From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-0.9 required=3.0 tests=DKIMWL_WL_HIGH,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS,MAILING_LIST_MULTI, SPF_HELO_NONE,SPF_PASS autolearn=no autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 0796AC2BA19 for ; Wed, 15 Apr 2020 17:08:00 +0000 (UTC) Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by mail.kernel.org (Postfix) with ESMTP id B0A5020737 for ; Wed, 15 Apr 2020 17:07:59 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=pass (1024-bit key) header.d=chromium.org header.i=@chromium.org header.b="WOrure74" DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org B0A5020737 Authentication-Results: mail.kernel.org; dmarc=fail (p=none dis=none) header.from=chromium.org Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=owner-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix) id 408E18E002B; Wed, 15 Apr 2020 13:07:59 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id 3BA768E0001; Wed, 15 Apr 2020 13:07:59 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 2CFD08E002B; Wed, 15 Apr 2020 13:07:59 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from forelay.hostedemail.com (smtprelay0046.hostedemail.com [216.40.44.46]) by kanga.kvack.org (Postfix) with ESMTP id 15F6F8E0001 for ; Wed, 15 Apr 2020 13:07:59 -0400 (EDT) Received: from smtpin28.hostedemail.com (10.5.19.251.rfc1918.com [10.5.19.251]) by forelay02.hostedemail.com (Postfix) with ESMTP id C4BE7582A for ; Wed, 15 Apr 2020 17:07:58 +0000 (UTC) X-FDA: 76710721836.28.cream71_45a0f391d1643 X-HE-Tag: cream71_45a0f391d1643 X-Filterd-Recvd-Size: 4676 Received: from mail-pf1-f195.google.com (mail-pf1-f195.google.com [209.85.210.195]) by imf31.hostedemail.com (Postfix) with ESMTP for ; Wed, 15 Apr 2020 17:07:58 +0000 (UTC) Received: by mail-pf1-f195.google.com with SMTP id u9so238570pfm.10 for ; Wed, 15 Apr 2020 10:07:58 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=chromium.org; s=google; h=date:from:to:cc:subject:message-id:references:mime-version :content-disposition:in-reply-to; bh=SZTn8f5/ghABE2L+wwiDBAnMI1J6XO6NwwAptX7OWP0=; b=WOrure743n6ft1s07FVn0NwHK6vwcWjeEwetN3ZkLfSzegAsd/VhTAKLalCRU+GnVk 5IZUzwlK1Mvax+fJO1YUC2PNGNLi8+weo1M5UraobLGXuTxvPHKck8zdjvZRknLFJWhg n4MTQ0RFTpLKjk2g/rBr+AMqh3JGKBsZlr9iE= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:date:from:to:cc:subject:message-id:references :mime-version:content-disposition:in-reply-to; bh=SZTn8f5/ghABE2L+wwiDBAnMI1J6XO6NwwAptX7OWP0=; b=lofbsRq9t0yW5VodYJjHQC3woHoAHdo7UkJcewFoN7CcKrWYG13w1xnCz8W/R4acvS ltipPovQnT9TMSKFOrBFDJ3yxYHTVKrZ1/svwU9ek5PxqjDkisYmClmZLrNzEXhNiXmC 4AEUUDnVNeFzTuCuFG1fbtK5eudoiN9go0Uz/j3uvFM8Oa92e2YHJFpaJplI8Rg00iza MvymjdXu097hXbahyDxrN8IngmvyfzAK5RmgPqrDs/Pu10td6x9AsM9l2+dTtGnLhpmR IOlSi4pyjQghXv2JR4cJ5GJxzr3EOAihvq8A3gWEAvcI4yeyAOCX2dQDA3YNIyIx/Z1a qErA== X-Gm-Message-State: AGi0PuafcLPu+68LvsPUlP/vLPlcfgL3lKyFrE71kMENnhu7TaSKABTg BrKUBX3Ayix2BgXY4DoRPa5i6g== X-Google-Smtp-Source: APiQypLhytxxym9lcpqpurx9Pnzqt2ZWOluFYgANfWlYHPO++l0BoaZPGtlP70ys5Ls9FpTIQaL9ZQ== X-Received: by 2002:a63:cf0b:: with SMTP id j11mr25945533pgg.404.1586970477218; Wed, 15 Apr 2020 10:07:57 -0700 (PDT) Received: from www.outflux.net (smtp.outflux.net. [198.145.64.163]) by smtp.gmail.com with ESMTPSA id a136sm11469021pfa.99.2020.04.15.10.07.55 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 15 Apr 2020 10:07:56 -0700 (PDT) Date: Wed, 15 Apr 2020 10:07:54 -0700 From: Kees Cook To: Marco Elver Cc: Andrew Morton , cl@linux.com, iamjoonsoo.kim@lge.com, linux-mm@kvack.org, mm-commits@vger.kernel.org, penberg@kernel.org, rientjes@google.com, silvio.cesare@gmail.com, torvalds@linux-foundation.org, vnik@duasynt.com Subject: Re: [patch 025/155] slub: relocate freelist pointer to middle of object Message-ID: <202004151001.C6B5AB7@keescook> References: <20200401210155.09e3b9742e1c6e732f5a7250@linux-foundation.org> <20200402040427.WyxceElzI%akpm@linux-foundation.org> <20200415164726.GA234932@google.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20200415164726.GA234932@google.com> X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: On Wed, Apr 15, 2020 at 06:47:26PM +0200, Marco Elver wrote: > On Wed, 01 Apr 2020, Andrew Morton wrote: > > From: Kees Cook > > Subject: slub: relocate freelist pointer to middle of object > > [...] > > With kernel v5.7-rc1 I am unable to boot when using the SLUB allocator > and red zoning (slub_debug=Z), but otherwise a default config. Bisect > points to this patch, and when reverting it, the kernel boots again. > > Splat: > [...] > [ 0.328713] rcu: Hierarchical RCU implementation. > [ 0.329169] rcu: RCU event tracing is enabled. > [ 0.329611] rcu: RCU restricting CPUs from NR_CPUS=64 to nr_cpu_ids=8. > [ 0.330251] rcu: RCU calculated value of scheduler-enlistment delay is 100 jiffies. > [ 0.330984] rcu: Adjusting geometry for rcu_fanout_leaf=16, nr_cpu_ids=8 > [ 0.332130] NR_IRQS: 4352, nr_irqs: 488, preallocated irqs: 16 > [ 0.332713] general protection fault, probably for non-canonical address 0xccccccccccccccd4: 0000 [#1] SMP PTI > [ 0.333680] CPU: 0 PID: 0 Comm: swapper/0 Not tainted 5.7.0-rc1+ #3 > [ 0.334280] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1 04/01/2014 > [ 0.335079] RIP: 0010:deactivate_slab.isra.0+0x5b/0x460 Thanks for the report! It seems something isn't using get_freepointer() (and is missing the s->offset calculation). I will try to track it down... > Can you reproduce this? Let me know if you need more information. Yup! I see a crash in the same place with slub_debug=Z. Since I'm building with CONFIG_SLAB_FREELIST_HARDENED=y, I see a random number instead of 0xccccccccccccccd4. I'll keep digging... -- Kees Cook