068D000C; Tue, 19 Dec 2023 17:30:23 -0500 (EST) Received: by kanga.kvack.org (Postfix, from userid 40) id 202AD8D000D; Tue, 19 Dec 2023 17:30:23 -0500 (EST) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id EFA858D000C; Tue, 19 Dec 2023 17:30:22 -0500 (EST) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0013.hostedemail.com [216.40.44.13]) by kanga.kvack.org (Postfix) with ESMTP id E0FFF8D0009 for ; Tue, 19 Dec 2023 17:30:22 -0500 (EST) Received: from smtpin16.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay07.hostedemail.com (Postfix) with ESMTP id BB0771603B8 for ; Tue, 19 Dec 2023 22:30:22 +0000 (UTC) X-FDA: 81585012684.16.5AE7A1F Received: from out-170.mta0.migadu.com (out-170.mta0.migadu.com [91.218.175.170]) by imf12.hostedemail.com (Postfix) with ESMTP id EDE544001B for ; Tue, 19 Dec 2023 22:30:20 +0000 (UTC) Authentication-Results: imf12.hostedemail.com; dkim=pass header.d=linux.dev header.s=key1 header.b=TbFrSJjR; dmarc=pass (policy=none) header.from=linux.dev; spf=pass (imf12.hostedemail.com: domain of andrey.konovalov@linux.dev designates 91.218.175.170 as permitted sender) smtp.mailfrom=andrey.konovalov@linux.dev ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1703025021; a=rsa-sha256; cv=none; b=qOb00lI4iNoD6q7cFZvOURPxncZjvLTzPHK7XAvoRfLRuDMm+YUZOxh3nksQ0Y9HqsvrEO 3zEVN2rc99fnNVnzJYQz33Wth1q17mlvK9kYGEjkJAtcVOPnAP5FD5zqkmZ5WgDto9AskO HDtCOPRhVCROvmoqHHaa2i+N6Yjj3Bw= ARC-Authentication-Results: i=1; imf12.hostedemail.com; dkim=pass header.d=linux.dev header.s=key1 header.b=TbFrSJjR; dmarc=pass (policy=none) header.from=linux.dev; spf=pass (imf12.hostedemail.com: domain of andrey.konovalov@linux.dev designates 91.218.175.170 as permitted sender) smtp.mailfrom=andrey.konovalov@linux.dev ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1703025021; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references:dkim-signature; bh=hXURpFT5cXmxHd6E+IlRMk2ARDz23DTQrTWld5qdG1E=; b=aMZqFKPO5kez1TWgYm9hsQQe8Xh2J4S9bm2xAOUrzCUI2KBI1clvowz93H1e1OWmle4ufv 0R68muk5PKnhN93J4Su8Q/WfFE5hQXbCgffPLO+aPCXYZLJorSQA9mWzLxp5ZcECs6ShCg UTAD3vazBDjq6+y7kU4U2q134gz58QM= X-Report-Abuse: Please report any abuse attempt to abuse@migadu.com and include these headers. DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linux.dev; s=key1; t=1703025019; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=hXURpFT5cXmxHd6E+IlRMk2ARDz23DTQrTWld5qdG1E=; b=TbFrSJjRFEHr11m9ihb+YpF44WT4zDOU6SR/gpiWxNk2O2ewimYty9RDE8JeT2bHHQsmaJ 7iHSxvOfzi3HpU9gwdbmyAE7I1nnRqLM1ejSraTyzN977wLeS1qdGvxzBLEl1QotjPd3vl vMCPpPc3Z0zUFBC41bC95eXG8vcuwiQ= From: andrey.konovalov@linux.dev To: Marco Elver , Alexander Potapenko Cc: Andrey Konovalov , Dmitry Vyukov , Andrey Ryabinin , kasan-dev@googlegroups.com, Evgenii Stepanov , Breno Leitao , Alexander Lobakin , Andrew Morton , linux-mm@kvack.org, linux-kernel@vger.kernel.org, Andrey Konovalov Subject: [PATCH mm 09/21] kasan: save free stack traces for slab mempools Date: Tue, 19 Dec 2023 23:28:53 +0100 Message-Id: <413a7c7c3344fb56809853339ffaabc9e4905e94.1703024586.git.andreyknvl@google.com> In-Reply-To: References: MIME-Version: 1.0 X-Migadu-Flow: FLOW_OUT X-Rspam-User: X-Rspamd-Server: rspam06 X-Rspamd-Queue-Id: EDE544001B X-Stat-Signature: d7pnim8guxrcf9usei6b38mbtxk36xp6 X-HE-Tag: 1703025020-200606 X-HE-Meta: U2FsdGVkX1/ou4Tx4dL7y85txrf8iex9Uf84RzTdAm0OgmTyYcaJF7fomVeqCwz7tA7BWYH7JLgGgCH6zWVDCGmd5z7Mm6bemho/RVx0mMXAwTdvXxFPhwV4lltr6EB/+Rt/8Wegx84+HrRrBGkLZMsloViE/kafqtZR+7cwBsmpZfuJD05rolbJ9P5wzTkw+QO63l4+lCmsTc+3rHx6O7A6xscWStXpD7YR2dCjgcXEj5YZ+bap+u0rUilFMzre9h9gUZL2oJX5qZ50LhJYx7HxK9mN7K428dlVa0ZVuyDACs6wt3hlin92xr+eTKFSRODjaEru16uswAgrpWyd9HmHTFxWclW4AOy7m3dlZnYokKqwSQXv08Nqa7DEir3jOCPlWtgnuOaMpbkZW6ESmIhNjAQVNvpsywYcl5JtsH8o0lmVFMTYj9VFe5KNw2wZVW6g2hBbSw609TR2TIvEryQWTXyrvG0JgyDo8rQd9+2lz6wp337SI0i5pa91VPpoG3xiAIsbrzksOutbdnC1F6mECItdtgtYoMp9NQ9eqquKglvXlDd6F0baayPaQYw6D8o79hL1o9RYyVD7+ar5g3UOtF7ybreLovt9ow2O1hhBSowIY/Ru3xJQC86cLOjl7hJsgbW11g8YeqbVaaK4a1jWdrN7+Li3k0xbkGzr8EOObi9+3rBkKBDobAcHg8emhUcyV0PqVdNBVj0tCNxc97H1BAyT/XQeAFKLNRr42uvxHFT37dvZAtsVwSku1jUgJpH2oIiVqkodqZasLAQ8kGXsY012VT6ikWmv/svjGyqPhxLQn1Hbwuignj9cEPqnazUonWyyecpj/I/d1tPw2iIF1SpV+qkxb+YS+RmJFT8cSw3O5FohroPWr36wc8luwscXhnQLSlRcgyFwAQzUmFDEIq53ca3E3iteYrlpCpG/ldGcCRmgTruqNXffBCvzf0zfd88Hpvt8ZWBdKqu GMRLqz4r m6p1deUKIE9FFEByDRA63uBd/MDeduwJEFbAM8u0WRoqa+p1tE/c7FCePwEW+W3xafcwnZTzzqqgsUoRcj8UCm74tS1ygfmS25HFsHpgiTVg+q6PvOww7jvA23yOZ58dLk+//xdQzzBWvSnqhoF210fLXp3dxOhyu7oTW X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: List-Subscribe: List-Unsubscribe: From: Andrey Konovalov Make kasan_mempool_poison_object save free stack traces for slab and kmalloc mempools when the object is freed into the mempool. Also simplify and rename ____kasan_slab_free to poison_slab_object and do a few other reability changes. Signed-off-by: Andrey Konovalov --- include/linux/kasan.h | 5 +++-- mm/kasan/common.c | 20 +++++++++----------- 2 files changed, 12 insertions(+), 13 deletions(-) diff --git a/include/linux/kasan.h b/include/linux/kasan.h index f8ebde384bd7..e636a00e26ba 100644 --- a/include/linux/kasan.h +++ b/include/linux/kasan.h @@ -268,8 +268,9 @@ bool __kasan_mempool_poison_object(void *ptr, unsigned long ip); * to reuse them instead of freeing them back to the slab allocator (e.g. * mempool). * - * This function poisons a slab allocation without initializing its memory and - * without putting it into the quarantine (for the Generic mode). + * This function poisons a slab allocation and saves a free stack trace for it + * without initializing the allocation's memory and without putting it into the + * quarantine (for the Generic mode). * * This function also performs checks to detect double-free and invalid-free * bugs and reports them. The caller can use the return value of this function diff --git a/mm/kasan/common.c b/mm/kasan/common.c index 3f4a1ed69e03..59146886e57d 100644 --- a/mm/kasan/common.c +++ b/mm/kasan/common.c @@ -207,8 +207,8 @@ void * __must_check __kasan_init_slab_obj(struct kmem_cache *cache, return (void *)object; } -static inline bool ____kasan_slab_free(struct kmem_cache *cache, void *object, - unsigned long ip, bool quarantine, bool init) +static inline bool poison_slab_object(struct kmem_cache *cache, void *object, + unsigned long ip, bool init) { void *tagged_object; @@ -221,13 +221,12 @@ static inline bool ____kasan_slab_free(struct kmem_cache *cache, void *object, if (is_kfence_address(object)) return false; - if (unlikely(nearest_obj(cache, virt_to_slab(object), object) != - object)) { + if (unlikely(nearest_obj(cache, virt_to_slab(object), object) != object)) { kasan_report_invalid_free(tagged_object, ip, KASAN_REPORT_INVALID_FREE); return true; } - /* RCU slabs could be legally used after free within the RCU period */ + /* RCU slabs could be legally used after free within the RCU period. */ if (unlikely(cache->flags & SLAB_TYPESAFE_BY_RCU)) return false; @@ -239,19 +238,18 @@ static inline bool ____kasan_slab_free(struct kmem_cache *cache, void *object, kasan_poison(object, round_up(cache->object_size, KASAN_GRANULE_SIZE), KASAN_SLAB_FREE, init); - if ((IS_ENABLED(CONFIG_KASAN_GENERIC) && !quarantine)) - return false; - if (kasan_stack_collection_enabled()) kasan_save_free_info(cache, tagged_object); - return kasan_quarantine_put(cache, object); + return false; } bool __kasan_slab_free(struct kmem_cache *cache, void *object, unsigned long ip, bool init) { - return ____kasan_slab_free(cache, object, ip, true, init); + bool buggy_object = poison_slab_object(cache, object, ip, init); + + return buggy_object ? true : kasan_quarantine_put(cache, object); } static inline bool check_page_allocation(void *ptr, unsigned long ip) @@ -472,7 +470,7 @@ bool __kasan_mempool_poison_object(void *ptr, unsigned long ip) } slab = folio_slab(folio); - return !____kasan_slab_free(slab->slab_cache, ptr, ip, false, false); + return !poison_slab_object(slab->slab_cache, ptr, ip, false); } void __kasan_mempool_unpoison_object(void *ptr, size_t size, unsigned long ip) From patchwork Tue Dec 19 22:28:54 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: andrey.konovalov@linux.dev X-Patchwork-Id: 13499304 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id EE2E9C46CD3 for ; Tue, 19 Dec 2023 22:30:28 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id 22D858D000E; Tue, 19 Dec 2023 17:30:24 -0500 (EST) Received: by kanga.kvack.org (Postfix, from userid 40) id 167848D000D; Tue, 19 Dec 2023 17:30:24 -0500 (EST) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id F22878D000E; Tue, 19 Dec 2023 17:30:23 -0500 (EST) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0017.hostedemail.com [216.40.44.17]) by kanga.kvack.org (Postfix) with ESMTP id D71D28D000D for ; Tue, 19 Dec 2023 17:30:23 -0500 (EST) Received: from smtpin05.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay05.hostedemail.com (Postfix) with ESMTP id B386240381 for ; Tue, 19 Dec 2023 22:30:23 +0000 (UTC) X-FDA: 81585012726.05.BB1F1F7 Received: from out-186.mta0.migadu.com (out-186.mta0.migadu.com [91.218.175.186]) by imf02.hostedemail.com (Postfix) with ESMTP id 24DC68000B for ; Tue, 19 Dec 2023 22:30:21 +0000 (UTC) Authentication-Results: imf02.hostedemail.com; dkim=pass header.d=linux.dev header.s=key1 header.b=Ctrg2ZB1; dmarc=pass (policy=none) header.from=linux.dev; spf=pass (imf02.hostedemail.com: domain of andrey.konovalov@linux.dev designates 91.218.175.186 as permitted sender) smtp.mailfrom=andrey.konovalov@linux.dev ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1703025022; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references:dkim-signature; bh=TOZdtH5KljVO+QBwvb475Ri4NSt7i5y2rX8Y2gdn2wY=; b=t/HS4oIQbH3XOym53wAoqXN1VyCq/iaiopBLnRBfU8TFHbKq0qeBHWx3RXplB5+/MPBHC1 yFf2QuFlFuJfEy+JDjIgeBaex0oCg7smb5Rfvz6Rdre7lf9xiu0R7NmByWlbGiKKfTuGYF VnXu4Ep9wwTICYNOVQsjiB5FXVTbb2Y= ARC-Authentication-Results: i=1; imf02.hostedemail.com; dkim=pass header.d=linux.dev header.s=key1 header.b=Ctrg2ZB1; dmarc=pass (policy=none) header.from=linux.dev; spf=pass (imf02.hostedemail.com: domain of andrey.konovalov@linux.dev designates 91.218.175.186 as permitted sender) smtp.mailfrom=andrey.konovalov@linux.dev ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1703025022; a=rsa-sha256; cv=none; b=oqZ8Uyq28wWcHIsYL/hlqnz0m4atcURj/rGuVySsNoEFVMZ97sEypR+K26qcEBbJntIPvv VnbCr0vQyNLxS4mbi8xmgcYXuwAobed1jSEPyuD0dyk+DmVWs3rBuI5bP684LhWS5ZTHEy yy6s1eFWrPRJUXU/HGjJp94NdiBIRx0= X-Report-Abuse: Please report any abuse attempt to abuse@migadu.com and include these headers. DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linux.dev; s=key1; t=1703025020; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=TOZdtH5KljVO+QBwvb475Ri4NSt7i5y2rX8Y2gdn2wY=; b=Ctrg2ZB1vr09mQJDl/g4xpRjwYVqozqH5I/yyeUDJ9kKUUsjofuMXHKU5XEuSmxPXCR5w9 dDaoAQH0Z6U4wMeGi6PrDUTFdO+Rj/pE+kqT96iJ8qj/ZdT+fG6UmURjrqCkw90n3UvUpY cDiRSDo85Tluc4i4aNZ0g57lX0tLRX8= From: andrey.konovalov@linux.dev To: Marco Elver , Alexander Potapenko Cc: Andrey Konovalov , Dmitry Vyukov , Andrey Ryabinin , kasan-dev@googlegroups.com, Evgenii Stepanov , Breno Leitao , Alexander Lobakin , Andrew Morton , linux-mm@kvack.org, linux-kernel@vger.kernel.org, Andrey Konovalov Subject: [PATCH mm 10/21] kasan: clean up and rename ____kasan_kmalloc Date: Tue, 19 Dec 2023 23:28:54 +0100 Message-Id: <5881232ad357ec0d59a5b1aefd9e0673a386399a.1703024586.git.andreyknvl@google.com> In-Reply-To: References: MIME-Version: 1.0 X-Migadu-Flow: FLOW_OUT X-Rspamd-Server: rspam09 X-Rspamd-Queue-Id: 24DC68000B X-Stat-Signature: tfthqxqkp99nnrhmum4ke8feeti9dw4g X-Rspam-User: X-HE-Tag: 1703025021-362784 X-HE-Meta: U2FsdGVkX1994SoxPluNOWsUJoil+FcQtt/sZS16Hgi1k9BEzN8+14VensJ13KtQLs/NwFIn23ciVrroqgHOiWxqlgwh00NLnaQ4uCOo0W9zPR0uW+ANY63QOo1SpAM6doYxmKF5EWT1cEqw7jf5eSyoo8gsgIzdyUZoAvkJvcg9Wor/5QUva1BscDG3wNLxaRFECfq4PmTe6E0aQdr2gnPgW308MMqzd2XCnAy7CS35rl6fzHRoz1QL6lbjrVKEjgaGemSaKH60dPwgMm0b+35uFQ2hHhVgEYZYn5nWCxS7wCLCztzqU0mgFFzQT7CN0LB9TfoVGsvzfLYYoORH2UXx6aRHRzB9mjDL1oj6oaFkUFlHPGuvmEwkJglWUhnWj4n/AKqg7wXgkUtX6Zu9W/HaISruGtN5Te0yzdzgNmc02xMs34cXl6ayrYsoIApdoFf21Fb5Axovori3EL2tZXGbT9tAZ3PVQW2/DJpCLmo+bFQ/lNpP4qxzuNqY0qbR8LbEeLTIQ27330FW1qNK4eeXliQY84FEhAiCW0sd2YoDH5MS71NQ+Ws9py+yNS8EpqOQiMeXLYfqW0Bc2MbqiceJUfJJzf0M3/dVOeswm2rQYdh2tc+spcD34nBTs+4eGK7MsVNpu5rVggp6R5EVTm2U3NvpUNDlrdgnZ2NIjyeu2TGbTN0l5HzQYOgYqOWt59KQJMQBg6s9Ya01jRNza5DEvrKXLu2V1rkifVboT99zZgvwLjcTDy0akYeS92Wc/U1WESBVxqA22Sz4D8ngvqxQunw3R+f7UvAIVI4gacARH5OldqFmVaCHwnHw1rUdHy4abGt24owYUo6tyhONQ1uEGogwmSxNuznmbddRvlEf+xXhyhKtDTIMkKvP2AJqpKzK3VjLujv2MiID22x8yzcEjMaMBCp6xSHJ1VHFeAwMgsWpY8CWLb4mZcNcclDaYqN8yE3JbrM= X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: List-Subscribe: List-Unsubscribe: From: Andrey Konovalov Introduce a new poison_kmalloc_redzone helper function that poisons the redzone for kmalloc object. Drop the confusingly named ____kasan_kmalloc function and instead use poison_kmalloc_redzone along with the other required parts of ____kasan_kmalloc in the callers' code. This is a preparatory change for the following patches in this series. Signed-off-by: Andrey Konovalov --- mm/kasan/common.c | 42 ++++++++++++++++++++++-------------------- 1 file changed, 22 insertions(+), 20 deletions(-) diff --git a/mm/kasan/common.c b/mm/kasan/common.c index 59146886e57d..1217b260abc3 100644 --- a/mm/kasan/common.c +++ b/mm/kasan/common.c @@ -312,26 +312,12 @@ void * __must_check __kasan_slab_alloc(struct kmem_cache *cache, return tagged_object; } -static inline void *____kasan_kmalloc(struct kmem_cache *cache, +static inline void poison_kmalloc_redzone(struct kmem_cache *cache, const void *object, size_t size, gfp_t flags) { unsigned long redzone_start; unsigned long redzone_end; - if (gfpflags_allow_blocking(flags)) - kasan_quarantine_reduce(); - - if (unlikely(object == NULL)) - return NULL; - - if (is_kfence_address(kasan_reset_tag(object))) - return (void *)object; - - /* - * The object has already been unpoisoned by kasan_slab_alloc() for - * kmalloc() or by kasan_krealloc() for krealloc(). - */ - /* * The redzone has byte-level precision for the generic mode. * Partially poison the last object granule to cover the unaligned @@ -355,14 +341,25 @@ static inline void *____kasan_kmalloc(struct kmem_cache *cache, if (kasan_stack_collection_enabled() && is_kmalloc_cache(cache)) kasan_save_alloc_info(cache, (void *)object, flags); - /* Keep the tag that was set by kasan_slab_alloc(). */ - return (void *)object; } void * __must_check __kasan_kmalloc(struct kmem_cache *cache, const void *object, size_t size, gfp_t flags) { - return ____kasan_kmalloc(cache, object, size, flags); + if (gfpflags_allow_blocking(flags)) + kasan_quarantine_reduce(); + + if (unlikely(object == NULL)) + return NULL; + + if (is_kfence_address(kasan_reset_tag(object))) + return (void *)object; + + /* The object has already been unpoisoned by kasan_slab_alloc(). */ + poison_kmalloc_redzone(cache, object, size, flags); + + /* Keep the tag that was set by kasan_slab_alloc(). */ + return (void *)object; } EXPORT_SYMBOL(__kasan_kmalloc); @@ -408,6 +405,9 @@ void * __must_check __kasan_krealloc(const void *object, size_t size, gfp_t flag if (unlikely(object == ZERO_SIZE_PTR)) return (void *)object; + if (is_kfence_address(kasan_reset_tag(object))) + return (void *)object; + /* * Unpoison the object's data. * Part of it might already have been unpoisoned, but it's unknown @@ -420,8 +420,10 @@ void * __must_check __kasan_krealloc(const void *object, size_t size, gfp_t flag /* Piggy-back on kmalloc() instrumentation to poison the redzone. */ if (unlikely(!slab)) return __kasan_kmalloc_large(object, size, flags); - else - return ____kasan_kmalloc(slab->slab_cache, object, size, flags); + else { + poison_kmalloc_redzone(slab->slab_cache, object, size, flags); + return (void *)object; + } } bool __kasan_mempool_poison_pages(struct page *page, unsigned int order, From patchwork Tue Dec 19 22:28:55 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: andrey.konovalov@linux.dev X-Patchwork-Id: 13499305 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id 920EFC41535 for ; Tue, 19 Dec 2023 22:30:31 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id E8D008D000F; Tue, 19 Dec 2023 17:30:24 -0500 (EST) Received: by kanga.kvack.org (Postfix, from userid 40) id DC4408D000D; Tue, 19 Dec 2023 17:30:24 -0500 (EST) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id B784E8D000F; Tue, 19 Dec 2023 17:30:24 -0500 (EST) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0015.hostedemail.com [216.40.44.15]) by kanga.kvack.org (Postfix) with ESMTP id A55158D000D for ; Tue, 19 Dec 2023 17:30:24 -0500 (EST) Received: from smtpin23.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay01.hostedemail.com (Postfix) with ESMTP id 81F861C0CF7 for ; Tue, 19 Dec 2023 22:30:24 +0000 (UTC) X-FDA: 81585012768.23.D7B71C4 Received: from out-182.mta0.migadu.com (out-182.mta0.migadu.com [91.218.175.182]) by imf19.hostedemail.com (Postfix) with ESMTP id E30751A000A for ; Tue, 19 Dec 2023 22:30:22 +0000 (UTC) Authentication-Results: imf19.hostedemail.com; dkim=pass header.d=linux.dev header.s=key1 header.b=SkAJqCw+; spf=pass (imf19.hostedemail.com: domain of andrey.konovalov@linux.dev designates 91.218.175.182 as permitted sender) smtp.mailfrom=andrey.konovalov@linux.dev; dmarc=pass (policy=none) header.from=linux.dev ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1703025023; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references:dkim-signature; bh=+EoZxIVuEAKv7x5FH4zs492QikDHeQQIvGcyYCPoQRk=; b=0apfdUurSAfJAh81nnw2y7+Xdw3Tkq7+USExYW5l0kskG54ppG0R/mQufV4mSHeYXNSls/ NpU1XSkNJwHL13UDrigwICigMo5Fo1mJoCvB4XJQxO6Rs5/6cBnPMogmNdopiNyp0jv4xq iET3JOm6AWRrbkd4mweHzIEI2bbHTiQ= ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1703025023; a=rsa-sha256; cv=none; b=gKZKGC19ykGQOzEksE/adD1XODbfcCD1wf644rySyh+jfSM6fyrI+/1LWm/Z//8ZUCwdpk MHVPELrjKBYdTEhj5vtsyxBW7cBeZHMf78X8RXfSB6lb2cOOZi5XalhhXi2FmQPsKCTllc HPWeIrHSO4K6ykvrz+JTnXkZK+MYeVs= ARC-Authentication-Results: i=1; imf19.hostedemail.com; dkim=pass header.d=linux.dev header.s=key1 header.b=SkAJqCw+; spf=pass (imf19.hostedemail.com: domain of andrey.konovalov@linux.dev designates 91.218.175.182 as permitted sender) smtp.mailfrom=andrey.konovalov@linux.dev; dmarc=pass (policy=none) header.from=linux.dev X-Report-Abuse: Please report any abuse attempt to abuse@migadu.com and include these headers. DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linux.dev; s=key1; t=1703025021; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=+EoZxIVuEAKv7x5FH4zs492QikDHeQQIvGcyYCPoQRk=; b=SkAJqCw+CpgpYcxkKbpNsgiVRs3jZsJLDCK6h/+n2tye0d1nsMHpkQEKaGwzu+Y3ortVD6 2V4tHBKknFNLP7uf44CoMBA1yfnNNq11AYTUObnX7PBrHpXsVtYRLuuPg5ub4gL7k2ldkm fH/a/eow85Q+6vMR0kRodOwNov6scpA= From: andrey.konovalov@linux.dev To: Marco Elver , Alexander Potapenko Cc: Andrey Konovalov , Dmitry Vyukov , Andrey Ryabinin , kasan-dev@googlegroups.com, Evgenii Stepanov , Breno Leitao , Alexander Lobakin , Andrew Morton , linux-mm@kvack.org, linux-kernel@vger.kernel.org, Andrey Konovalov Subject: [PATCH mm 11/21] kasan: introduce poison_kmalloc_large_redzone Date: Tue, 19 Dec 2023 23:28:55 +0100 Message-Id: <93317097b668519d76097fb065201b2027436e22.1703024586.git.andreyknvl@google.com> In-Reply-To: References: MIME-Version: 1.0 X-Migadu-Flow: FLOW_OUT X-Rspamd-Queue-Id: E30751A000A X-Rspam-User: X-Rspamd-Server: rspam11 X-Stat-Signature: gxzypdqium5eyixsfz7q1wrrwsjrf7j6 X-HE-Tag: 1703025022-287385 X-HE-Meta: U2FsdGVkX1/yQCNGdIRktSmxD+tLDruiZtwH+Is+Lm9nm3F/DKkQzmo3hkzhkqRn2HWlmlrAL5G3Umkoy5f4lvDbakAtjw5EoMRR7KN+Yw3/edyE/Bqk22Caz2c/NDEsczVbqWa+/Ap5SYXjKJws2+E5r3vw/xA0FNMyuiG0BaQbxPfd0VxlUACbAvaqSlGGUmwRYNQfbsm0sZuzv53Bk2b3U4q+NuvvnxZo53S51VUyVDGSvUQsPRTyJxV6pUx6xO++CADMS+gvq4ix9WJa0rIT8bcIxICg3AW1U6XodHZGXPGp/4ZdZJ5vnmkHgoNc8SPlvM2OZUiYeCNbfsp4efCtEtypb61iG88h8cIZa2pl5pmocfM6twVzGLMN78FOsuoylGArhMnUz9Oow7bk8hsrayfuzaVtepuKp5fJOunc+TidgjFreQ7huV4oIAOew7hviruCh3paXBhbJlorFLuMZ9jYde3+Q5vnqGBy+isPkDrjoz4FCdt3b7WyPOnsRLQ2YaXPUzYjKQSgX/mub/FSGxgbnE4HeQCveaxyElZM4xK9YO/ChrBd99nMUM8SDlk+3+gG5xu5k2ywoRi6giUnzPKvqL4aiL9Iu0my/niXPiWxFwTikdSga+fQdRnmM+A+OIg/ggilT1UFUD6hLUQ3C3OtSGnMgA+7b3Bij83yguVnZt/UvDmAkg294heURssJM63Z+Qr+aX69/28uyaWgdFF+lGS+i6Zj7rO3AivkEWjLshCp1rfENANrQsiZwh1t7j6dhbSpfpI0FNbNTcbRmEbd5JEwgKVObfjrE97uz/By5kBw9oveQLDbm8J/j4D1xb8lnMUS7rFqZ3UZFTa07tGFDQ0iIoSgNdgA2bJtWzlDND1Az/Owm0CZKbWnFFzVnNFrhqTV2b25sVFRCifNAyH58pGJPoVDaslIvqRfQWeG/DKOsr0K+POOTtbzSZxVmxY9ErQ= X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: List-Subscribe: List-Unsubscribe: From: Andrey Konovalov Split out a poison_kmalloc_large_redzone helper from __kasan_kmalloc_large and use it in the caller's code. This is a preparatory change for the following patches in this series. Signed-off-by: Andrey Konovalov --- mm/kasan/common.c | 41 +++++++++++++++++++++++------------------ 1 file changed, 23 insertions(+), 18 deletions(-) diff --git a/mm/kasan/common.c b/mm/kasan/common.c index 1217b260abc3..962805bf5f62 100644 --- a/mm/kasan/common.c +++ b/mm/kasan/common.c @@ -363,23 +363,12 @@ void * __must_check __kasan_kmalloc(struct kmem_cache *cache, const void *object } EXPORT_SYMBOL(__kasan_kmalloc); -void * __must_check __kasan_kmalloc_large(const void *ptr, size_t size, +static inline void poison_kmalloc_large_redzone(const void *ptr, size_t size, gfp_t flags) { unsigned long redzone_start; unsigned long redzone_end; - if (gfpflags_allow_blocking(flags)) - kasan_quarantine_reduce(); - - if (unlikely(ptr == NULL)) - return NULL; - - /* - * The object has already been unpoisoned by kasan_unpoison_pages() for - * alloc_pages() or by kasan_krealloc() for krealloc(). - */ - /* * The redzone has byte-level precision for the generic mode. * Partially poison the last object granule to cover the unaligned @@ -389,12 +378,25 @@ void * __must_check __kasan_kmalloc_large(const void *ptr, size_t size, kasan_poison_last_granule(ptr, size); /* Poison the aligned part of the redzone. */ - redzone_start = round_up((unsigned long)(ptr + size), - KASAN_GRANULE_SIZE); + redzone_start = round_up((unsigned long)(ptr + size), KASAN_GRANULE_SIZE); redzone_end = (unsigned long)ptr + page_size(virt_to_page(ptr)); kasan_poison((void *)redzone_start, redzone_end - redzone_start, KASAN_PAGE_REDZONE, false); +} +void * __must_check __kasan_kmalloc_large(const void *ptr, size_t size, + gfp_t flags) +{ + if (gfpflags_allow_blocking(flags)) + kasan_quarantine_reduce(); + + if (unlikely(ptr == NULL)) + return NULL; + + /* The object has already been unpoisoned by kasan_unpoison_pages(). */ + poison_kmalloc_large_redzone(ptr, size, flags); + + /* Keep the tag that was set by alloc_pages(). */ return (void *)ptr; } @@ -402,6 +404,9 @@ void * __must_check __kasan_krealloc(const void *object, size_t size, gfp_t flag { struct slab *slab; + if (gfpflags_allow_blocking(flags)) + kasan_quarantine_reduce(); + if (unlikely(object == ZERO_SIZE_PTR)) return (void *)object; @@ -419,11 +424,11 @@ void * __must_check __kasan_krealloc(const void *object, size_t size, gfp_t flag /* Piggy-back on kmalloc() instrumentation to poison the redzone. */ if (unlikely(!slab)) - return __kasan_kmalloc_large(object, size, flags); - else { + poison_kmalloc_large_redzone(object, size, flags); + else poison_kmalloc_redzone(slab->slab_cache, object, size, flags); - return (void *)object; - } + + return (void *)object; } bool __kasan_mempool_poison_pages(struct page *page, unsigned int order, From patchwork Tue Dec 19 22:28:56 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: andrey.konovalov@linux.dev X-Patchwork-Id: 13499306 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id 9B5F8C41535 for ; Tue, 19 Dec 2023 22:31:27 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id 3B22B6B0092; Tue, 19 Dec 2023 17:31:27 -0500 (EST) Received: by kanga.kvack.org (Postfix, from userid 40) id 362298D0010; Tue, 19 Dec 2023 17:31:27 -0500 (EST) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 22A148D000D; Tue, 19 Dec 2023 17:31:27 -0500 (EST) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0010.hostedemail.com [216.40.44.10]) by kanga.kvack.org (Postfix) with ESMTP id 0D0C76B0092 for ; Tue, 19 Dec 2023 17:31:27 -0500 (EST) Received: from smtpin19.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay03.hostedemail.com (Postfix) with ESMTP id CF87FA021D for ; Tue, 19 Dec 2023 22:31:26 +0000 (UTC) X-FDA: 81585015372.19.780C1C8 Received: from out-178.mta0.migadu.com (out-178.mta0.migadu.com [91.218.175.178]) by imf12.hostedemail.com (Postfix) with ESMTP id D11BF40023 for ; Tue, 19 Dec 2023 22:31:24 +0000 (UTC) Authentication-Results: imf12.hostedemail.com; dkim=pass header.d=linux.dev header.s=key1 header.b=r2ZaOIS6; spf=pass (imf12.hostedemail.com: domain of andrey.konovalov@linux.dev designates 91.218.175.178 as permitted sender) smtp.mailfrom=andrey.konovalov@linux.dev; dmarc=pass (policy=none) header.from=linux.dev ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1703025085; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references:dkim-signature; bh=g+O4MJvijsH/fxNfhEtO0ZT1bhv1NQvjMHnoD8zQplM=; b=u2cOhh8NqwgRBZXlhEt2aI/Svnz/LIhf/uZUvYtr6H6QbAqqXu3IBxwS8VBJNDt92vQ8Vk nib1BCBaP+m+LMCbP8q762BkHiIBLKEGBaDj2UKCQRsermsRpbF/0wnue5evR0e/ymsvjJ ISsIeb6l0bZ8o5DgbxvRdS0nV8BNi1k= ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1703025085; a=rsa-sha256; cv=none; b=ksogYZRmQEAbLK42g35eIzpvzgNI6r1Sy/jYNEJ59rNVfupiTmD0YLQIj9l5qw4gddOmhS 3f0etQkWXyiAAhTtfyI6Em68ufxNk751J77kDx69qUdQHo/Li2dd3guh+Imhuwt1VGRWyh OqeCIJVj+x6EXdv39pdifAcybbNK3h8= ARC-Authentication-Results: i=1; imf12.hostedemail.com; dkim=pass header.d=linux.dev header.s=key1 header.b=r2ZaOIS6; spf=pass (imf12.hostedemail.com: domain of andrey.konovalov@linux.dev designates 91.218.175.178 as permitted sender) smtp.mailfrom=andrey.konovalov@linux.dev; dmarc=pass (policy=none) header.from=linux.dev X-Report-Abuse: Please report any abuse attempt to abuse@migadu.com and include these headers. DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linux.dev; s=key1; t=1703025083; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=g+O4MJvijsH/fxNfhEtO0ZT1bhv1NQvjMHnoD8zQplM=; b=r2ZaOIS6ZMwbcRwAxJW59qk9nmH2ETUbfqjNUSa+35AQ7mxBRhFueCynEMDfgvcNnxrrtH sElLzMZVBT/HNZgRFD9eQQjvBsU+nFyNWnkw46nJ6bBbaBE5Zd1NMueq/it/uzQfhtXh75 B0otrG1zpXfsZNehE7M3FBuN9mYYkzY= From: andrey.konovalov@linux.dev To: Marco Elver , Alexander Potapenko Cc: Andrey Konovalov , Dmitry Vyukov , Andrey Ryabinin , kasan-dev@googlegroups.com, Evgenii Stepanov , Breno Leitao , Alexander Lobakin , Andrew Morton , linux-mm@kvack.org, linux-kernel@vger.kernel.org, Andrey Konovalov Subject: [PATCH mm 12/21] kasan: save alloc stack traces for mempool Date: Tue, 19 Dec 2023 23:28:56 +0100 Message-Id: <05ad235da8347cfe14d496d01b2aaf074b4f607c.1703024586.git.andreyknvl@google.com> In-Reply-To: References: MIME-Version: 1.0 X-Migadu-Flow: FLOW_OUT X-Rspamd-Queue-Id: D11BF40023 X-Rspam-User: X-Rspamd-Server: rspam11 X-Stat-Signature: ac3y9bhj83yyumettk5rxxqeub4d4zof X-HE-Tag: 1703025084-164221 X-HE-Meta: U2FsdGVkX1+TScNZoW6x+PXOq2TUQQZppUc7qBARq2Gh6/6si5XFSaVE0kLHI3YR0AwYmDKVEyheo2zVyQV/aWuqL+GJnSTyhXIAURbzb++YD7xkO/nXKiY48KDt2gUbIV7UQEbGmdAfImPqakPgB51iGYHbIguq8ZG8K+veMTiyQXCxlXnNqYtJvGa2AQZzOkRUr4ChM0sXmawSf2thlIqzyOV2+0rP92pY1FmeH3uzDngO4hyRh5k3xvQTFoBrk/rJlnq8EtIisqA2XVs37SWWojK5crLJmsNgnDApe2wtmTcuQCGp8kjg1X508tTJD5Tdd4x+NM5yemOVkM2H+JNJMeTT2tPo9jGO2xK6Bp456WCmKT7WGBCN4zyNMELEt7mVmnJMGeUN8Lv06gdaqEuavaUXsDdLGNPaSwbKq7OSYd834/K0fovJKdUi5sxhm/aRHD/7WYei94N+s9dLoOl59ae024l8tng7lKB/tHbOFwB7nNJgCqHhOciwyg+1xYM8C35GHV06YsUrUYCwwCrkroEcDWxlzk0ur1z0FRxd3Hu9HPk1e6gTlc9pmKRUgUk7LVIrIih7EvHkT6tWqK4R/nHoAQ2MPOrrOvKUg0N3nGXEQp70DjjuxgHJeI67uiytAIHsv2M3Nlb0rJVgN1GJtsYAB4VBcWSwzzDDsUdAPFALq+wMKinQIYJH6b7CanfbwBYMG+UJsD4Xzr+V+ukATvVkNzv7NbzZtaP001wZqa1t1eopXC6DZLehM6WDgjhpdiRGmyRQ0J706SepvKnhLgNTohuo0yMPgz3d3oln2iHOHVn5e3l7owTeNP8soFP0M/48pcdKdMwpGzblH0fuqpWcbNJt/amN/ngeLiuG3yErZOIJjqEx+bx7oIPeGvuzrOUHJKdnvTB1lE8+r/qzxd/VQViX4201hp8F3KwQd+5eZwLMrPTpIQ63zx1oqDNrogX33JwPtzWfrw2 U6MYmh+m CXt2PvaYGkaSi9EBFOHyFIoZB45B4BqSriMq+ZqamnNizj58CSYosqyl3fHygxESm+r3XL2jd+Ort3W+947FQYaHHV/spgcelzgXCFuwaOAwqNiWi5OK49K0Zd7DP1cNafS2LU56i+XFgQjECox7BaJbwktfDUjm1JH3WfduukK077D8= X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: List-Subscribe: List-Unsubscribe: From: Andrey Konovalov Update kasan_mempool_unpoison_object to properly poison the redzone and save alloc strack traces for kmalloc and slab pools. As a part of this change, split out and use a unpoison_slab_object helper function from __kasan_slab_alloc. Signed-off-by: Andrey Konovalov --- include/linux/kasan.h | 7 +++--- mm/kasan/common.c | 50 ++++++++++++++++++++++++++++++++++--------- 2 files changed, 44 insertions(+), 13 deletions(-) diff --git a/include/linux/kasan.h b/include/linux/kasan.h index e636a00e26ba..7392c5d89b92 100644 --- a/include/linux/kasan.h +++ b/include/linux/kasan.h @@ -303,9 +303,10 @@ void __kasan_mempool_unpoison_object(void *ptr, size_t size, unsigned long ip); * mempool). * * This function unpoisons a slab allocation that was previously poisoned via - * kasan_mempool_poison_object() without initializing its memory. For the - * tag-based modes, this function does not assign a new tag to the allocation - * and instead restores the original tags based on the pointer value. + * kasan_mempool_poison_object() and saves an alloc stack trace for it without + * initializing the allocation's memory. For the tag-based modes, this function + * does not assign a new tag to the allocation and instead restores the + * original tags based on the pointer value. * * This function operates on all slab allocations including large kmalloc * allocations (the ones returned by kmalloc_large() or by kmalloc() with the diff --git a/mm/kasan/common.c b/mm/kasan/common.c index 962805bf5f62..b8e7416f83af 100644 --- a/mm/kasan/common.c +++ b/mm/kasan/common.c @@ -277,6 +277,20 @@ void __kasan_kfree_large(void *ptr, unsigned long ip) /* The object will be poisoned by kasan_poison_pages(). */ } +void unpoison_slab_object(struct kmem_cache *cache, void *object, gfp_t flags, + bool init) +{ + /* + * Unpoison the whole object. For kmalloc() allocations, + * poison_kmalloc_redzone() will do precise poisoning. + */ + kasan_unpoison(object, cache->object_size, init); + + /* Save alloc info (if possible) for non-kmalloc() allocations. */ + if (kasan_stack_collection_enabled() && !is_kmalloc_cache(cache)) + kasan_save_alloc_info(cache, object, flags); +} + void * __must_check __kasan_slab_alloc(struct kmem_cache *cache, void *object, gfp_t flags, bool init) { @@ -299,15 +313,8 @@ void * __must_check __kasan_slab_alloc(struct kmem_cache *cache, tag = assign_tag(cache, object, false); tagged_object = set_tag(object, tag); - /* - * Unpoison the whole object. - * For kmalloc() allocations, kasan_kmalloc() will do precise poisoning. - */ - kasan_unpoison(tagged_object, cache->object_size, init); - - /* Save alloc info (if possible) for non-kmalloc() allocations. */ - if (kasan_stack_collection_enabled() && !is_kmalloc_cache(cache)) - kasan_save_alloc_info(cache, tagged_object, flags); + /* Unpoison the object and save alloc info for non-kmalloc() allocations. */ + unpoison_slab_object(cache, tagged_object, flags, init); return tagged_object; } @@ -482,7 +489,30 @@ bool __kasan_mempool_poison_object(void *ptr, unsigned long ip) void __kasan_mempool_unpoison_object(void *ptr, size_t size, unsigned long ip) { - kasan_unpoison(ptr, size, false); + struct slab *slab; + gfp_t flags = 0; /* Might be executing under a lock. */ + + if (is_kfence_address(kasan_reset_tag(ptr))) + return; + + slab = virt_to_slab(ptr); + + /* + * This function can be called for large kmalloc allocation that get + * their memory from page_alloc. + */ + if (unlikely(!slab)) { + kasan_unpoison(ptr, size, false); + poison_kmalloc_large_redzone(ptr, size, flags); + return; + } + + /* Unpoison the object and save alloc info for non-kmalloc() allocations. */ + unpoison_slab_object(slab->slab_cache, ptr, size, flags); + + /* Poison the redzone and save alloc info for kmalloc() allocations. */ + if (is_kmalloc_cache(slab->slab_cache)) + poison_kmalloc_redzone(slab->slab_cache, ptr, size, flags); } bool __kasan_check_byte(const void *address, unsigned long ip) From patchwork Tue Dec 19 22:28:57 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: andrey.konovalov@linux.dev X-Patchwork-Id: 13499307 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id CDE2AC46CD3 for ; Tue, 19 Dec 2023 22:31:28 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id 9A73F8D0010; Tue, 19 Dec 2023 17:31:27 -0500 (EST) Received: by kanga.kvack.org (Postfix, from userid 40) id 9555F8D000D; Tue, 19 Dec 2023 17:31:27 -0500 (EST) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 7F7378D0010; Tue, 19 Dec 2023 17:31:27 -0500 (EST) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0015.hostedemail.com [216.40.44.15]) by kanga.kvack.org (Postfix) with ESMTP id 6B4A78D000D for ; Tue, 19 Dec 2023 17:31:27 -0500 (EST) Received: from smtpin21.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay05.hostedemail.com (Postfix) with ESMTP id 2437B402FF for ; Tue, 19 Dec 2023 22:31:27 +0000 (UTC) X-FDA: 81585015414.21.093876E Received: from out-174.mta0.migadu.com (out-174.mta0.migadu.com [91.218.175.174]) by imf18.hostedemail.com (Postfix) with ESMTP id 5B0861C0025 for ; Tue, 19 Dec 2023 22:31:25 +0000 (UTC) Authentication-Results: imf18.hostedemail.com; dkim=pass header.d=linux.dev header.s=key1 header.b=Kt1rNfuv; spf=pass (imf18.hostedemail.com: domain of andrey.konovalov@linux.dev designates 91.218.175.174 as permitted sender) smtp.mailfrom=andrey.konovalov@linux.dev; dmarc=pass (policy=none) header.from=linux.dev ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1703025085; a=rsa-sha256; cv=none; b=O9HQfOniKjcpnwCwAktcln9ekAIFPFROQyVXAGBGAtmld5Sl712gfebxDJOmZMH2W8lnvH 0Uce7Bb8I2ac4d96kNjNGV3IfFjPwpEYbxR5AsNSER42cFEZCMguYhol+MWxxuCsqAp8s6 woWhE6vq8E4WD3Bumd8Tnl65ua7uFFk= ARC-Authentication-Results: i=1; imf18.hostedemail.com; dkim=pass header.d=linux.dev header.s=key1 header.b=Kt1rNfuv; spf=pass (imf18.hostedemail.com: domain of andrey.konovalov@linux.dev designates 91.218.175.174 as permitted sender) smtp.mailfrom=andrey.konovalov@linux.dev; dmarc=pass (policy=none) header.from=linux.dev ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1703025085; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references:dkim-signature; bh=KVsX1wYh/u3bsgXc0v6541Y+g0kgoewEBIuD2sVrVOE=; b=MY8eQkRL4o1nYPOeEJhkAM/+ZqHd3VUA1wgt24mNTAARCCcTIRwSWlk/j7ucQzDY+GtrNN OcItTZ4fnIyqibscFAlfQJ7KSqS1J0jnrWa2T7WcRk+SUzHYxtzpl3IcV39uwXaJyBzaen IgU26IVcrGRbSsT2z+n76krKfLxPSCA= X-Report-Abuse: Please report any abuse attempt to abuse@migadu.com and include these headers. DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linux.dev; s=key1; t=1703025084; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=KVsX1wYh/u3bsgXc0v6541Y+g0kgoewEBIuD2sVrVOE=; b=Kt1rNfuvx7+wT5H8UNOgwHCeTbOEvaDygKRpZZi3u1FYmus+bD/11ubTVW79B+oIdiaNwz JlwOYJnlQA+xJy+dqmZh3LmC25rgn5CNTohHAkyMco9Blc+/P3IIuddLLDTvM6CJy8A9+O KeuWbai25yfJ/zAiqqyvZxcC5VTNrDs= From: andrey.konovalov@linux.dev To: Marco Elver , Alexander Potapenko Cc: Andrey Konovalov , Dmitry Vyukov , Andrey Ryabinin , kasan-dev@googlegroups.com, Evgenii Stepanov , Breno Leitao , Alexander Lobakin , Andrew Morton , linux-mm@kvack.org, linux-kernel@vger.kernel.org, Andrey Konovalov Subject: [PATCH mm 13/21] mempool: skip slub_debug poisoning when KASAN is enabled Date: Tue, 19 Dec 2023 23:28:57 +0100 Message-Id: <98a4b1617e8ceeb266ef9a46f5e8c7f67a563ad2.1703024586.git.andreyknvl@google.com> In-Reply-To: References: MIME-Version: 1.0 X-Migadu-Flow: FLOW_OUT X-Rspamd-Server: rspam08 X-Rspamd-Queue-Id: 5B0861C0025 X-Stat-Signature: eo6zudjx93qkgtao8fa9n9t7hjzwhcsw X-Rspam-User: X-HE-Tag: 1703025085-851281 X-HE-Meta: U2FsdGVkX19bIT8z9ysyFEEGxMdidQlzZEgb9BHu9mHBH/uy5G+KWujCJVzr5q79WpvN1rpNXTrrTywo+sM8kOPdUPPOX494qped6rByFEGDojZGXJrLmLYMz0Ev3GuVaRtWNy4Gp/hkmJ2cK26sm9uA5/52+cQfNkzdJtbDqpK2PGPaF7kE1djvxGbaoVJI0zhJ1PWOVFeoHyXggcX1K6vZg8I0kN6IuGu0uLFxNm8g4cJf/9MRkckgZW7TXm82opENXJR8xb7XkBXXQcIgMGHVrJw49Art/l5VdOQBJdlI2TkqIKNc5bmvJIqjkfFEfOtAnDt+/IsQSQscDvzmcvh2VICAZxXtBc0rFAnwBPRE+7tx6e1NJ7rIF8cPXkycCJYCJFim2oFbbHYXqFt5T3fcE5GEcTFvchYE+nYMVNk1X2w//nE1EN/kZ1oBwwKXL03+O5bSq6BC7z87gAclcCkkyGRlMWGqqzCk5M93BkJ+2/xXCNb9To+pYb+aFfdUH5KmKKUDw4GnkThoyI3l0KHvT5l/nTAd81pynlDl0b2O42C7QBj9NEomoliUPdtEp5mZi6SWwYzG3qeCSUT6Sx77yAJRaWa/j94Zl/8KcLjHk6gVeVUTP9tVc5Zihx1nBvLr4ixG9j5LTkOPu0N8YILNNP9AxOxzGv2KhrZJ8xY+QDJ0guHL6haB5hZ0F/YdQRjFM2e4TX7Taxcra4g/BoNune2lOoh7bYKNhfpcZ4QEWD1GaSIqgw+J2zVBOUUwoHHtywUSFJkg1KOBaO52Zw94U38i4pT3P4JtHIoJlpaCvPTjGlTKmCLsP7cy1jqKgw73lCoVRGqtma+B/qEd3ksTMYe1N4A6sWQ6qVvJm7hSrm6w/cQB3+tImsvCij91AcUbkS47L/KfaFKQiP3KRAZUk1xbpBYmqMY3U8SxqVwdif1aCU4wZb6w2mhlPjfnfyJVi2orw2e5FIb3F5W car26xPa 2qK2QrU8xzsY6HvoNsn+9nVAU0k+6XsIK0i4YeOdTlUxp+GUJuyVJeoNkyrPUT5svKqOl0Uy411Yb0p1E5ELrEaQH7OckAj2nLXUxY6EYnw/CB4Eq36AV39sHD/cbigXeM6rkKm1GzrMBWsjgMiHrtfe8BFcicHbmWVP0/hHQVr56+KbtxlxpsNEAhFUGcVK+eacUp+3w2FTKMTmrGdHD+x2D3A== X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: List-Subscribe: List-Unsubscribe: From: Andrey Konovalov With the changes in the following patch, KASAN starts saving its metadata within freed mempool elements. Thus, skip slub_debug poisoning and checking of mempool elements when KASAN is enabled. Corruptions of freed mempool elements will be detected by KASAN anyway. Signed-off-by: Andrey Konovalov --- Changes RFC->v1: - This is a new patch. --- mm/mempool.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/mm/mempool.c b/mm/mempool.c index 7e1c729f292b..1fd39478c85e 100644 --- a/mm/mempool.c +++ b/mm/mempool.c @@ -56,6 +56,10 @@ static void __check_element(mempool_t *pool, void *element, size_t size) static void check_element(mempool_t *pool, void *element) { + /* Skip checking: KASAN might save its metadata in the element. */ + if (kasan_enabled()) + return; + /* Mempools backed by slab allocator */ if (pool->free == mempool_kfree) { __check_element(pool, element, (size_t)pool->pool_data); @@ -81,6 +85,10 @@ static void __poison_element(void *element, size_t size) static void poison_element(mempool_t *pool, void *element) { + /* Skip poisoning: KASAN might save its metadata in the element. */ + if (kasan_enabled()) + return; + /* Mempools backed by slab allocator */ if (pool->alloc == mempool_kmalloc) { __poison_element(element, (size_t)pool->pool_data); From patchwork Tue Dec 19 22:28:58 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: andrey.konovalov@linux.dev X-Patchwork-Id: 13499308 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id CD39AC46CCD for ; Tue, 19 Dec 2023 22:31:30 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id 2069F8D0011; Tue, 19 Dec 2023 17:31:28 -0500 (EST) Received: by kanga.kvack.org (Postfix, from userid 40) id 1B63A8D000D; Tue, 19 Dec 2023 17:31:28 -0500 (EST) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id F24048D0011; Tue, 19 Dec 2023 17:31:27 -0500 (EST) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0012.hostedemail.com [216.40.44.12]) by kanga.kvack.org (Postfix) with ESMTP id D368A8D000D for ; Tue, 19 Dec 2023 17:31:27 -0500 (EST) Received: from smtpin11.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay01.hostedemail.com (Postfix) with ESMTP id B52A51C0C7D for ; Tue, 19 Dec 2023 22:31:27 +0000 (UTC) X-FDA: 81585015414.11.F65A4AA Received: from out-171.mta0.migadu.com (out-171.mta0.migadu.com [91.218.175.171]) by imf02.hostedemail.com (Postfix) with ESMTP id 28BD480014 for ; Tue, 19 Dec 2023 22:31:25 +0000 (UTC) Authentication-Results: imf02.hostedemail.com; dkim=pass header.d=linux.dev header.s=key1 header.b=fbafFq1j; spf=pass (imf02.hostedemail.com: domain of andrey.konovalov@linux.dev designates 91.218.175.171 as permitted sender) smtp.mailfrom=andrey.konovalov@linux.dev; dmarc=pass (policy=none) header.from=linux.dev ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1703025086; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references:dkim-signature; bh=ZKMuCi1Fs+yi8i1iMj8jEYKxpwLo+oL8GkzWTmOTGSI=; b=5vR0NgrVcg/TJMGd7APM9gVoaIuBOHDGg8qXz5RMZhx6hBMYzot2qpSOZbVtxWu2gK1rWK Evf0D8puQ822gMphbW7u7LRAjDFD0U/eemwjl9BdivJgaf1dp4yerZwXV7nLQ06+7hQbOO FrNGMlmMoLm2EjNoDVAwO7utT515hGg= ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1703025086; a=rsa-sha256; cv=none; b=uYzfyVtSSzPC68yfh3FQlqR/JJQjbpbFuvYDtYHc7W+6vD2M/3AGxHBjuitzW79KEiA/sp yng7IOnWXHY2eq1BSRps9uSK7wLw7XI6ct32FDh8PDrHrRcYKEHTW9fDSOamjF4b2wq+sG ApTeRy+yMs818YUGATQgz5Yy8Sey8ME= ARC-Authentication-Results: i=1; imf02.hostedemail.com; dkim=pass header.d=linux.dev header.s=key1 header.b=fbafFq1j; spf=pass (imf02.hostedemail.com: domain of andrey.konovalov@linux.dev designates 91.218.175.171 as permitted sender) smtp.mailfrom=andrey.konovalov@linux.dev; dmarc=pass (policy=none) header.from=linux.dev X-Report-Abuse: Please report any abuse attempt to abuse@migadu.com and include these headers. DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linux.dev; s=key1; t=1703025084; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=ZKMuCi1Fs+yi8i1iMj8jEYKxpwLo+oL8GkzWTmOTGSI=; b=fbafFq1jlKC1cw8l0es+kRgSLJMag+jZz1zaVwws6qJ/XwEE/QAU3b2QRQ4d4gY3ik5ERb tj3mXVFI3saO1VRCl/G6F+6cQtebPvlWXWmXRbKaD42JplnE469NR+x6bSXKkfuSwR+j0Y wmoNA/R34bjTYOY+bjg9F2pqKV9n4xU= From: andrey.konovalov@linux.dev To: Marco Elver , Alexander Potapenko Cc: Andrey Konovalov , Dmitry Vyukov , Andrey Ryabinin , kasan-dev@googlegroups.com, Evgenii Stepanov , Breno Leitao , Alexander Lobakin , Andrew Morton , linux-mm@kvack.org, linux-kernel@vger.kernel.org, Andrey Konovalov Subject: [PATCH mm 14/21] mempool: use new mempool KASAN hooks Date: Tue, 19 Dec 2023 23:28:58 +0100 Message-Id: In-Reply-To: References: MIME-Version: 1.0 X-Migadu-Flow: FLOW_OUT X-Rspamd-Queue-Id: 28BD480014 X-Rspam-User: X-Stat-Signature: oej8uk34hdwe16wkfee15uxpcokffpph X-Rspamd-Server: rspam03 X-HE-Tag: 1703025085-398751 X-HE-Meta: U2FsdGVkX19WRcSGCLOsKz/6tSGCUOoB7p7t0FkERnxy0PtIQvhE8Iu0k9cOAJqEN0tQ40He49HyzBnmt9/pOCC+i4bmWy3lmuDZT8QO3eyTDM+VfAVPq/tD87bI3xWSgFBegDkA0aFyhti8Xhd7VExtMtDbC8oAc0RA7BB0KjJZwXN11dQtAPlKclu11lMKqIzwaFGCEdU3AjELsCgXLC4U8YE80TJSl9xERfnpKbRDIuJtJLet+FDQCCL62GG68EnO3lkPCqWQwZvMiOt+uVif2WcQTdikTbhSTBob4obGDn61lXEejp+JU5CvxQNmk+AEIrSSelT+1es1jSe9rBX7L9qF9nxeoluo59bks1jj6vmfK2VKN8ug/eAu563i5IMgyrBAfDmrV3AZZtgN/eVKWldZJuhZdoZ5eDYr65WgbKp9flT3m6gUMNYL7ehH4g9LSgAUjgFHpDUraR81zJCRmFzOG2O/EFl93kkz1CAPBIULaAA7+eJZxTm8bgyeoDMPIoc+J2S5wWq2g1u8gR4wMF/k4QuLnz0mzp8BpOSGXUtodiLZgB3qKMmnCaSAkHmI2Zy1RMKp67Qkczi5pLQ7kELHKPAdUich/oQkjGqQAUtZVdXu7jdcayg5tSRNKbz0NM0ahk9/9zpWML99NwikNxzCmEjxtuOxLzNv/PR47GGabI3q/f7N2L1a8jSQ75a7XaW/gYgUmK+A4E7jmVl+oI/MeYxHRgzGR/dbIR4Hp3Kve9MNDk71UOwC7eDpK8oMS7BRhEeKEH3GJfr8y0XbuS5NGcxWJ4N0wHdSOX8lOE+bugg9iV5sGBWsyV1Ufy1r92E9VCrPkliVRloESgQKHUnM9GanDRd81FXWksM9A/liHaXfd6QLemAe1rz0yq0wV3bkVzfOJU7DD0Odg+CdqX0CaKM4 X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: List-Subscribe: List-Unsubscribe: From: Andrey Konovalov Update the mempool code to use the new mempool KASAN hooks. Rely on the return value of kasan_mempool_poison_object and kasan_mempool_poison_pages to prevent double-free and invalid-free bugs. Signed-off-by: Andrey Konovalov --- mm/mempool.c | 22 ++++++++++++---------- 1 file changed, 12 insertions(+), 10 deletions(-) diff --git a/mm/mempool.c b/mm/mempool.c index 1fd39478c85e..103dc4770cfb 100644 --- a/mm/mempool.c +++ b/mm/mempool.c @@ -112,32 +112,34 @@ static inline void poison_element(mempool_t *pool, void *element) } #endif /* CONFIG_DEBUG_SLAB || CONFIG_SLUB_DEBUG_ON */ -static __always_inline void kasan_poison_element(mempool_t *pool, void *element) +static __always_inline bool kasan_poison_element(mempool_t *pool, void *element) { if (pool->alloc == mempool_alloc_slab || pool->alloc == mempool_kmalloc) - kasan_mempool_poison_object(element); + return kasan_mempool_poison_object(element); else if (pool->alloc == mempool_alloc_pages) - kasan_poison_pages(element, (unsigned long)pool->pool_data, - false); + return kasan_mempool_poison_pages(element, + (unsigned long)pool->pool_data); + return true; } static void kasan_unpoison_element(mempool_t *pool, void *element) { if (pool->alloc == mempool_kmalloc) - kasan_unpoison_range(element, (size_t)pool->pool_data); + kasan_mempool_unpoison_object(element, (size_t)pool->pool_data); else if (pool->alloc == mempool_alloc_slab) - kasan_unpoison_range(element, kmem_cache_size(pool->pool_data)); + kasan_mempool_unpoison_object(element, + kmem_cache_size(pool->pool_data)); else if (pool->alloc == mempool_alloc_pages) - kasan_unpoison_pages(element, (unsigned long)pool->pool_data, - false); + kasan_mempool_unpoison_pages(element, + (unsigned long)pool->pool_data); } static __always_inline void add_element(mempool_t *pool, void *element) { BUG_ON(pool->curr_nr >= pool->min_nr); poison_element(pool, element); - kasan_poison_element(pool, element); - pool->elements[pool->curr_nr++] = element; + if (kasan_poison_element(pool, element)) + pool->elements[pool->curr_nr++] = element; } static void *remove_element(mempool_t *pool) From patchwork Tue Dec 19 22:28:59 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: andrey.konovalov@linux.dev X-Patchwork-Id: 13499309 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id 0681AC41535 for ; Tue, 19 Dec 2023 22:31:33 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id CB4AD8D0012; Tue, 19 Dec 2023 17:31:28 -0500 (EST) Received: by kanga.kvack.org (Postfix, from userid 40) id C66C58D000D; Tue, 19 Dec 2023 17:31:28 -0500 (EST) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id A8FC08D0012; Tue, 19 Dec 2023 17:31:28 -0500 (EST) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0012.hostedemail.com [216.40.44.12]) by kanga.kvack.org (Postfix) with ESMTP id 985B28D000D for ; Tue, 19 Dec 2023 17:31:28 -0500 (EST) Received: from smtpin27.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay06.hostedemail.com (Postfix) with ESMTP id 745DFA117A for ; Tue, 19 Dec 2023 22:31:28 +0000 (UTC) X-FDA: 81585015456.27.0089433 Received: from out-183.mta0.migadu.com (out-183.mta0.migadu.com [91.218.175.183]) by imf21.hostedemail.com (Postfix) with ESMTP id A3B5D1C0012 for ; Tue, 19 Dec 2023 22:31:26 +0000 (UTC) Authentication-Results: imf21.hostedemail.com; dkim=pass header.d=linux.dev header.s=key1 header.b=CZpopGBZ; dmarc=pass (policy=none) header.from=linux.dev; spf=pass (imf21.hostedemail.com: domain of andrey.konovalov@linux.dev designates 91.218.175.183 as permitted sender) smtp.mailfrom=andrey.konovalov@linux.dev ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1703025086; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references:dkim-signature; bh=Vw9Ju+XsuH7jTh0rV53QjnTfccLPGDaCnQHzua8vht8=; b=6QVnKcm0dkHN7AHZsnPR7O6PqHMjop2CGeoelNezxDQJ6bZSpgEVmOFTvR9XrNizVkM0KM Ld3OWOXJh+M1iDypg5fkR0+kqLFlloq1zsTaiR4wpQjrxqVEZl3jVnljJbBduFR7i3I8be hxudUZ7DoNt8ZrT3WG/wxF0Z6d9iFVM= ARC-Authentication-Results: i=1; imf21.hostedemail.com; dkim=pass header.d=linux.dev header.s=key1 header.b=CZpopGBZ; dmarc=pass (policy=none) header.from=linux.dev; spf=pass (imf21.hostedemail.com: domain of andrey.konovalov@linux.dev designates 91.218.175.183 as permitted sender) smtp.mailfrom=andrey.konovalov@linux.dev ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1703025086; a=rsa-sha256; cv=none; b=tk58b+xci+xZ0IKSl7f1QoaKJo1FpV6CRB39ID2Xi1FnQyfz0cVccX+cUll5zPty4pzBWX 2LmbLuwu9QcWyvaraNBetx06teCF7sKx6exD5FqONn6luH6GVKsynjiWjLaJklj1nJwymD +IhzvK/OahIwtiXIXRN/7WzJ6Wyn+O8= X-Report-Abuse: Please report any abuse attempt to abuse@migadu.com and include these headers. DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linux.dev; s=key1; t=1703025085; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=Vw9Ju+XsuH7jTh0rV53QjnTfccLPGDaCnQHzua8vht8=; b=CZpopGBZsYX+uocBYMIAfDP7PDv7NGAgHL88CMPaHeNmC1Jd3UkHAbZqq1SXvnp8qR3PRk ko3vkaTQDOJV582w6cY6Jpq7gGMvDm6ekS2hgFsxwAQMhisoeEHQlLiOfoxsL6ydfk5Smi uW9JPOVYPoMNbIRTQbjw3x7wa9H6dN4= From: andrey.konovalov@linux.dev To: Marco Elver , Alexander Potapenko Cc: Andrey Konovalov , Dmitry Vyukov , Andrey Ryabinin , kasan-dev@googlegroups.com, Evgenii Stepanov , Breno Leitao , Alexander Lobakin , Andrew Morton , linux-mm@kvack.org, linux-kernel@vger.kernel.org, Andrey Konovalov Subject: [PATCH mm 15/21] mempool: introduce mempool_use_prealloc_only Date: Tue, 19 Dec 2023 23:28:59 +0100 Message-Id: In-Reply-To: References: MIME-Version: 1.0 X-Migadu-Flow: FLOW_OUT X-Rspamd-Queue-Id: A3B5D1C0012 X-Rspam-User: X-Rspamd-Server: rspam02 X-Stat-Signature: c6wgoxca6bcih8mwas1mfew39px19kmd X-HE-Tag: 1703025086-319171 X-HE-Meta: U2FsdGVkX1/jd1uLNokdP5o3EzQAjhj1+XGStuK0iWY4+q/DABImAhBkMgxijTRQTQCatw/d+GNMndq1i3+g4/wTiDhK9NXD9tPnMldCzIcuT02xhC7LNhykUd/Zw/nWBfqAWlBQzh1wG2fWWQmBiNU4TZSR8HhW6EeukyDAJMp7miE8B9VRGoaHMbflIHHwKav5XcoIdgq4B0Xj8Fqbq32u0/5LQou035cD3dufweZtaNDfhYzpLSqJ0c6Zwwm8d3y1ulnMQV7LRiWLMcgLuZ9FDl88VAVGhfkxMkbQ1uAHNf8cO0n6DcGbbwU9SKYS+DLElEa7Fe6JF0zO0PvFJwTX8prmeVPKr+8R1dCp8oFJvVnr678oYQNS9N6YO9yNrHkK/7/UbFKj3lKTbPioFIuSDLBIeMra2tjvkBJMbENha6iOUvbBSf3qgptAi8athB9EByV+997MdS79WYjRNitINalAPsKMNQ0Z45oTs2lpKrHynfDWAYMjMfWPHD5V3YCq1YGdrd5DqdzsT8gTYmA78yPGxrgKt3qKMnshtcxg/mx6WFIGtxoCM7jIDOTz7FkJjHO+hvvH5DdhNXDTNu6U8lFf673osGPbq4xnCCT+en8KKMoQOqclwqFZN+GvhTiStmoVQ/fziGWaO2X8jntwTwLn/7h5aNrVkAM5zGKvP34FjDEh2JSv1KXRr4AFHtlhFhfbWpNWbncEtuHP0VDb+8evXQkKxdMy5+vjkvsYGWDGMocjtLY/35zcld5+XwDrqlTpenZOM4PkPFpra1pTdXqzI6g01auGOgQoVPw1H48CHQD0vAlrFAOMSPGdQTTi4lT3EFnCBt2ZBurPjSA1Rk067HHcOAArQqjk7bFMV5wDRs4ZPitFlaE+fjJq/baK15hdyIVWLAyxNWnIYs9Yq4nktBhJrdJ/+t2TBREa2Bto1Sa2/dJHwKied3dR3wwJJMXEYBaoPRzhlPk SgUlysWn brbF+J5UJ9LNWXvjNFJDvnFakSzGZjVzPH+wqCF8HE3ns3AaBW9nOXr+EB+45k71tSRiMYbjJ4IA8Rs/bTECa5BlIoFkkjV3JsLIivkL1aLHiuI3JJclmlKBtwselpypbhLHsI8ngDFUCxn/NHQkOPDFDEjnAAFeBUhN8X+FwESs9vD/LmmXojZk59kp39tSAIV3tGekDBxUEqRlPlcoI9NZDVNqx/0gVzJ0Y X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: List-Subscribe: List-Unsubscribe: From: Andrey Konovalov Introduce a new mempool_alloc_preallocated API that asks the mempool to only use the elements preallocated during the mempool's creation when allocating and to not attempt allocating new ones from the underlying allocator. This API is required to test the KASAN poisoning/unpoisoning functionality in KASAN tests, but it might be also useful on its own. Signed-off-by: Andrey Konovalov --- Changes RFC->v1: - Introduce a new mempool_alloc_preallocated API instead of adding a flag into mempool_t. --- include/linux/mempool.h | 1 + mm/mempool.c | 37 +++++++++++++++++++++++++++++++++++++ 2 files changed, 38 insertions(+) diff --git a/include/linux/mempool.h b/include/linux/mempool.h index 4aae6c06c5f2..7be1e32e6d42 100644 --- a/include/linux/mempool.h +++ b/include/linux/mempool.h @@ -51,6 +51,7 @@ extern mempool_t *mempool_create_node(int min_nr, mempool_alloc_t *alloc_fn, extern int mempool_resize(mempool_t *pool, int new_min_nr); extern void mempool_destroy(mempool_t *pool); extern void *mempool_alloc(mempool_t *pool, gfp_t gfp_mask) __malloc; +extern void *mempool_alloc_preallocated(mempool_t *pool) __malloc; extern void mempool_free(void *element, mempool_t *pool); /* diff --git a/mm/mempool.c b/mm/mempool.c index 103dc4770cfb..cb7b4b56cec1 100644 --- a/mm/mempool.c +++ b/mm/mempool.c @@ -456,6 +456,43 @@ void *mempool_alloc(mempool_t *pool, gfp_t gfp_mask) } EXPORT_SYMBOL(mempool_alloc); +/** + * mempool_alloc_preallocated - allocate an element from preallocated elements + * belonging to a specific memory pool + * @pool: pointer to the memory pool which was allocated via + * mempool_create(). + * + * This function is similar to mempool_alloc, but it only attempts allocating + * an element from the preallocated elements. It does not sleep and immediately + * returns if no preallocated elements are available. + * + * Return: pointer to the allocated element or %NULL if no elements are + * available. + */ +void *mempool_alloc_preallocated(mempool_t *pool) +{ + void *element; + unsigned long flags; + + spin_lock_irqsave(&pool->lock, flags); + if (likely(pool->curr_nr)) { + element = remove_element(pool); + spin_unlock_irqrestore(&pool->lock, flags); + /* paired with rmb in mempool_free(), read comment there */ + smp_wmb(); + /* + * Update the allocation stack trace as this is more useful + * for debugging. + */ + kmemleak_update_trace(element); + return element; + } + spin_unlock_irqrestore(&pool->lock, flags); + + return NULL; +} +EXPORT_SYMBOL(mempool_alloc_preallocated); + /** * mempool_free - return an element to the pool. * @element: pool element pointer. From patchwork Tue Dec 19 22:29:00 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: andrey.konovalov@linux.dev X-Patchwork-Id: 13499310 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id 6BB2AC41535 for ; Tue, 19 Dec 2023 22:31:35 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id 933DC8D0013; Tue, 19 Dec 2023 17:31:29 -0500 (EST) Received: by kanga.kvack.org (Postfix, from userid 40) id 8C8988D000D; Tue, 19 Dec 2023 17:31:29 -0500 (EST) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 64C858D0013; Tue, 19 Dec 2023 17:31:29 -0500 (EST) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0013.hostedemail.com [216.40.44.13]) by kanga.kvack.org (Postfix) with ESMTP id 4E2A58D000D for ; Tue, 19 Dec 2023 17:31:29 -0500 (EST) Received: from smtpin16.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay04.hostedemail.com (Postfix) with ESMTP id 23A591A045F for ; Tue, 19 Dec 2023 22:31:29 +0000 (UTC) X-FDA: 81585015498.16.B090689 Received: from out-177.mta0.migadu.com (out-177.mta0.migadu.com [91.218.175.177]) by imf29.hostedemail.com (Postfix) with ESMTP id 6156A120003 for ; Tue, 19 Dec 2023 22:31:27 +0000 (UTC) Authentication-Results: imf29.hostedemail.com; dkim=pass header.d=linux.dev header.s=key1 header.b=YqrnJgAl; dmarc=pass (policy=none) header.from=linux.dev; spf=pass (imf29.hostedemail.com: domain of andrey.konovalov@linux.dev designates 91.218.175.177 as permitted sender) smtp.mailfrom=andrey.konovalov@linux.dev ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1703025087; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references:dkim-signature; bh=gqTGbtVMui+CmtAk7WElvDUhOKijpogQXuGURBykLZ0=; b=E6PTRM1R8QJx7CZZ9AbWU40NxDSF8e4JyKJJWljFoUaEoWHhatduqgHySOhI131oIBA2ta 96EJKXFaJTYEMnGyVmYv3V3ANc1YwLsKqYZmHnIao4HE+ZnlohjMUEgtlldi31NcTkGc8p sSYLBhtc1Daf2OEGfTPu8+M+CE46aWo= ARC-Authentication-Results: i=1; imf29.hostedemail.com; dkim=pass header.d=linux.dev header.s=key1 header.b=YqrnJgAl; dmarc=pass (policy=none) header.from=linux.dev; spf=pass (imf29.hostedemail.com: domain of andrey.konovalov@linux.dev designates 91.218.175.177 as permitted sender) smtp.mailfrom=andrey.konovalov@linux.dev ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1703025087; a=rsa-sha256; cv=none; b=QAaWUKyZ3YGDTqxFciPbTYKjU2bBnindZvQljGRcYa7Ovp7JFj5CZA4hAXeCS+8gleyLLh iDgiCatamcHXpWaESp9w6lDo87t22YhMOwOMQYDXnf9ZreAZmyYFgTky5PWnWKkSv9QVV6 IwSpq7hKyQ7FGcI1FGYSPlMpTpTp5mk= X-Report-Abuse: Please report any abuse attempt to abuse@migadu.com and include these headers. DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linux.dev; s=key1; t=1703025085; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=gqTGbtVMui+CmtAk7WElvDUhOKijpogQXuGURBykLZ0=; b=YqrnJgAlquajDIl5bS/SUbEt3hHi1yePvIngCNhvy5NPjLJtH9NzR2DNcrEbXuO3mTgAfc WnRYQEnVKDzcn1NHeUUzpzPRb5b+Jnvi9IT8lvOHAJ8lZl5px1Dta7PJmc5FDtpmw3a9kE xUWaYEaCnbJDSFV/GGHi3rjbRbq5pM0= From: andrey.konovalov@linux.dev To: Marco Elver , Alexander Potapenko Cc: Andrey Konovalov , Dmitry Vyukov , Andrey Ryabinin , kasan-dev@googlegroups.com, Evgenii Stepanov , Breno Leitao , Alexander Lobakin , Andrew Morton , linux-mm@kvack.org, linux-kernel@vger.kernel.org, Andrey Konovalov Subject: [PATCH mm 16/21] kasan: add mempool tests Date: Tue, 19 Dec 2023 23:29:00 +0100 Message-Id: <5fd64732266be8287711b6408d86ffc78784be06.1703024586.git.andreyknvl@google.com> In-Reply-To: References: MIME-Version: 1.0 X-Migadu-Flow: FLOW_OUT X-Rspamd-Queue-Id: 6156A120003 X-Rspam-User: X-Rspamd-Server: rspam04 X-Stat-Signature: 13ee7m3ioabsn8j4sdhj5th1uekhfjp8 X-HE-Tag: 1703025087-579082 X-HE-Meta: U2FsdGVkX1/+b5rLiJcmb19ykM09gS3Ou0E5nSGUtoW7Ca2vH/UYNCYIL1lQt23NG6s6i/Q8WaA5GoGN6V0MOmmcreIDKJODu4YKgkPle/j1wP7Nm8OqUdIqnERsv/lEUcrqMUwu7oaGM+NT51gR0ZdUCg2IzSykzYy9Q3k5yoSHzl7zjlmUoaK1wi7qVzsgUiOMr6CKrpQj8uIryK0jzUZi5cO2sQqSkaVm14dfTMMPvt3CsE32/utDDJS5VSv+Q5KE1ie3S+huuS8pK+gIYqTCnQ7pEHJm8hm3xttPVYxPb4w099/C4q/qH4a0AHJrlpwzZ4w2wiQBTle23cG2PzrLuckyJE/701k52cs3NSIviDmF2x6ATVldwNaSoqyXa+wx5PF2C8g519KzBoxOip5Zunum7ZZwk0XXbrdCARL+AKRpH0dJHeh/Knv+WIHyrOrDBzhe8qlw054XnmSjaPqSWGKK4iHVj1Y1dctBkllb4eAGj+qE3EjAwv5oOQ/0f+TBmkZCFUwonnW8RLB812wksi0pVuIxCUqQsrRTdIcYvFO/qFlAi2M7K6CpnpB/T4uq9GIiEWwKD7fnB6Vg3/o9y++wYEiwOkoV3Uc09blpZu1Rkdb42El+w1Sl8yt7dlb72wJB6e1kooQ1zl8z/5TItvedDgOHQRVUxoffTD1VEi3zMwtQ9HWGdmQ5jYKCQqOdbeCo00B6MLekzqXRIzHQHYDxBHBNigIWxPBubycBwBp3eRkZr3bMc01YE80OVzA+1DYw5nC0Y01IrS7sDv3N6E5bBQOg4wJaRP120oB4sjbUUKZLgtTBemfq0iHaFLWr7cMQgKx475QTz6XDe5zOhSIAEP3UHEOSRzEWtAukYF7XPQzKZds7BhlfYdwI7qLJmnbbn6JJR+niAsjujBuHWf9sUlM3TX48ZGAGXYW6vjSd5JoYqXFmNIm/nC1twsOx1yM7ewDJqT+YJB6 j7s4trJ/ 4PFViu2lvtjrY2rGQsSUJkViIBWAan9pSTtIegko019Ak+75AoNzf+50+K/90pJvBN7TYx89wPEyrEc/BlPoCiAgalP90GMsCF1shp5W2wbFmLkCaEg9beDvwwlpkkj0QHPkgS4NTTV+NbTvgrNHxUuo3QmdksqrbQDZZfM5dTqxXn0dAxcuD780Py3+Q1EhpjKLe/5+7iIJLtRFp9riGQakzA6G2hYBWFtg/ X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: List-Subscribe: List-Unsubscribe: From: Andrey Konovalov Add KASAN tests for mempool. Signed-off-by: Andrey Konovalov --- Changes RFC->v1: - Use read instead of write in oob_right tests to avoid triggering slub_debug-detected corruptions. - Adapt tests for the mempool API change. --- mm/kasan/kasan_test.c | 319 ++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 319 insertions(+) diff --git a/mm/kasan/kasan_test.c b/mm/kasan/kasan_test.c index 8281eb42464b..0ae4e93e9311 100644 --- a/mm/kasan/kasan_test.c +++ b/mm/kasan/kasan_test.c @@ -13,6 +13,7 @@ #include #include #include +#include #include #include #include @@ -798,6 +799,312 @@ static void kmem_cache_bulk(struct kunit *test) kmem_cache_destroy(cache); } +static void *mempool_prepare_kmalloc(struct kunit *test, mempool_t *pool, size_t size) +{ + int pool_size = 4; + int ret; + void *elem; + + memset(pool, 0, sizeof(*pool)); + ret = mempool_init_kmalloc_pool(pool, pool_size, size); + KUNIT_ASSERT_EQ(test, ret, 0); + + /* + * Allocate one element to prevent mempool from freeing elements to the + * underlying allocator and instead make it add them to the element + * list when the tests trigger double-free and invalid-free bugs. + * This allows testing KASAN annotations in add_element(). + */ + elem = mempool_alloc_preallocated(pool); + KUNIT_ASSERT_NOT_ERR_OR_NULL(test, elem); + + return elem; +} + +static struct kmem_cache *mempool_prepare_slab(struct kunit *test, mempool_t *pool, size_t size) +{ + struct kmem_cache *cache; + int pool_size = 4; + int ret; + + cache = kmem_cache_create("test_cache", size, 0, 0, NULL); + KUNIT_ASSERT_NOT_ERR_OR_NULL(test, cache); + + memset(pool, 0, sizeof(*pool)); + ret = mempool_init_slab_pool(pool, pool_size, cache); + KUNIT_ASSERT_EQ(test, ret, 0); + + /* + * Do not allocate one preallocated element, as we skip the double-free + * and invalid-free tests for slab mempool for simplicity. + */ + + return cache; +} + +static void *mempool_prepare_page(struct kunit *test, mempool_t *pool, int order) +{ + int pool_size = 4; + int ret; + void *elem; + + memset(pool, 0, sizeof(*pool)); + ret = mempool_init_page_pool(pool, pool_size, order); + KUNIT_ASSERT_EQ(test, ret, 0); + + elem = mempool_alloc_preallocated(pool); + KUNIT_ASSERT_NOT_ERR_OR_NULL(test, elem); + + return elem; +} + +static void mempool_oob_right_helper(struct kunit *test, mempool_t *pool, size_t size) +{ + char *elem; + + elem = mempool_alloc_preallocated(pool); + KUNIT_ASSERT_NOT_ERR_OR_NULL(test, elem); + + OPTIMIZER_HIDE_VAR(elem); + + if (IS_ENABLED(CONFIG_KASAN_GENERIC)) + KUNIT_EXPECT_KASAN_FAIL(test, + ((volatile char *)&elem[size])[0]); + else + KUNIT_EXPECT_KASAN_FAIL(test, + ((volatile char *)&elem[round_up(size, KASAN_GRANULE_SIZE)])[0]); + + mempool_free(elem, pool); +} + +static void mempool_kmalloc_oob_right(struct kunit *test) +{ + mempool_t pool; + size_t size = 128 - KASAN_GRANULE_SIZE - 5; + void *extra_elem; + + extra_elem = mempool_prepare_kmalloc(test, &pool, size); + + mempool_oob_right_helper(test, &pool, size); + + mempool_free(extra_elem, &pool); + mempool_exit(&pool); +} + +static void mempool_kmalloc_large_oob_right(struct kunit *test) +{ + mempool_t pool; + size_t size = KMALLOC_MAX_CACHE_SIZE + 1; + void *extra_elem; + + extra_elem = mempool_prepare_kmalloc(test, &pool, size); + + mempool_oob_right_helper(test, &pool, size); + + mempool_free(extra_elem, &pool); + mempool_exit(&pool); +} + +static void mempool_slab_oob_right(struct kunit *test) +{ + mempool_t pool; + size_t size = 123; + struct kmem_cache *cache; + + cache = mempool_prepare_slab(test, &pool, size); + + mempool_oob_right_helper(test, &pool, size); + + mempool_exit(&pool); + kmem_cache_destroy(cache); +} + +/* + * Skip the out-of-bounds test for page mempool. With Generic KASAN, page + * allocations have no redzones, and thus the out-of-bounds detection is not + * guaranteed; see https://bugzilla.kernel.org/show_bug.cgi?id=210503. With + * the tag-based KASAN modes, the neighboring allocation might have the same + * tag; see https://bugzilla.kernel.org/show_bug.cgi?id=203505. + */ + +static void mempool_uaf_helper(struct kunit *test, mempool_t *pool, bool page) +{ + char *elem, *ptr; + + elem = mempool_alloc_preallocated(pool); + KUNIT_ASSERT_NOT_ERR_OR_NULL(test, elem); + + mempool_free(elem, pool); + + ptr = page ? page_address((struct page *)elem) : elem; + KUNIT_EXPECT_KASAN_FAIL(test, ((volatile char *)ptr)[0]); +} + +static void mempool_kmalloc_uaf(struct kunit *test) +{ + mempool_t pool; + size_t size = 128; + void *extra_elem; + + extra_elem = mempool_prepare_kmalloc(test, &pool, size); + + mempool_uaf_helper(test, &pool, false); + + mempool_free(extra_elem, &pool); + mempool_exit(&pool); +} + +static void mempool_kmalloc_large_uaf(struct kunit *test) +{ + mempool_t pool; + size_t size = KMALLOC_MAX_CACHE_SIZE + 1; + void *extra_elem; + + /* page_alloc fallback is only implemented for SLUB. */ + KASAN_TEST_NEEDS_CONFIG_ON(test, CONFIG_SLUB); + + extra_elem = mempool_prepare_kmalloc(test, &pool, size); + + mempool_uaf_helper(test, &pool, false); + + mempool_free(extra_elem, &pool); + mempool_exit(&pool); +} + +static void mempool_slab_uaf(struct kunit *test) +{ + mempool_t pool; + size_t size = 123; + struct kmem_cache *cache; + + cache = mempool_prepare_slab(test, &pool, size); + + mempool_uaf_helper(test, &pool, false); + + mempool_exit(&pool); + kmem_cache_destroy(cache); +} + +static void mempool_page_alloc_uaf(struct kunit *test) +{ + mempool_t pool; + int order = 2; + void *extra_elem; + + extra_elem = mempool_prepare_page(test, &pool, order); + + mempool_uaf_helper(test, &pool, true); + + mempool_free(extra_elem, &pool); + mempool_exit(&pool); +} + +static void mempool_double_free_helper(struct kunit *test, mempool_t *pool) +{ + char *elem; + + elem = mempool_alloc_preallocated(pool); + KUNIT_ASSERT_NOT_ERR_OR_NULL(test, elem); + + mempool_free(elem, pool); + + KUNIT_EXPECT_KASAN_FAIL(test, mempool_free(elem, pool)); +} + +static void mempool_kmalloc_double_free(struct kunit *test) +{ + mempool_t pool; + size_t size = 128; + char *extra_elem; + + extra_elem = mempool_prepare_kmalloc(test, &pool, size); + + mempool_double_free_helper(test, &pool); + + mempool_free(extra_elem, &pool); + mempool_exit(&pool); +} + +static void mempool_kmalloc_large_double_free(struct kunit *test) +{ + mempool_t pool; + size_t size = KMALLOC_MAX_CACHE_SIZE + 1; + char *extra_elem; + + /* page_alloc fallback is only implemented for SLUB. */ + KASAN_TEST_NEEDS_CONFIG_ON(test, CONFIG_SLUB); + + extra_elem = mempool_prepare_kmalloc(test, &pool, size); + + mempool_double_free_helper(test, &pool); + + mempool_free(extra_elem, &pool); + mempool_exit(&pool); +} + +static void mempool_page_alloc_double_free(struct kunit *test) +{ + mempool_t pool; + int order = 2; + char *extra_elem; + + extra_elem = mempool_prepare_page(test, &pool, order); + + mempool_double_free_helper(test, &pool); + + mempool_free(extra_elem, &pool); + mempool_exit(&pool); +} + +static void mempool_kmalloc_invalid_free_helper(struct kunit *test, mempool_t *pool) +{ + char *elem; + + elem = mempool_alloc_preallocated(pool); + KUNIT_ASSERT_NOT_ERR_OR_NULL(test, elem); + + KUNIT_EXPECT_KASAN_FAIL(test, mempool_free(elem + 1, pool)); + + mempool_free(elem, pool); +} + +static void mempool_kmalloc_invalid_free(struct kunit *test) +{ + mempool_t pool; + size_t size = 128; + char *extra_elem; + + extra_elem = mempool_prepare_kmalloc(test, &pool, size); + + mempool_kmalloc_invalid_free_helper(test, &pool); + + mempool_free(extra_elem, &pool); + mempool_exit(&pool); +} + +static void mempool_kmalloc_large_invalid_free(struct kunit *test) +{ + mempool_t pool; + size_t size = KMALLOC_MAX_CACHE_SIZE + 1; + char *extra_elem; + + /* page_alloc fallback is only implemented for SLUB. */ + KASAN_TEST_NEEDS_CONFIG_ON(test, CONFIG_SLUB); + + extra_elem = mempool_prepare_kmalloc(test, &pool, size); + + mempool_kmalloc_invalid_free_helper(test, &pool); + + mempool_free(extra_elem, &pool); + mempool_exit(&pool); +} + +/* + * Skip the invalid-free test for page mempool. The invalid-free detection only + * works for compound pages and mempool preallocates all page elements without + * the __GFP_COMP flag. + */ + static char global_array[10]; static void kasan_global_oob_right(struct kunit *test) @@ -1538,6 +1845,18 @@ static struct kunit_case kasan_kunit_test_cases[] = { KUNIT_CASE(kmem_cache_oob), KUNIT_CASE(kmem_cache_accounted), KUNIT_CASE(kmem_cache_bulk), + KUNIT_CASE(mempool_kmalloc_oob_right), + KUNIT_CASE(mempool_kmalloc_large_oob_right), + KUNIT_CASE(mempool_slab_oob_right), + KUNIT_CASE(mempool_kmalloc_uaf), + KUNIT_CASE(mempool_kmalloc_large_uaf), + KUNIT_CASE(mempool_slab_uaf), + KUNIT_CASE(mempool_page_alloc_uaf), + KUNIT_CASE(mempool_kmalloc_double_free), + KUNIT_CASE(mempool_kmalloc_large_double_free), + KUNIT_CASE(mempool_page_alloc_double_free), + KUNIT_CASE(mempool_kmalloc_invalid_free), + KUNIT_CASE(mempool_kmalloc_large_invalid_free), KUNIT_CASE(kasan_global_oob_right), KUNIT_CASE(kasan_global_oob_left), KUNIT_CASE(kasan_stack_oob), From patchwork Tue Dec 19 22:29:01 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: andrey.konovalov@linux.dev X-Patchwork-Id: 13499311 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id 214DFC41535 for ; Tue, 19 Dec 2023 22:31:38 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id 27BF98D0014; Tue, 19 Dec 2023 17:31:30 -0500 (EST) Received: by kanga.kvack.org (Postfix, from userid 40) id 22DDB8D000D; Tue, 19 Dec 2023 17:31:30 -0500 (EST) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 0A96B8D0014; Tue, 19 Dec 2023 17:31:29 -0500 (EST) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0010.hostedemail.com [216.40.44.10]) by kanga.kvack.org (Postfix) with ESMTP id DC0968D000D for ; Tue, 19 Dec 2023 17:31:29 -0500 (EST) Received: from smtpin11.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay05.hostedemail.com (Postfix) with ESMTP id BC995401B1 for ; Tue, 19 Dec 2023 22:31:29 +0000 (UTC) X-FDA: 81585015498.11.39D24A0 Received: from out-185.mta0.migadu.com (out-185.mta0.migadu.com [91.218.175.185]) by imf04.hostedemail.com (Postfix) with ESMTP id E31FE40017 for ; Tue, 19 Dec 2023 22:31:27 +0000 (UTC) Authentication-Results: imf04.hostedemail.com; dkim=pass header.d=linux.dev header.s=key1 header.b=Iwn4kg+j; dmarc=pass (policy=none) header.from=linux.dev; spf=pass (imf04.hostedemail.com: domain of andrey.konovalov@linux.dev designates 91.218.175.185 as permitted sender) smtp.mailfrom=andrey.konovalov@linux.dev ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1703025088; a=rsa-sha256; cv=none; b=a2Ixo9mXeCt1gdMNFf8Lid7f1r2ChghbpsSrR11ZEH0mUdlkDpOrliCafdbmGp0tmtXIRQ nDmDSxhvvlJhpMVUwvkb0bj8jjdD0ItzGQ8hiVN/mfasLNTEeSLb3QWuQ92kuEOXFhFZyF 1NqDVcbEcdVCrEQ9tXAeZTce4aEEpgk= ARC-Authentication-Results: i=1; imf04.hostedemail.com; dkim=pass header.d=linux.dev header.s=key1 header.b=Iwn4kg+j; dmarc=pass (policy=none) header.from=linux.dev; spf=pass (imf04.hostedemail.com: domain of andrey.konovalov@linux.dev designates 91.218.175.185 as permitted sender) smtp.mailfrom=andrey.konovalov@linux.dev ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1703025088; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references:dkim-signature; bh=vtcYZCAnAciS7NEDq4A0NBDaIMQC+9FU2xLXkQaUBC0=; b=paLMHCg2x6tP9To10O5Rt9I4Gb4hPItDTSlMZX0ma4A39g1yB5l1lNczLWyQTmpokl3E4g xHw4vSQvo63h64zHbC7VlRB04XJzBl9SxBtukrsCj1+Wjh7XzaFbTVzf4pjkUzktty7uc4 4ErLNIvJMsj7z3AIvbDv9NXkUP2S0is= X-Report-Abuse: Please report any abuse attempt to abuse@migadu.com and include these headers. DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linux.dev; s=key1; t=1703025086; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=vtcYZCAnAciS7NEDq4A0NBDaIMQC+9FU2xLXkQaUBC0=; b=Iwn4kg+js3TZqTZyBEzr5jlkex5ITD9Q+U+eV8TWaTbadaxxhhpExvz32AObLkyzYsWKVo MEGpKSGLfb3aHTx+3wLZBhFQ6hI849in9n+2J9o44vahne4V4yCGCqK7fWLB18LfLjC7TQ S1SacVIxMXkVgZHMVh+q2zV1q3hj0X0= From: andrey.konovalov@linux.dev To: Marco Elver , Alexander Potapenko Cc: Andrey Konovalov , Dmitry Vyukov , Andrey Ryabinin , kasan-dev@googlegroups.com, Evgenii Stepanov , Breno Leitao , Alexander Lobakin , Andrew Morton , linux-mm@kvack.org, linux-kernel@vger.kernel.org, Andrey Konovalov Subject: [PATCH mm 17/21] kasan: rename pagealloc tests Date: Tue, 19 Dec 2023 23:29:01 +0100 Message-Id: In-Reply-To: References: MIME-Version: 1.0 X-Migadu-Flow: FLOW_OUT X-Rspam-User: X-Rspamd-Server: rspam06 X-Rspamd-Queue-Id: E31FE40017 X-Stat-Signature: d9ruqiqqdme6hz3ot3uk5yyn5djtc681 X-HE-Tag: 1703025087-558957 X-HE-Meta: U2FsdGVkX18AeEn0U00zRKKb8GxI/UQkWjrd9e72wA2fh2o4j0t7AO9lfaE+9dL9dX/PjYf0zhMAr0ybvkBm+77tKf1+JjKFk9WSVRPzE9hXGAtZnNPGH5ijs23YWZUIaLlfEy3xH5NvWVeeo4KTD7CYnTf3jmNwimB1WBQiFKe4/F8PO2DeKvr554nRkPq7KSlR3FCOufXGGgANowwYyTWYIqlk5bQI9s96oW4uSPuzJk1BmGZiVJKW2nbD39BHgVtJdmckTkVnWc4W/a5Ei1LSeJ4RA1QTMBsCJCGrbThXEJSpnqkCC5aeTRC1wM3TkY8yOdjDr7nNAAj21uRj/Q4FrDfnVZ8ntDM919w4fIpZDiLewt0dB26ZarEVnzcvDhGOVElRELBniP03IqhUk3FQ7l3QSI6HkxJyNZALlfCxiv9FKGWj6LmJqHyEs5IKOwkSz0rrWYbQvX5vqXcj/dXmzbvjoJMXjCP5Qb3b6DP+a2CJjcJ6Z+YbmGeH2sKL6aeMQn8e/9IY+PIv80ymXCU3XRIUXvKu9wEDWo3rgUnIo0PoVsnJhpLD0SD3oLuUGMbMS7M34vAlM7Mtf8uw3MaL/65u0wE7NAAGs0khd/H1t5713DS6J/WsPa/UBMidrYzPJQPNwxNAslsgr4flKqHt9L2VjkOMlN4YBgxhB2CYHNanpqjfAvKs6oZsiMb+yffRHD8hyK3IPa9jI6wqWobIS+CMxG+tRpv5x7CtMnAhZ9cafjU/ZQbKiG6vTiFkoMyqUTpERICyFs2HtaCBHmRYqFc9+wbOnd4esNPWKbHoZT9oyINlClT1Fd6BJPhYcPJlgVp+GCH5AgTTcY5IzTkf3Y7fIlg4gx8ljLg3e0pDZ1IsSG9k5Tack/N73FkNeEsbvlgBVZGUNL4DJWbbGrKCyAsr7+phPCKFysaRU7MuizeAhmtzQxrVWjGRpPCYfFz1IB8EAHxlsoOk6ec ML6cOE+Q Fr8lSmm1UEIP1F0YLS7x2Q0Z07r+f9q0Gn8pees8K1P9dzBJhQWSid6tk9txdnLa8OxUwDEN2+pYqtdQHbeC+WzTe2E3tZ29GttTf65ID+6BgU7HMs7ac6Y6ayi9l8BOAcp6j6X0pTvQ7W6QbKr0VpWUZXX+L4FuKM2i4 X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: List-Subscribe: List-Unsubscribe: From: Andrey Konovalov Rename "pagealloc" KASAN tests: 1. Use "kmalloc_large" for tests that use large kmalloc allocations. 2. Use "page_alloc" for tests that use page_alloc. Also clean up the comments. Signed-off-by: Andrey Konovalov --- mm/kasan/kasan_test.c | 51 ++++++++++++++++++++++--------------------- 1 file changed, 26 insertions(+), 25 deletions(-) diff --git a/mm/kasan/kasan_test.c b/mm/kasan/kasan_test.c index 0ae4e93e9311..230958de7604 100644 --- a/mm/kasan/kasan_test.c +++ b/mm/kasan/kasan_test.c @@ -214,12 +214,13 @@ static void kmalloc_node_oob_right(struct kunit *test) } /* - * These kmalloc_pagealloc_* tests try allocating a memory chunk that doesn't - * fit into a slab cache and therefore is allocated via the page allocator - * fallback. Since this kind of fallback is only implemented for SLUB, these - * tests are limited to that allocator. + * The kmalloc_large_* tests below use kmalloc() to allocate a memory chunk + * that does not fit into the largest slab cache and therefore is allocated via + * the page_alloc fallback for SLUB. SLAB has no such fallback, and thus these + * tests are not supported for it. */ -static void kmalloc_pagealloc_oob_right(struct kunit *test) + +static void kmalloc_large_oob_right(struct kunit *test) { char *ptr; size_t size = KMALLOC_MAX_CACHE_SIZE + 10; @@ -235,7 +236,7 @@ static void kmalloc_pagealloc_oob_right(struct kunit *test) kfree(ptr); } -static void kmalloc_pagealloc_uaf(struct kunit *test) +static void kmalloc_large_uaf(struct kunit *test) { char *ptr; size_t size = KMALLOC_MAX_CACHE_SIZE + 10; @@ -249,7 +250,7 @@ static void kmalloc_pagealloc_uaf(struct kunit *test) KUNIT_EXPECT_KASAN_FAIL(test, ((volatile char *)ptr)[0]); } -static void kmalloc_pagealloc_invalid_free(struct kunit *test) +static void kmalloc_large_invalid_free(struct kunit *test) { char *ptr; size_t size = KMALLOC_MAX_CACHE_SIZE + 10; @@ -262,7 +263,7 @@ static void kmalloc_pagealloc_invalid_free(struct kunit *test) KUNIT_EXPECT_KASAN_FAIL(test, kfree(ptr + 1)); } -static void pagealloc_oob_right(struct kunit *test) +static void page_alloc_oob_right(struct kunit *test) { char *ptr; struct page *pages; @@ -284,7 +285,7 @@ static void pagealloc_oob_right(struct kunit *test) free_pages((unsigned long)ptr, order); } -static void pagealloc_uaf(struct kunit *test) +static void page_alloc_uaf(struct kunit *test) { char *ptr; struct page *pages; @@ -298,15 +299,15 @@ static void pagealloc_uaf(struct kunit *test) KUNIT_EXPECT_KASAN_FAIL(test, ((volatile char *)ptr)[0]); } -static void kmalloc_large_oob_right(struct kunit *test) +/* + * Check that KASAN detects an out-of-bounds access for a big object allocated + * via kmalloc(). But not as big as to trigger the page_alloc fallback for SLUB. + */ +static void kmalloc_big_oob_right(struct kunit *test) { char *ptr; size_t size = KMALLOC_MAX_CACHE_SIZE - 256; - /* - * Allocate a chunk that is large enough, but still fits into a slab - * and does not trigger the page allocator fallback in SLUB. - */ ptr = kmalloc(size, GFP_KERNEL); KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr); @@ -404,18 +405,18 @@ static void krealloc_less_oob(struct kunit *test) krealloc_less_oob_helper(test, 235, 201); } -static void krealloc_pagealloc_more_oob(struct kunit *test) +static void krealloc_large_more_oob(struct kunit *test) { - /* page_alloc fallback in only implemented for SLUB. */ + /* page_alloc fallback is only implemented for SLUB. */ KASAN_TEST_NEEDS_CONFIG_ON(test, CONFIG_SLUB); krealloc_more_oob_helper(test, KMALLOC_MAX_CACHE_SIZE + 201, KMALLOC_MAX_CACHE_SIZE + 235); } -static void krealloc_pagealloc_less_oob(struct kunit *test) +static void krealloc_large_less_oob(struct kunit *test) { - /* page_alloc fallback in only implemented for SLUB. */ + /* page_alloc fallback is only implemented for SLUB. */ KASAN_TEST_NEEDS_CONFIG_ON(test, CONFIG_SLUB); krealloc_less_oob_helper(test, KMALLOC_MAX_CACHE_SIZE + 235, @@ -1816,16 +1817,16 @@ static struct kunit_case kasan_kunit_test_cases[] = { KUNIT_CASE(kmalloc_oob_right), KUNIT_CASE(kmalloc_oob_left), KUNIT_CASE(kmalloc_node_oob_right), - KUNIT_CASE(kmalloc_pagealloc_oob_right), - KUNIT_CASE(kmalloc_pagealloc_uaf), - KUNIT_CASE(kmalloc_pagealloc_invalid_free), - KUNIT_CASE(pagealloc_oob_right), - KUNIT_CASE(pagealloc_uaf), KUNIT_CASE(kmalloc_large_oob_right), + KUNIT_CASE(kmalloc_large_uaf), + KUNIT_CASE(kmalloc_large_invalid_free), + KUNIT_CASE(page_alloc_oob_right), + KUNIT_CASE(page_alloc_uaf), + KUNIT_CASE(kmalloc_big_oob_right), KUNIT_CASE(krealloc_more_oob), KUNIT_CASE(krealloc_less_oob), - KUNIT_CASE(krealloc_pagealloc_more_oob), - KUNIT_CASE(krealloc_pagealloc_less_oob), + KUNIT_CASE(krealloc_large_more_oob), + KUNIT_CASE(krealloc_large_less_oob), KUNIT_CASE(krealloc_uaf), KUNIT_CASE(kmalloc_oob_16), KUNIT_CASE(kmalloc_uaf_16), From patchwork Tue Dec 19 22:29:02 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: andrey.konovalov@linux.dev X-Patchwork-Id: 13499312 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id 9B650C41535 for ; Tue, 19 Dec 2023 22:32:32 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id 365236B0087; Tue, 19 Dec 2023 17:32:32 -0500 (EST) Received: by kanga.kvack.org (Postfix, from userid 40) id 315666B0089; Tue, 19 Dec 2023 17:32:32 -0500 (EST) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 1B5E06B0095; Tue, 19 Dec 2023 17:32:32 -0500 (EST) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0014.hostedemail.com [216.40.44.14]) by kanga.kvack.org (Postfix) with ESMTP id 09C786B0087 for ; Tue, 19 Dec 2023 17:32:32 -0500 (EST) Received: from smtpin22.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay02.hostedemail.com (Postfix) with ESMTP id B8C61120879 for ; Tue, 19 Dec 2023 22:32:31 +0000 (UTC) X-FDA: 81585018102.22.A699E33 Received: from out-180.mta1.migadu.com (out-180.mta1.migadu.com [95.215.58.180]) by imf16.hostedemail.com (Postfix) with ESMTP id F3EB1180011 for ; Tue, 19 Dec 2023 22:32:29 +0000 (UTC) Authentication-Results: imf16.hostedemail.com; dkim=pass header.d=linux.dev header.s=key1 header.b=csItksj+; dmarc=pass (policy=none) header.from=linux.dev; spf=pass (imf16.hostedemail.com: domain of andrey.konovalov@linux.dev designates 95.215.58.180 as permitted sender) smtp.mailfrom=andrey.konovalov@linux.dev ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1703025150; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references:dkim-signature; bh=JAXOX97EsAmXy2yhWR89ibBKpDRw8QdBu0qlhVLQFtk=; b=TAI1GNtdd3f1xm3n3l/erK3GISDiSHV+xvh9w3qYgeP3JckotwZw/46ZMQlpvH/fyDBzGz s1S6NZD9guLYbPeyUAhowh2oLmxqYRQ1T0gh+3gqGncC4aObEi9hdwKbZbhJAppHIqYRY/ PgE7Nc/sfuz1xBCbB7TnWGtjvXUkkXs= ARC-Authentication-Results: i=1; imf16.hostedemail.com; dkim=pass header.d=linux.dev header.s=key1 header.b=csItksj+; dmarc=pass (policy=none) header.from=linux.dev; spf=pass (imf16.hostedemail.com: domain of andrey.konovalov@linux.dev designates 95.215.58.180 as permitted sender) smtp.mailfrom=andrey.konovalov@linux.dev ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1703025150; a=rsa-sha256; cv=none; b=7nQxDWZ06LLkM96qqOqCgPUpt//CVxgWUEyTQrkl4XVlMtpnrxuuVV8uryF0tnOOkb8Wm+ 0FERnS63GdLWMiQxfJiBJlzGzN5emNUdTATvs473wCT8H0eLk260Wnp28UehxYVX8j48ZJ hjwVCDN/clcV2AWOCrImdHjCMXkidiA= X-Report-Abuse: Please report any abuse attempt to abuse@migadu.com and include these headers. DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linux.dev; s=key1; t=1703025148; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=JAXOX97EsAmXy2yhWR89ibBKpDRw8QdBu0qlhVLQFtk=; b=csItksj+qfVZgYztXVXmO5Q/IjIHIbtHAh6iT/j8QfAxoWkkqq3VWgkBhbzwvLM84M8D0A TY/aJpwJCMqD/cTXvUGvVm9NwUBAX39OldG7WZQHt0DozXkegxdK48FHxPlZa+KERo76WU +T7Q2BbJcPQj9yUjKW5CnW+vavcmm5s= From: andrey.konovalov@linux.dev To: Marco Elver , Alexander Potapenko Cc: Andrey Konovalov , Dmitry Vyukov , Andrey Ryabinin , kasan-dev@googlegroups.com, Evgenii Stepanov , Breno Leitao , Alexander Lobakin , Andrew Morton , linux-mm@kvack.org, linux-kernel@vger.kernel.org, Andrey Konovalov Subject: [PATCH mm 18/21] kasan: reorder tests Date: Tue, 19 Dec 2023 23:29:02 +0100 Message-Id: In-Reply-To: References: MIME-Version: 1.0 X-Migadu-Flow: FLOW_OUT X-Rspam-User: X-Stat-Signature: ahwxc7s91741x5sse93fxfhyfi44zhmh X-Rspamd-Server: rspam07 X-Rspamd-Queue-Id: F3EB1180011 X-HE-Tag: 1703025149-68448 X-HE-Meta: U2FsdGVkX18ii8ma/FFWeLGNQ1gBhHUwoI/xpwUlND8R9lWQMg5H7t5mQvVOy1EGM/Rna81HhFGLnuFfrllUl8VcwWzSPMDpaNUdBbRXJritTwMU98w+wRhz3XRIORex4wuLGes1LvdABQnUHrdmqnMOvO7WEvEXgRkZYCpZy87x0pSWcbAY8M30sBUr7PLUyzYDlA8bUZRlerXQPcNdN8QlW3lDE30RujkeZefLTuHPgkCgAqg8Q1vlDjGKZnLDIxp624vFLIUZhjS216Uu9TPLSnjhwRCqe/r+Qt4LYzWW/hIAwqx+FGeWOX1FnOFLq7qM9Fd7DrIHrrU9W4vl3AXvH++vJe5ceEuDh9ESWqVkFFuictqTFaYXr6wZlMYmacNFlc8MjzC/sZaGnz4bnS57eIXnLYAPLbv8KqbMTNO2hylLjjzcQ3fvUrbxkiWN0SPlOsjy+8oooiuPUm3yl4tgmnmTFrkV/qydLz+4kuZCHVj1juLlfyUhKbhSk5D5pfUX+djwy/xLneyIP8PaM10GoyIa3fR6CcMXcabAim0WIN8vGAJBN6kszVtWRmFEhKrwG7NrrXlDIxfg1FrprIDVVCXvEbkFeOk2SnRTic3T1ONMFAuwZHU78c90heC89jtack9T+Nt5qevZUVaYlo1lGPG9I5RjeoLcxdRSsAh4diPiuskGIsNkqtjWuDKlxHFnQv4i88AJOW0Hlw8LkYo7D88qbVUXLjYjFqyAgiwzIMKFrdreRKknQ8v/D/2ySIJ+rH6/MDOvh6IHC9ronOPu8v2pcRVtNUpwUUnnOJgeYP9lHsb9sBkdLsf291fGqUp3Jp1zBm7QeHvpUTVAkYrq1r9PFxj/pZHWbR1UZlLzImhqh0HFbilKzWc4dy7EGpsy2NCotWby/F1ap2aHAAUpwfZRDpTK X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: List-Subscribe: List-Unsubscribe: From: Andrey Konovalov Put closely related tests next to each other. No functional changes. Signed-off-by: Andrey Konovalov --- mm/kasan/kasan_test.c | 418 +++++++++++++++++++++--------------------- 1 file changed, 209 insertions(+), 209 deletions(-) diff --git a/mm/kasan/kasan_test.c b/mm/kasan/kasan_test.c index 230958de7604..1c77c73ff287 100644 --- a/mm/kasan/kasan_test.c +++ b/mm/kasan/kasan_test.c @@ -213,6 +213,23 @@ static void kmalloc_node_oob_right(struct kunit *test) kfree(ptr); } +/* + * Check that KASAN detects an out-of-bounds access for a big object allocated + * via kmalloc(). But not as big as to trigger the page_alloc fallback for SLUB. + */ +static void kmalloc_big_oob_right(struct kunit *test) +{ + char *ptr; + size_t size = KMALLOC_MAX_CACHE_SIZE - 256; + + ptr = kmalloc(size, GFP_KERNEL); + KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr); + + OPTIMIZER_HIDE_VAR(ptr); + KUNIT_EXPECT_KASAN_FAIL(test, ptr[size] = 0); + kfree(ptr); +} + /* * The kmalloc_large_* tests below use kmalloc() to allocate a memory chunk * that does not fit into the largest slab cache and therefore is allocated via @@ -299,23 +316,6 @@ static void page_alloc_uaf(struct kunit *test) KUNIT_EXPECT_KASAN_FAIL(test, ((volatile char *)ptr)[0]); } -/* - * Check that KASAN detects an out-of-bounds access for a big object allocated - * via kmalloc(). But not as big as to trigger the page_alloc fallback for SLUB. - */ -static void kmalloc_big_oob_right(struct kunit *test) -{ - char *ptr; - size_t size = KMALLOC_MAX_CACHE_SIZE - 256; - - ptr = kmalloc(size, GFP_KERNEL); - KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr); - - OPTIMIZER_HIDE_VAR(ptr); - KUNIT_EXPECT_KASAN_FAIL(test, ptr[size] = 0); - kfree(ptr); -} - static void krealloc_more_oob_helper(struct kunit *test, size_t size1, size_t size2) { @@ -698,6 +698,126 @@ static void kmalloc_uaf3(struct kunit *test) KUNIT_EXPECT_KASAN_FAIL(test, ((volatile char *)ptr1)[8]); } +static void kmalloc_double_kzfree(struct kunit *test) +{ + char *ptr; + size_t size = 16; + + ptr = kmalloc(size, GFP_KERNEL); + KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr); + + kfree_sensitive(ptr); + KUNIT_EXPECT_KASAN_FAIL(test, kfree_sensitive(ptr)); +} + +/* Check that ksize() does NOT unpoison whole object. */ +static void ksize_unpoisons_memory(struct kunit *test) +{ + char *ptr; + size_t size = 128 - KASAN_GRANULE_SIZE - 5; + size_t real_size; + + ptr = kmalloc(size, GFP_KERNEL); + KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr); + + real_size = ksize(ptr); + KUNIT_EXPECT_GT(test, real_size, size); + + OPTIMIZER_HIDE_VAR(ptr); + + /* These accesses shouldn't trigger a KASAN report. */ + ptr[0] = 'x'; + ptr[size - 1] = 'x'; + + /* These must trigger a KASAN report. */ + if (IS_ENABLED(CONFIG_KASAN_GENERIC)) + KUNIT_EXPECT_KASAN_FAIL(test, ((volatile char *)ptr)[size]); + KUNIT_EXPECT_KASAN_FAIL(test, ((volatile char *)ptr)[size + 5]); + KUNIT_EXPECT_KASAN_FAIL(test, ((volatile char *)ptr)[real_size - 1]); + + kfree(ptr); +} + +/* + * Check that a use-after-free is detected by ksize() and via normal accesses + * after it. + */ +static void ksize_uaf(struct kunit *test) +{ + char *ptr; + int size = 128 - KASAN_GRANULE_SIZE; + + ptr = kmalloc(size, GFP_KERNEL); + KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr); + kfree(ptr); + + OPTIMIZER_HIDE_VAR(ptr); + KUNIT_EXPECT_KASAN_FAIL(test, ksize(ptr)); + KUNIT_EXPECT_KASAN_FAIL(test, ((volatile char *)ptr)[0]); + KUNIT_EXPECT_KASAN_FAIL(test, ((volatile char *)ptr)[size]); +} + +/* + * The two tests below check that Generic KASAN prints auxiliary stack traces + * for RCU callbacks and workqueues. The reports need to be inspected manually. + * + * These tests are still enabled for other KASAN modes to make sure that all + * modes report bad accesses in tested scenarios. + */ + +static struct kasan_rcu_info { + int i; + struct rcu_head rcu; +} *global_rcu_ptr; + +static void rcu_uaf_reclaim(struct rcu_head *rp) +{ + struct kasan_rcu_info *fp = + container_of(rp, struct kasan_rcu_info, rcu); + + kfree(fp); + ((volatile struct kasan_rcu_info *)fp)->i; +} + +static void rcu_uaf(struct kunit *test) +{ + struct kasan_rcu_info *ptr; + + ptr = kmalloc(sizeof(struct kasan_rcu_info), GFP_KERNEL); + KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr); + + global_rcu_ptr = rcu_dereference_protected( + (struct kasan_rcu_info __rcu *)ptr, NULL); + + KUNIT_EXPECT_KASAN_FAIL(test, + call_rcu(&global_rcu_ptr->rcu, rcu_uaf_reclaim); + rcu_barrier()); +} + +static void workqueue_uaf_work(struct work_struct *work) +{ + kfree(work); +} + +static void workqueue_uaf(struct kunit *test) +{ + struct workqueue_struct *workqueue; + struct work_struct *work; + + workqueue = create_workqueue("kasan_workqueue_test"); + KUNIT_ASSERT_NOT_ERR_OR_NULL(test, workqueue); + + work = kmalloc(sizeof(struct work_struct), GFP_KERNEL); + KUNIT_ASSERT_NOT_ERR_OR_NULL(test, work); + + INIT_WORK(work, workqueue_uaf_work); + queue_work(workqueue, work); + destroy_workqueue(workqueue); + + KUNIT_EXPECT_KASAN_FAIL(test, + ((volatile struct work_struct *)work)->data); +} + static void kfree_via_page(struct kunit *test) { char *ptr; @@ -748,6 +868,69 @@ static void kmem_cache_oob(struct kunit *test) kmem_cache_destroy(cache); } +static void kmem_cache_double_free(struct kunit *test) +{ + char *p; + size_t size = 200; + struct kmem_cache *cache; + + cache = kmem_cache_create("test_cache", size, 0, 0, NULL); + KUNIT_ASSERT_NOT_ERR_OR_NULL(test, cache); + + p = kmem_cache_alloc(cache, GFP_KERNEL); + if (!p) { + kunit_err(test, "Allocation failed: %s\n", __func__); + kmem_cache_destroy(cache); + return; + } + + kmem_cache_free(cache, p); + KUNIT_EXPECT_KASAN_FAIL(test, kmem_cache_free(cache, p)); + kmem_cache_destroy(cache); +} + +static void kmem_cache_invalid_free(struct kunit *test) +{ + char *p; + size_t size = 200; + struct kmem_cache *cache; + + cache = kmem_cache_create("test_cache", size, 0, SLAB_TYPESAFE_BY_RCU, + NULL); + KUNIT_ASSERT_NOT_ERR_OR_NULL(test, cache); + + p = kmem_cache_alloc(cache, GFP_KERNEL); + if (!p) { + kunit_err(test, "Allocation failed: %s\n", __func__); + kmem_cache_destroy(cache); + return; + } + + /* Trigger invalid free, the object doesn't get freed. */ + KUNIT_EXPECT_KASAN_FAIL(test, kmem_cache_free(cache, p + 1)); + + /* + * Properly free the object to prevent the "Objects remaining in + * test_cache on __kmem_cache_shutdown" BUG failure. + */ + kmem_cache_free(cache, p); + + kmem_cache_destroy(cache); +} + +static void empty_cache_ctor(void *object) { } + +static void kmem_cache_double_destroy(struct kunit *test) +{ + struct kmem_cache *cache; + + /* Provide a constructor to prevent cache merging. */ + cache = kmem_cache_create("test_cache", 200, 0, 0, empty_cache_ctor); + KUNIT_ASSERT_NOT_ERR_OR_NULL(test, cache); + kmem_cache_destroy(cache); + KUNIT_EXPECT_KASAN_FAIL(test, kmem_cache_destroy(cache)); +} + static void kmem_cache_accounted(struct kunit *test) { int i; @@ -1145,53 +1328,6 @@ static void kasan_global_oob_left(struct kunit *test) KUNIT_EXPECT_KASAN_FAIL(test, *(volatile char *)p); } -/* Check that ksize() does NOT unpoison whole object. */ -static void ksize_unpoisons_memory(struct kunit *test) -{ - char *ptr; - size_t size = 128 - KASAN_GRANULE_SIZE - 5; - size_t real_size; - - ptr = kmalloc(size, GFP_KERNEL); - KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr); - - real_size = ksize(ptr); - KUNIT_EXPECT_GT(test, real_size, size); - - OPTIMIZER_HIDE_VAR(ptr); - - /* These accesses shouldn't trigger a KASAN report. */ - ptr[0] = 'x'; - ptr[size - 1] = 'x'; - - /* These must trigger a KASAN report. */ - if (IS_ENABLED(CONFIG_KASAN_GENERIC)) - KUNIT_EXPECT_KASAN_FAIL(test, ((volatile char *)ptr)[size]); - KUNIT_EXPECT_KASAN_FAIL(test, ((volatile char *)ptr)[size + 5]); - KUNIT_EXPECT_KASAN_FAIL(test, ((volatile char *)ptr)[real_size - 1]); - - kfree(ptr); -} - -/* - * Check that a use-after-free is detected by ksize() and via normal accesses - * after it. - */ -static void ksize_uaf(struct kunit *test) -{ - char *ptr; - int size = 128 - KASAN_GRANULE_SIZE; - - ptr = kmalloc(size, GFP_KERNEL); - KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr); - kfree(ptr); - - OPTIMIZER_HIDE_VAR(ptr); - KUNIT_EXPECT_KASAN_FAIL(test, ksize(ptr)); - KUNIT_EXPECT_KASAN_FAIL(test, ((volatile char *)ptr)[0]); - KUNIT_EXPECT_KASAN_FAIL(test, ((volatile char *)ptr)[size]); -} - static void kasan_stack_oob(struct kunit *test) { char stack_array[10]; @@ -1234,69 +1370,6 @@ static void kasan_alloca_oob_right(struct kunit *test) KUNIT_EXPECT_KASAN_FAIL(test, *(volatile char *)p); } -static void kmem_cache_double_free(struct kunit *test) -{ - char *p; - size_t size = 200; - struct kmem_cache *cache; - - cache = kmem_cache_create("test_cache", size, 0, 0, NULL); - KUNIT_ASSERT_NOT_ERR_OR_NULL(test, cache); - - p = kmem_cache_alloc(cache, GFP_KERNEL); - if (!p) { - kunit_err(test, "Allocation failed: %s\n", __func__); - kmem_cache_destroy(cache); - return; - } - - kmem_cache_free(cache, p); - KUNIT_EXPECT_KASAN_FAIL(test, kmem_cache_free(cache, p)); - kmem_cache_destroy(cache); -} - -static void kmem_cache_invalid_free(struct kunit *test) -{ - char *p; - size_t size = 200; - struct kmem_cache *cache; - - cache = kmem_cache_create("test_cache", size, 0, SLAB_TYPESAFE_BY_RCU, - NULL); - KUNIT_ASSERT_NOT_ERR_OR_NULL(test, cache); - - p = kmem_cache_alloc(cache, GFP_KERNEL); - if (!p) { - kunit_err(test, "Allocation failed: %s\n", __func__); - kmem_cache_destroy(cache); - return; - } - - /* Trigger invalid free, the object doesn't get freed. */ - KUNIT_EXPECT_KASAN_FAIL(test, kmem_cache_free(cache, p + 1)); - - /* - * Properly free the object to prevent the "Objects remaining in - * test_cache on __kmem_cache_shutdown" BUG failure. - */ - kmem_cache_free(cache, p); - - kmem_cache_destroy(cache); -} - -static void empty_cache_ctor(void *object) { } - -static void kmem_cache_double_destroy(struct kunit *test) -{ - struct kmem_cache *cache; - - /* Provide a constructor to prevent cache merging. */ - cache = kmem_cache_create("test_cache", 200, 0, 0, empty_cache_ctor); - KUNIT_ASSERT_NOT_ERR_OR_NULL(test, cache); - kmem_cache_destroy(cache); - KUNIT_EXPECT_KASAN_FAIL(test, kmem_cache_destroy(cache)); -} - static void kasan_memchr(struct kunit *test) { char *ptr; @@ -1458,79 +1531,6 @@ static void kasan_bitops_tags(struct kunit *test) kfree(bits); } -static void kmalloc_double_kzfree(struct kunit *test) -{ - char *ptr; - size_t size = 16; - - ptr = kmalloc(size, GFP_KERNEL); - KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr); - - kfree_sensitive(ptr); - KUNIT_EXPECT_KASAN_FAIL(test, kfree_sensitive(ptr)); -} - -/* - * The two tests below check that Generic KASAN prints auxiliary stack traces - * for RCU callbacks and workqueues. The reports need to be inspected manually. - * - * These tests are still enabled for other KASAN modes to make sure that all - * modes report bad accesses in tested scenarios. - */ - -static struct kasan_rcu_info { - int i; - struct rcu_head rcu; -} *global_rcu_ptr; - -static void rcu_uaf_reclaim(struct rcu_head *rp) -{ - struct kasan_rcu_info *fp = - container_of(rp, struct kasan_rcu_info, rcu); - - kfree(fp); - ((volatile struct kasan_rcu_info *)fp)->i; -} - -static void rcu_uaf(struct kunit *test) -{ - struct kasan_rcu_info *ptr; - - ptr = kmalloc(sizeof(struct kasan_rcu_info), GFP_KERNEL); - KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr); - - global_rcu_ptr = rcu_dereference_protected( - (struct kasan_rcu_info __rcu *)ptr, NULL); - - KUNIT_EXPECT_KASAN_FAIL(test, - call_rcu(&global_rcu_ptr->rcu, rcu_uaf_reclaim); - rcu_barrier()); -} - -static void workqueue_uaf_work(struct work_struct *work) -{ - kfree(work); -} - -static void workqueue_uaf(struct kunit *test) -{ - struct workqueue_struct *workqueue; - struct work_struct *work; - - workqueue = create_workqueue("kasan_workqueue_test"); - KUNIT_ASSERT_NOT_ERR_OR_NULL(test, workqueue); - - work = kmalloc(sizeof(struct work_struct), GFP_KERNEL); - KUNIT_ASSERT_NOT_ERR_OR_NULL(test, work); - - INIT_WORK(work, workqueue_uaf_work); - queue_work(workqueue, work); - destroy_workqueue(workqueue); - - KUNIT_EXPECT_KASAN_FAIL(test, - ((volatile struct work_struct *)work)->data); -} - static void vmalloc_helpers_tags(struct kunit *test) { void *ptr; @@ -1817,12 +1817,12 @@ static struct kunit_case kasan_kunit_test_cases[] = { KUNIT_CASE(kmalloc_oob_right), KUNIT_CASE(kmalloc_oob_left), KUNIT_CASE(kmalloc_node_oob_right), + KUNIT_CASE(kmalloc_big_oob_right), KUNIT_CASE(kmalloc_large_oob_right), KUNIT_CASE(kmalloc_large_uaf), KUNIT_CASE(kmalloc_large_invalid_free), KUNIT_CASE(page_alloc_oob_right), KUNIT_CASE(page_alloc_uaf), - KUNIT_CASE(kmalloc_big_oob_right), KUNIT_CASE(krealloc_more_oob), KUNIT_CASE(krealloc_less_oob), KUNIT_CASE(krealloc_large_more_oob), @@ -1841,9 +1841,17 @@ static struct kunit_case kasan_kunit_test_cases[] = { KUNIT_CASE(kmalloc_uaf_memset), KUNIT_CASE(kmalloc_uaf2), KUNIT_CASE(kmalloc_uaf3), + KUNIT_CASE(kmalloc_double_kzfree), + KUNIT_CASE(ksize_unpoisons_memory), + KUNIT_CASE(ksize_uaf), + KUNIT_CASE(rcu_uaf), + KUNIT_CASE(workqueue_uaf), KUNIT_CASE(kfree_via_page), KUNIT_CASE(kfree_via_phys), KUNIT_CASE(kmem_cache_oob), + KUNIT_CASE(kmem_cache_double_free), + KUNIT_CASE(kmem_cache_invalid_free), + KUNIT_CASE(kmem_cache_double_destroy), KUNIT_CASE(kmem_cache_accounted), KUNIT_CASE(kmem_cache_bulk), KUNIT_CASE(mempool_kmalloc_oob_right), @@ -1863,19 +1871,11 @@ static struct kunit_case kasan_kunit_test_cases[] = { KUNIT_CASE(kasan_stack_oob), KUNIT_CASE(kasan_alloca_oob_left), KUNIT_CASE(kasan_alloca_oob_right), - KUNIT_CASE(ksize_unpoisons_memory), - KUNIT_CASE(ksize_uaf), - KUNIT_CASE(kmem_cache_double_free), - KUNIT_CASE(kmem_cache_invalid_free), - KUNIT_CASE(kmem_cache_double_destroy), KUNIT_CASE(kasan_memchr), KUNIT_CASE(kasan_memcmp), KUNIT_CASE(kasan_strings), KUNIT_CASE(kasan_bitops_generic), KUNIT_CASE(kasan_bitops_tags), - KUNIT_CASE(kmalloc_double_kzfree), - KUNIT_CASE(rcu_uaf), - KUNIT_CASE(workqueue_uaf), KUNIT_CASE(vmalloc_helpers_tags), KUNIT_CASE(vmalloc_oob), KUNIT_CASE(vmap_tags), From patchwork Tue Dec 19 22:29:03 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: andrey.konovalov@linux.dev X-Patchwork-Id: 13499313 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id AD5D7C46CCD for ; Tue, 19 Dec 2023 22:32:33 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id BCC8E6B0089; Tue, 19 Dec 2023 17:32:32 -0500 (EST) Received: by kanga.kvack.org (Postfix, from userid 40) id B795D6B0099; Tue, 19 Dec 2023 17:32:32 -0500 (EST) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id A40FB6B009B; Tue, 19 Dec 2023 17:32:32 -0500 (EST) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0014.hostedemail.com [216.40.44.14]) by kanga.kvack.org (Postfix) with ESMTP id 9118E6B0089 for ; Tue, 19 Dec 2023 17:32:32 -0500 (EST) Received: from smtpin15.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay09.hostedemail.com (Postfix) with ESMTP id 6978C801F3 for ; Tue, 19 Dec 2023 22:32:32 +0000 (UTC) X-FDA: 81585018144.15.F00EBDD Received: from out-188.mta1.migadu.com (out-188.mta1.migadu.com [95.215.58.188]) by imf30.hostedemail.com (Postfix) with ESMTP id A292B80022 for ; Tue, 19 Dec 2023 22:32:30 +0000 (UTC) Authentication-Results: imf30.hostedemail.com; dkim=pass header.d=linux.dev header.s=key1 header.b=bmAVzIYf; spf=pass (imf30.hostedemail.com: domain of andrey.konovalov@linux.dev designates 95.215.58.188 as permitted sender) smtp.mailfrom=andrey.konovalov@linux.dev; dmarc=pass (policy=none) header.from=linux.dev ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1703025150; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references:dkim-signature; bh=mlYQJh3Zrut4xXu3wLWLs7KGtUj3CeTDuDfdtjdzU7g=; b=dXnvRWJ74zSiNWku16oCcdQElbcjslyma+GZAgDOoSnfdo6AsrVZWeYRUU6FBoBrtJNtRx XJQbCS7Ovmyo0ckgUPVQcLlviOujrYCkWPathIvPcLv0u28NEYKB4itwMmigSxmwTdoaDe fJudUBorYar/z4DEreS2F/coRhwMdCw= ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1703025150; a=rsa-sha256; cv=none; b=uj6HFwol8mxLE0GR7O1GcTGI123rZAl3BB2F20iTtEGtyDS2U9zHhmdEobg1AcODn0IazG n/TFn1A1kYLM2gU+DXUPNouUpJhE9/0WS6DvWXEpaun6YK8qwUJ9UQww/zQ6dEU5k4WrY4 SMYuaE3dnPOjXmKrfIXflf6qgGKh3ng= ARC-Authentication-Results: i=1; imf30.hostedemail.com; dkim=pass header.d=linux.dev header.s=key1 header.b=bmAVzIYf; spf=pass (imf30.hostedemail.com: domain of andrey.konovalov@linux.dev designates 95.215.58.188 as permitted sender) smtp.mailfrom=andrey.konovalov@linux.dev; dmarc=pass (policy=none) header.from=linux.dev X-Report-Abuse: Please report any abuse attempt to abuse@migadu.com and include these headers. DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linux.dev; s=key1; t=1703025149; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=mlYQJh3Zrut4xXu3wLWLs7KGtUj3CeTDuDfdtjdzU7g=; b=bmAVzIYfyYppWmvGTLBiS5nG8obTrmbbdL0D6+ClOLIyRzStyC0cUpgaQoGRj4B9negloZ gDBuxMa0ozyhE+nyywcFc4sF3IFTOtfxFhASYlhLoyPMu0p611lKZY7InRWt+SuofDu71+ 8EC/bvZUjw4CO1A7j3BBvX7vr2/bJog= From: andrey.konovalov@linux.dev To: Marco Elver , Alexander Potapenko Cc: Andrey Konovalov , Dmitry Vyukov , Andrey Ryabinin , kasan-dev@googlegroups.com, Evgenii Stepanov , Breno Leitao , Alexander Lobakin , Andrew Morton , linux-mm@kvack.org, linux-kernel@vger.kernel.org, Andrey Konovalov Subject: [PATCH mm 19/21] kasan: rename and document kasan_(un)poison_object_data Date: Tue, 19 Dec 2023 23:29:03 +0100 Message-Id: In-Reply-To: References: MIME-Version: 1.0 X-Migadu-Flow: FLOW_OUT X-Stat-Signature: ejxsjuqzjh1o7y3iyrb1hgkuwtzyys5d X-Rspamd-Server: rspam10 X-Rspamd-Queue-Id: A292B80022 X-Rspam-User: X-HE-Tag: 1703025150-400560 X-HE-Meta: U2FsdGVkX1/I7WmIvIUf6RkxI3yUctUyT//kCjoRZ/ntLYFBuihunfcuJH1nrtWtOGLRnLNQ5eJTcCD/ZIWjjluJ3gx48ZESbHkTR0YuoPsNL0J0cLg5gXh0MRswgMMQUWVcEUNkt6TR3y+imfEJmXDxEm1KtND7FESt7UTtMoSXOdKM5ja/5TDT+7qlvrdptYhMa/X8EeY/ATxwH5Nba2cjTV/5CSEnmh4Db1uIHSe5uU81yq8MII10FnOcGSz9wSCx2KwfPAAUL9j3yhd8EWIHJk5vbsNJsMVWAP+jSslsT+11/Wymln+9OoR67h/51F0R3Sau+5dsAYDkKE0G/ZstxdhXpobUwmnw0k/hxJOvPHYLMVAal9O1tipCY+fhkAHA+IfaWxt9suEvAfXyc0J5DD1pVnR2qSA/BrBHksDSnfkc7plr06B6DjDHMzl2lFFQbLEYT9iceFD0Rce3UqcFixh+b6OcooW7cczboXf7dxiO16nhO917qbYSuxH7f6Bupn0MhSeLWqIj7LWG+1Z3K90LPQ0jlnpcXIGUJHKhNGfMLKWa6DJzwa20PbCmtdngQa15x6tp7IAYoWwJUkHJ/Xo5v2MXqXncq6/w2aAtLx8gnK+qDJuxJB3stAY8ZkoP2ZHzgbQWXty59Mg/PzuOODKOxdEkBv1P+IuoAYWa9hwja+HGHJBH4zPzh+yfoV2OQqvpgfjeAjPRuWr9oU7mFcs7SEYByg7RNIvmoZy9A/RU254bDHz+m+naE8M7xt+YFVsAVq/U/ApW45V2mTe4DVlxvAb9l2w32SjHz9wSke1Z38LhT7177NiJlejQKoS0n0rPMhwjVqPTQL/k07FWLow4ozdvj7suP/L8i1HWXUDNCmB1XtiM0VY8Lq1urG3LQYMhBiQAUhblyxWBRjwga7CxD/Rz8/jgRdKucQbpkXkQv7i4gQ0DxdGoNPsQpMy3WYCyNPWh/sxTIZO s9HCmxhf D91eJLVv4HqUzTRuvXjQYGj6hTtch9N6RXsogr1JVRUkYfmOp2QSZ4YwtUsd57tJdgvmYX4A6O96QiKI2+ksq59WlpnoDrw99WnkQlwbqWUEaZVv1d02oa+UKqI19uOQ5SbRyMbDYYxi+HDm78PZwjO51F4sBZ/pQ+ErL6pfNeIK8gfdNsxq05Loi4NFrQPKUaAlq9F37FLxsK31MJt2FcHqcjJG6LBPsbBU8 X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: List-Subscribe: List-Unsubscribe: From: Andrey Konovalov Rename kasan_unpoison_object_data to kasan_unpoison_new_object and add a documentation comment. Do the same for kasan_poison_object_data. The new names and the comments should suggest the users that these hooks are intended for internal use by the slab allocator. The following patch will remove non-slab-internal uses of these hooks. No functional changes. Signed-off-by: Andrey Konovalov --- include/linux/kasan.h | 35 +++++++++++++++++++++++++++-------- mm/kasan/common.c | 4 ++-- mm/slab.c | 10 ++++------ mm/slub.c | 4 ++-- net/core/skbuff.c | 8 ++++---- 5 files changed, 39 insertions(+), 22 deletions(-) diff --git a/include/linux/kasan.h b/include/linux/kasan.h index 7392c5d89b92..d49e3d4c099e 100644 --- a/include/linux/kasan.h +++ b/include/linux/kasan.h @@ -129,20 +129,39 @@ static __always_inline void kasan_poison_slab(struct slab *slab) __kasan_poison_slab(slab); } -void __kasan_unpoison_object_data(struct kmem_cache *cache, void *object); -static __always_inline void kasan_unpoison_object_data(struct kmem_cache *cache, +void __kasan_unpoison_new_object(struct kmem_cache *cache, void *object); +/** + * kasan_unpoison_new_object - Temporarily unpoison a new slab object. + * @cache: Cache the object belong to. + * @object: Pointer to the object. + * + * This function is intended for the slab allocator's internal use. It + * temporarily unpoisons an object from a newly allocated slab without doing + * anything else. The object must later be repoisoned by + * kasan_poison_new_object(). + */ +static __always_inline void kasan_unpoison_new_object(struct kmem_cache *cache, void *object) { if (kasan_enabled()) - __kasan_unpoison_object_data(cache, object); + __kasan_unpoison_new_object(cache, object); } -void __kasan_poison_object_data(struct kmem_cache *cache, void *object); -static __always_inline void kasan_poison_object_data(struct kmem_cache *cache, +void __kasan_poison_new_object(struct kmem_cache *cache, void *object); +/** + * kasan_unpoison_new_object - Repoison a new slab object. + * @cache: Cache the object belong to. + * @object: Pointer to the object. + * + * This function is intended for the slab allocator's internal use. It + * repoisons an object that was previously unpoisoned by + * kasan_unpoison_new_object() without doing anything else. + */ +static __always_inline void kasan_poison_new_object(struct kmem_cache *cache, void *object) { if (kasan_enabled()) - __kasan_poison_object_data(cache, object); + __kasan_poison_new_object(cache, object); } void * __must_check __kasan_init_slab_obj(struct kmem_cache *cache, @@ -342,9 +361,9 @@ static inline bool kasan_unpoison_pages(struct page *page, unsigned int order, return false; } static inline void kasan_poison_slab(struct slab *slab) {} -static inline void kasan_unpoison_object_data(struct kmem_cache *cache, +static inline void kasan_unpoison_new_object(struct kmem_cache *cache, void *object) {} -static inline void kasan_poison_object_data(struct kmem_cache *cache, +static inline void kasan_poison_new_object(struct kmem_cache *cache, void *object) {} static inline void *kasan_init_slab_obj(struct kmem_cache *cache, const void *object) diff --git a/mm/kasan/common.c b/mm/kasan/common.c index b8e7416f83af..ebb1b23d6480 100644 --- a/mm/kasan/common.c +++ b/mm/kasan/common.c @@ -143,12 +143,12 @@ void __kasan_poison_slab(struct slab *slab) KASAN_SLAB_REDZONE, false); } -void __kasan_unpoison_object_data(struct kmem_cache *cache, void *object) +void __kasan_unpoison_new_object(struct kmem_cache *cache, void *object) { kasan_unpoison(object, cache->object_size, false); } -void __kasan_poison_object_data(struct kmem_cache *cache, void *object) +void __kasan_poison_new_object(struct kmem_cache *cache, void *object) { kasan_poison(object, round_up(cache->object_size, KASAN_GRANULE_SIZE), KASAN_SLAB_REDZONE, false); diff --git a/mm/slab.c b/mm/slab.c index 9ad3d0f2d1a5..773c79e153f3 100644 --- a/mm/slab.c +++ b/mm/slab.c @@ -2327,11 +2327,9 @@ static void cache_init_objs_debug(struct kmem_cache *cachep, struct slab *slab) * They must also be threaded. */ if (cachep->ctor && !(cachep->flags & SLAB_POISON)) { - kasan_unpoison_object_data(cachep, - objp + obj_offset(cachep)); + kasan_unpoison_new_object(cachep, objp + obj_offset(cachep)); cachep->ctor(objp + obj_offset(cachep)); - kasan_poison_object_data( - cachep, objp + obj_offset(cachep)); + kasan_poison_new_object(cachep, objp + obj_offset(cachep)); } if (cachep->flags & SLAB_RED_ZONE) { @@ -2472,9 +2470,9 @@ static void cache_init_objs(struct kmem_cache *cachep, /* constructor could break poison info */ if (DEBUG == 0 && cachep->ctor) { - kasan_unpoison_object_data(cachep, objp); + kasan_unpoison_new_object(cachep, objp); cachep->ctor(objp); - kasan_poison_object_data(cachep, objp); + kasan_poison_new_object(cachep, objp); } if (!shuffled) diff --git a/mm/slub.c b/mm/slub.c index 782bd8a6bd34..891742e5932a 100644 --- a/mm/slub.c +++ b/mm/slub.c @@ -1860,9 +1860,9 @@ static void *setup_object(struct kmem_cache *s, void *object) setup_object_debug(s, object); object = kasan_init_slab_obj(s, object); if (unlikely(s->ctor)) { - kasan_unpoison_object_data(s, object); + kasan_unpoison_new_object(s, object); s->ctor(object); - kasan_poison_object_data(s, object); + kasan_poison_new_object(s, object); } return object; } diff --git a/net/core/skbuff.c b/net/core/skbuff.c index b157efea5dea..63bb6526399d 100644 --- a/net/core/skbuff.c +++ b/net/core/skbuff.c @@ -337,7 +337,7 @@ static struct sk_buff *napi_skb_cache_get(void) } skb = nc->skb_cache[--nc->skb_count]; - kasan_unpoison_object_data(skbuff_cache, skb); + kasan_unpoison_new_object(skbuff_cache, skb); return skb; } @@ -1309,13 +1309,13 @@ static void napi_skb_cache_put(struct sk_buff *skb) struct napi_alloc_cache *nc = this_cpu_ptr(&napi_alloc_cache); u32 i; - kasan_poison_object_data(skbuff_cache, skb); + kasan_poison_new_object(skbuff_cache, skb); nc->skb_cache[nc->skb_count++] = skb; if (unlikely(nc->skb_count == NAPI_SKB_CACHE_SIZE)) { for (i = NAPI_SKB_CACHE_HALF; i < NAPI_SKB_CACHE_SIZE; i++) - kasan_unpoison_object_data(skbuff_cache, - nc->skb_cache[i]); + kasan_unpoison_new_object(skbuff_cache, + nc->skb_cache[i]); kmem_cache_free_bulk(skbuff_cache, NAPI_SKB_CACHE_HALF, nc->skb_cache + NAPI_SKB_CACHE_HALF); From patchwork Tue Dec 19 22:29:04 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: andrey.konovalov@linux.dev X-Patchwork-Id: 13499314 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id 100B3C41535 for ; Tue, 19 Dec 2023 22:32:36 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id BCF6E6B0099; Tue, 19 Dec 2023 17:32:33 -0500 (EST) Received: by kanga.kvack.org (Postfix, from userid 40) id ADDCF6B009C; Tue, 19 Dec 2023 17:32:33 -0500 (EST) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 934806B009D; Tue, 19 Dec 2023 17:32:33 -0500 (EST) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0017.hostedemail.com [216.40.44.17]) by kanga.kvack.org (Postfix) with ESMTP id 806E56B0099 for ; Tue, 19 Dec 2023 17:32:33 -0500 (EST) Received: from smtpin05.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay07.hostedemail.com (Postfix) with ESMTP id 575141603FC for ; Tue, 19 Dec 2023 22:32:33 +0000 (UTC) X-FDA: 81585018186.05.537D2C8 Received: from out-180.mta1.migadu.com (out-180.mta1.migadu.com [95.215.58.180]) by imf10.hostedemail.com (Postfix) with ESMTP id 72681C0025 for ; Tue, 19 Dec 2023 22:32:31 +0000 (UTC) Authentication-Results: imf10.hostedemail.com; dkim=pass header.d=linux.dev header.s=key1 header.b="ljf0/KaK"; dmarc=pass (policy=none) header.from=linux.dev; spf=pass (imf10.hostedemail.com: domain of andrey.konovalov@linux.dev designates 95.215.58.180 as permitted sender) smtp.mailfrom=andrey.konovalov@linux.dev ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1703025151; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references:dkim-signature; bh=e29xpsueqsta+pB4dpMwNezQWpITpFZrOcR7dgpqXnM=; b=8ZG8SzeObm4CeRIQf6KaCg3GkXDwSWOIY9w7RmX0r/NEX4RX2rNJ8ddYE3J51BndPukHXs eXoznj/C76lEmxDMAnPsWtcH0L6qy7+NAr3bpb8v3DpBxSVeT8c5T9QPkA7SFSB3boIVg9 MCBUO7WqG4+64HSEdDCT53Nt4KuLH9o= ARC-Authentication-Results: i=1; imf10.hostedemail.com; dkim=pass header.d=linux.dev header.s=key1 header.b="ljf0/KaK"; dmarc=pass (policy=none) header.from=linux.dev; spf=pass (imf10.hostedemail.com: domain of andrey.konovalov@linux.dev designates 95.215.58.180 as permitted sender) smtp.mailfrom=andrey.konovalov@linux.dev ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1703025151; a=rsa-sha256; cv=none; b=wU2P/HQeAaxm5j++Wg85D6+J/O6XdYAjRQdMktHuoCr1T2/d6PfboG7oFhy1Ovn6H9j0sj WGv2QWy5hybLH0KJl6lRDQf5n8wA5pO073LZp2mYYhjb3Zb9Kiqp9W2Lwl1sfnMafJj0x7 ZYvTyutBNhPuyYA0pUKPe/gkBxNlZ04= X-Report-Abuse: Please report any abuse attempt to abuse@migadu.com and include these headers. DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linux.dev; s=key1; t=1703025149; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=e29xpsueqsta+pB4dpMwNezQWpITpFZrOcR7dgpqXnM=; b=ljf0/KaKFmDC2Uyj9pcq18seQDB62a/kgliZneYzRVKag4kgTWvduY54lnptev/4IOVTKg XWh9fADptQruk8bYRvzl+jF0l8p4U0RNpQ3xZT3+C7DxlLuZnVWmBR0/EtI5V5z/V058ga q4EXpOfTgh0O1XTzevXYooHK4dHrhlQ= From: andrey.konovalov@linux.dev To: Marco Elver , Alexander Potapenko Cc: Andrey Konovalov , Dmitry Vyukov , Andrey Ryabinin , kasan-dev@googlegroups.com, Evgenii Stepanov , Breno Leitao , Alexander Lobakin , Andrew Morton , linux-mm@kvack.org, linux-kernel@vger.kernel.org, Andrey Konovalov Subject: [PATCH mm 20/21] skbuff: use mempool KASAN hooks Date: Tue, 19 Dec 2023 23:29:04 +0100 Message-Id: In-Reply-To: References: MIME-Version: 1.0 X-Migadu-Flow: FLOW_OUT X-Rspamd-Queue-Id: 72681C0025 X-Rspam-User: X-Rspamd-Server: rspam04 X-Stat-Signature: a7hijmnajbbmtrpfjt1y1awnh1us4jn4 X-HE-Tag: 1703025151-158419 X-HE-Meta: U2FsdGVkX19/kWDJR6VF9KrS7wYpEpkpuyU563eAO0tmz9O+9Jv26csmMrf1dm1FNYCT0aLt5PyIiZP1qFM0sc+mPIfd2fQlD2QnzWq49kH7/ZfBwRFrvIjTis+u9cSKCqAjZjft6B8lKg+I264mMRhFNTlIx3GhiEENnVoeUOHUXT9dPMl7F7Gr6t5I0tB14Y3K9HKxQsW8ixXSff6c/7q5Iyg6z9zaWgksqNCVcMrpu/TTc5n909cSgqdLQSRabjeTKyU2XhZAZem8lJq6Ww2cijPfHobmxKtcHlg0NYd3dhuZD7ZFCC0tY9pWp2KT1TP0i+mNldiSBXdk0ShqoMM9pUydQoPtTAqw0OjhTVuBSucNxB727hl1b1rQ8T1xAIk8nuZJMIGgWTreFz1t7PBcQm0brgHg0DOfQnvC7KjSPOtgAeMzHxWK5oyYSBnv2tf7HVwmHIGC81P2h75X2boSQZTNv7TCqbdZyytXr0thccV4Sdxykq1YNtRkjpbYkMq3nsrR7SZP42nxesHrupKO4SmN7rf4dkq6k+OafSdLQd5Wc1f2J99/X8epFn/44OiJHILD+DgnoiBeiwLAvVH7tChthXqIJmlZ4MCSSg6d9ke1X5/0X73ZMHGGxf/xkKDdOGz+Jl0iaLnAvhlLNsT4YziNGU5eWgKzdVN7VfLF4dTO/gQ9Ddi7wDUXS1okFwbw7MC8trwYTSBRkKSHc5/CAom+mmWT6MJGQoGC9QtgRS9zyus44K/sltRgdkV6650+GpJPUFyOA2kg/ca3bmlzouNcT4lIeNq6W3NqND8wSXZcxAT7KNAqlNo1vN3uZGpSqUAght8+UNXKrR/LMQXMLJY2AeLZ94WnGnbz05sGui94Sv4WholQGmP2Zsu5qMGYe3MhwQneutDHy32DsK90IoMUa4NtiY3j1z9ZIiAE4TyTfrJD6iyR2VxcpJbSSYwtPTAzgo7t+2NZU7X SvzihlAm DQWdcsFwTq4PXHDVZHfEMh/N2yNOkdZ9mJlctL5wsoPDLosOzcb2c8zYr/Uhn2ArN0VXrgWbxUfQyrDLZYG7ad0kGtb09dm8bIR1WYQE5sJzj0dwMKRCNhnaMdBZXYggrADLb/8SjyfgBEz1SqJntSTOk+oNU5SumiFmZFYCKDiOXTNLyhtQO4+m5x15QYG6lZNgosi6Es3d3etw= X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: List-Subscribe: List-Unsubscribe: From: Andrey Konovalov Instead of using slab-internal KASAN hooks for poisoning and unpoisoning cached objects, use the proper mempool KASAN hooks. Also check the return value of kasan_mempool_poison_object to prevent double-free and invali-free bugs. Signed-off-by: Andrey Konovalov --- net/core/skbuff.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/net/core/skbuff.c b/net/core/skbuff.c index 63bb6526399d..bb75b4272992 100644 --- a/net/core/skbuff.c +++ b/net/core/skbuff.c @@ -337,7 +337,7 @@ static struct sk_buff *napi_skb_cache_get(void) } skb = nc->skb_cache[--nc->skb_count]; - kasan_unpoison_new_object(skbuff_cache, skb); + kasan_mempool_unpoison_object(skb, kmem_cache_size(skbuff_cache)); return skb; } @@ -1309,13 +1309,15 @@ static void napi_skb_cache_put(struct sk_buff *skb) struct napi_alloc_cache *nc = this_cpu_ptr(&napi_alloc_cache); u32 i; - kasan_poison_new_object(skbuff_cache, skb); + if (!kasan_mempool_poison_object(skb)) + return; + nc->skb_cache[nc->skb_count++] = skb; if (unlikely(nc->skb_count == NAPI_SKB_CACHE_SIZE)) { for (i = NAPI_SKB_CACHE_HALF; i < NAPI_SKB_CACHE_SIZE; i++) - kasan_unpoison_new_object(skbuff_cache, - nc->skb_cache[i]); + kasan_mempool_unpoison_object(nc->skb_cache[i], + kmem_cache_size(skbuff_cache)); kmem_cache_free_bulk(skbuff_cache, NAPI_SKB_CACHE_HALF, nc->skb_cache + NAPI_SKB_CACHE_HALF); From patchwork Tue Dec 19 22:29:05 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: andrey.konovalov@linux.dev X-Patchwork-Id: 13499315 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id 2390BC41535 for ; Tue, 19 Dec 2023 22:32:38 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id 318996B009C; Tue, 19 Dec 2023 17:32:34 -0500 (EST) Received: by kanga.kvack.org (Postfix, from userid 40) id 27CAA6B009D; Tue, 19 Dec 2023 17:32:34 -0500 (EST) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 0F3056B00A0; Tue, 19 Dec 2023 17:32:33 -0500 (EST) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0014.hostedemail.com [216.40.44.14]) by kanga.kvack.org (Postfix) with ESMTP id D4D6D6B009D for ; Tue, 19 Dec 2023 17:32:33 -0500 (EST) Received: from smtpin04.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay03.hostedemail.com (Postfix) with ESMTP id AF85FA0413 for ; Tue, 19 Dec 2023 22:32:33 +0000 (UTC) X-FDA: 81585018186.04.D2A2146 Received: from out-187.mta1.migadu.com (out-187.mta1.migadu.com [95.215.58.187]) by imf23.hostedemail.com (Postfix) with ESMTP id 00873140019 for ; Tue, 19 Dec 2023 22:32:31 +0000 (UTC) Authentication-Results: imf23.hostedemail.com; dkim=pass header.d=linux.dev header.s=key1 header.b="PVS7/Vp9"; spf=pass (imf23.hostedemail.com: domain of andrey.konovalov@linux.dev designates 95.215.58.187 as permitted sender) smtp.mailfrom=andrey.konovalov@linux.dev; dmarc=pass (policy=none) header.from=linux.dev ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1703025152; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references:dkim-signature; bh=EPGVjwO+qP/d7FcuwPK2D6CcDKWjvT42oG4AsVrb0Go=; b=wH88nobEbW5JyTL4865UxmVo+gte1miKuRupm3F+1WMFXR4mtmnxshSabv2WIw3cZqTt1i AI6Vy3QPo98zwt3qForE/679brMB/x15eT7HnpRjUxmmAa3EffN6j5mWl6w5JxTF0EJAs0 gK8eMsC2w5Nc+vgYMhDBZp7PRSREOHc= ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1703025152; a=rsa-sha256; cv=none; b=NEBT87nlLQK1H6VMXI5DMpjsnA8r0ZEUWfSUzfcKK/mMB0QGLY4yS/DW2OUCVEFvNcnJ2N /DZRifuyhwsGLAP7tBjGiHUhPLrluB4/44hkAAo1AqphYANVKqwMjod82cEvOrSFWuASwT Z3vKSY6jzX7g2FVTmogqkvhwuPNQyaA= ARC-Authentication-Results: i=1; imf23.hostedemail.com; dkim=pass header.d=linux.dev header.s=key1 header.b="PVS7/Vp9"; spf=pass (imf23.hostedemail.com: domain of andrey.konovalov@linux.dev designates 95.215.58.187 as permitted sender) smtp.mailfrom=andrey.konovalov@linux.dev; dmarc=pass (policy=none) header.from=linux.dev X-Report-Abuse: Please report any abuse attempt to abuse@migadu.com and include these headers. DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linux.dev; s=key1; t=1703025150; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=EPGVjwO+qP/d7FcuwPK2D6CcDKWjvT42oG4AsVrb0Go=; b=PVS7/Vp9rKcCStvahkmREEOMnuEX6kau1z/8KUeJ+M+L9oh0S/muURork3hPcDgoR/5lvV ReB2LpYutwX5p3c63FdFGnocPloJeeIBz+IrzYNEY41q/t2SiRz0dp5ZLm4EF8f/mEHnF3 IzsuSBbMxsPovIvvYoBbisxMLMXLZwo= From: andrey.konovalov@linux.dev To: Marco Elver , Alexander Potapenko Cc: Andrey Konovalov , Dmitry Vyukov , Andrey Ryabinin , kasan-dev@googlegroups.com, Evgenii Stepanov , Breno Leitao , Alexander Lobakin , Andrew Morton , linux-mm@kvack.org, linux-kernel@vger.kernel.org, Andrey Konovalov Subject: [PATCH mm 21/21] io_uring: use mempool KASAN hook Date: Tue, 19 Dec 2023 23:29:05 +0100 Message-Id: In-Reply-To: References: MIME-Version: 1.0 X-Migadu-Flow: FLOW_OUT X-Stat-Signature: kmf39h38o9zm1u436opmpbouatpmex4d X-Rspamd-Server: rspam10 X-Rspamd-Queue-Id: 00873140019 X-Rspam-User: X-HE-Tag: 1703025151-835627 X-HE-Meta: U2FsdGVkX1+rum6i18OJ7DCQh5XaybgQHi5XVxx8vgm2VXZLSbrMeUv+xK0ra1qn0u3NAavbdTMetJIY+zGgDpdoopxSEZnMIEPQF/3fYA/Y0iVHKAfmhgoFsHeEMmf7aqJDx/Zdu4GSqqsE/g7Mjk3nI1isoMjfYnh0bLDvpUJEbk/269OmEr+7XwoaJxoLwbM6zJCVkAxglECusPVp68/CwEjpHQ9e7u3H8Vfr6AnVHJk98+ylSoarhJQupIcVEG/ody1wCRJdfVOOhRZw3nRqm7tf/7Zmi2F1pIoKfQvAyfmC03EKYZUu+nrQBT7BKWlyBHUPftNa6t8fxa4vQp7ovSYp67z6wZAvEM1Vi0hC3JDSEZ6XdRQH+vptigfVGLWsCfhM/D8G16qkSLsit8Odbqfq4f3S4ifHsc6QtzFheUHvy6I51ZKMkKD9hOstksJ1Gd/suEp9o3Ak9D4PTVzSUSxPCAKG5YgPbtvWRB1vivv0kckqF2E4n3M2bpE1r9flajIY0jlEZPIXgcdl/cyrKdU8OByQrStVwoCbk6RT/bTthgXOvQDvkW0aATpXrmGdM1KxqvdcWAs4cTZjok7rSWpIbSywFVYInD8EYph9MBbh+KbtukdvYL2fS2aoYOQ4HEkgRbxJO2IWIiZsJ5d5sL1ZcGRtJfwrKWhXeHXHSgeKe2+ucM4OQxlLoJ2W2gXmwazSTlI4OwZgrfLbZiNtuF1h9Utnnx1eUC76t65Vs5QKKDOge1oHo0da1SZomU/DFxahnVFXKFw3tRhTJP7pX19bOkfs0gRrvfL9620Ki17G6VQWdl0lYYmXoIpPuaKMkgvEl7QsmGNWkskMymL9YiXZmZCED+hl5fYqr2bwclvHBowDThHJEQHsGyHIPsq3M2XDkG1SEgZ7Oy7/I8sXXofBN4tl11FtKoxJqDnvmfVj0qduvZpfwNUULzzm/0JKK8d931JOzAKmz0t seLy+JP5 66HVJtYZJ7s9qtyFm+3JHvXY748hvcrH+8uf9BHWyeQKdwQuqBNv7V5yqFbApauoh345lAzF/Ds8TWq2JdumM+KPM7bhNLbEf4XDcpvlHUEnM8GyBNxl2J5iQvhW58d5EGumdWE50eSW3T/0LhYVohNyqBWWZpBgM8nK1NeG3THmI7CEi2i3EOTMzFs1bWarNBX2YSyA09p2h0kwm8LSueAaAuW+pQ3OqqWIl X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: List-Subscribe: List-Unsubscribe: From: Andrey Konovalov Use the proper kasan_mempool_unpoison_object hook for unpoisoning cached objects. A future change might also update io_uring to check the return value of kasan_mempool_poison_object to prevent double-free and invalid-free bugs. This proves to be non-trivial with the current way io_uring caches objects, so this is left out-of-scope of this series. Signed-off-by: Andrey Konovalov --- io_uring/alloc_cache.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/io_uring/alloc_cache.h b/io_uring/alloc_cache.h index 8de0414e8efe..bf2fb26a6539 100644 --- a/io_uring/alloc_cache.h +++ b/io_uring/alloc_cache.h @@ -33,7 +33,7 @@ static inline struct io_cache_entry *io_alloc_cache_get(struct io_alloc_cache *c struct io_cache_entry *entry; entry = container_of(cache->list.next, struct io_cache_entry, node); - kasan_unpoison_range(entry, cache->elem_size); + kasan_mempool_unpoison_object(entry, cache->elem_size); cache->list.next = cache->list.next->next; cache->nr_cached--; return entry;