From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753332AbbCPKrB (ORCPT ); Mon, 16 Mar 2015 06:47:01 -0400 Received: from mail-la0-f45.google.com ([209.85.215.45]:36539 "EHLO mail-la0-f45.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751472AbbCPKq7 (ORCPT ); Mon, 16 Mar 2015 06:46:59 -0400 From: Rasmus Villemoes To: David Rientjes Cc: Andrew Morton , Sebastian Ott , Mikulas Patocka , Catalin Marinas , linux-kernel@vger.kernel.org, linux-mm@kvack.org Subject: Re: [patch 1/2] mm, mempool: poison elements backed by slab allocator Organization: D03 References: X-Hashcash: 1:20:150316:mpatocka@redhat.com::nJ8FKMWWm00jcvTI:0000000000000000000000000000000000000000000YLO X-Hashcash: 1:20:150316:linux-mm@kvack.org::cjG1wLNBXPj9tbTf:00000000000000000000000000000000000000000000u0J X-Hashcash: 1:20:150316:rientjes@google.com::1P02JTHF6n68cJTv:0000000000000000000000000000000000000000001tzf X-Hashcash: 1:20:150316:catalin.marinas@arm.com::twFmQAPQ8m3+F9t6:0000000000000000000000000000000000000026FL X-Hashcash: 1:20:150316:sebott@linux.vnet.ibm.com::qMR/PIkVvE9BsJ5l:00000000000000000000000000000000000038Zv X-Hashcash: 1:20:150316:linux-kernel@vger.kernel.org::BZK5NrKRAcf449mr:0000000000000000000000000000000004tHR X-Hashcash: 1:20:150316:akpm@linux-foundation.org::CaETdCYo1/qDMvmX:0000000000000000000000000000000000006izM Date: Mon, 16 Mar 2015 11:46:56 +0100 In-Reply-To: (David Rientjes's message of "Mon, 9 Mar 2015 00:21:56 -0700 (PDT)") Message-ID: <8761a1dxsv.fsf@rasmusvillemoes.dk> User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/24.3 (gnu/linux) MIME-Version: 1.0 Content-Type: text/plain Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Mon, Mar 09 2015, David Rientjes wrote: > Mempools keep elements in a reserved pool for contexts in which > allocation may not be possible. When an element is allocated from the > reserved pool, its memory contents is the same as when it was added to > the reserved pool. > > Because of this, elements lack any free poisoning to detect > use-after-free errors. > > This patch adds free poisoning for elements backed by the slab allocator. > This is possible because the mempool layer knows the object size of each > element. > > When an element is added to the reserved pool, it is poisoned with > POISON_FREE. When it is removed from the reserved pool, the contents are > checked for POISON_FREE. If there is a mismatch, a warning is emitted to > the kernel log. > > + > +static void poison_slab_element(mempool_t *pool, void *element) > +{ > + if (pool->alloc == mempool_alloc_slab || > + pool->alloc == mempool_kmalloc) { > + size_t size = ksize(element); > + u8 *obj = element; > + > + memset(obj, POISON_FREE, size - 1); > + obj[size - 1] = POISON_END; > + } > +} Maybe a stupid question, but what happens if the underlying slab allocator has non-trivial ->ctor? Rasmus From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail-lb0-f179.google.com (mail-lb0-f179.google.com [209.85.217.179]) by kanga.kvack.org (Postfix) with ESMTP id D5D536B0032 for ; Mon, 16 Mar 2015 06:47:00 -0400 (EDT) Received: by lbbzq9 with SMTP id zq9so28427600lbb.0 for ; Mon, 16 Mar 2015 03:47:00 -0700 (PDT) Received: from mail-lb0-x22b.google.com (mail-lb0-x22b.google.com. [2a00:1450:4010:c04::22b]) by mx.google.com with ESMTPS id zj11si7765497lbb.148.2015.03.16.03.46.58 for (version=TLSv1.2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Mon, 16 Mar 2015 03:46:59 -0700 (PDT) Received: by lbcds1 with SMTP id ds1so28402434lbc.3 for ; Mon, 16 Mar 2015 03:46:58 -0700 (PDT) From: Rasmus Villemoes Subject: Re: [patch 1/2] mm, mempool: poison elements backed by slab allocator References: Date: Mon, 16 Mar 2015 11:46:56 +0100 In-Reply-To: (David Rientjes's message of "Mon, 9 Mar 2015 00:21:56 -0700 (PDT)") Message-ID: <8761a1dxsv.fsf@rasmusvillemoes.dk> MIME-Version: 1.0 Content-Type: text/plain Sender: owner-linux-mm@kvack.org List-ID: To: David Rientjes Cc: Andrew Morton , Sebastian Ott , Mikulas Patocka , Catalin Marinas , linux-kernel@vger.kernel.org, linux-mm@kvack.org On Mon, Mar 09 2015, David Rientjes wrote: > Mempools keep elements in a reserved pool for contexts in which > allocation may not be possible. When an element is allocated from the > reserved pool, its memory contents is the same as when it was added to > the reserved pool. > > Because of this, elements lack any free poisoning to detect > use-after-free errors. > > This patch adds free poisoning for elements backed by the slab allocator. > This is possible because the mempool layer knows the object size of each > element. > > When an element is added to the reserved pool, it is poisoned with > POISON_FREE. When it is removed from the reserved pool, the contents are > checked for POISON_FREE. If there is a mismatch, a warning is emitted to > the kernel log. > > + > +static void poison_slab_element(mempool_t *pool, void *element) > +{ > + if (pool->alloc == mempool_alloc_slab || > + pool->alloc == mempool_kmalloc) { > + size_t size = ksize(element); > + u8 *obj = element; > + > + memset(obj, POISON_FREE, size - 1); > + obj[size - 1] = POISON_END; > + } > +} Maybe a stupid question, but what happens if the underlying slab allocator has non-trivial ->ctor? Rasmus -- To unsubscribe, send a message with 'unsubscribe linux-mm' in the body to majordomo@kvack.org. For more info on Linux MM, see: http://www.linux-mm.org/ . Don't email: email@kvack.org