From: Andrey Konovalov <andreyknvl@google.com> To: Andrey Ryabinin <aryabinin@virtuozzo.com>, Alexander Potapenko <glider@google.com>, Dmitry Vyukov <dvyukov@google.com>, Catalin Marinas <catalin.marinas@arm.com>, Will Deacon <will.deacon@arm.com>, Christoph Lameter <cl@linux.com>, Andrew Morton <akpm@linux-foundation.org>, Mark Rutland <mark.rutland@arm.com>, Nick Desaulniers <ndesaulniers@google.com>, Marc Zyngier <marc.zyngier@arm.com>, Dave Martin <dave.martin@arm.com>, Ard Biesheuvel <ard.biesheuvel@linaro.org>, "Eric W . Biederman" <ebiederm@xmission.com>, Ingo Molnar <mingo@kernel.org>, Paul Lawrence <paullawrence@google.com>, Geert Uytterhoeven <geert@linux-m68k.org>, Arnd Bergmann <arnd@arndb.de>, "Kirill A . Shutemov" <kirill.shutemov@linux.intel.com>, Greg Kroah-Hartman <gregkh@linuxfoundation.org>, Kate Stewart <kstewart@linuxfoundation.org>, Mike Rapoport <rppt@linux.vnet.ibm.com>, kasan-dev@googlegroups.com, linux-doc@vger.kernel.org, linux-kernel@vger.kernel.org, linux-arm-kernel@lists.infradead.org, linux-sparse@vger.kernel.org, linux-mm@kvack.org, linux-kbuild@vger.kernel.org Cc: Kostya Serebryany <kcc@google.com>, Evgeniy Stepanov <eugenis@google.com>, Lee Smith <Lee.Smith@arm.com>, Ramana Radhakrishnan <Ramana.Radhakrishnan@arm.com>, Jacob Bramley <Jacob.Bramley@arm.com>, Ruben Ayrapetyan <Ruben.Ayrapetyan@arm.com>, Jann Horn <jannh@google.com>, Mark Brand <markbrand@google.com>, Chintan Pandya <cpandya@codeaurora.org>, Vishwath Mohan <vishwath@google.com>, Andrey Konovalov <andreyknvl@google.com> Subject: [PATCH v6 08/18] khwasan: preassign tags to objects with ctors or SLAB_TYPESAFE_BY_RCU Date: Wed, 29 Aug 2018 13:35:12 +0200 [thread overview] Message-ID: <95b5beb7ec13b7e998efe84c9a7a5c1fa49a9fe3.1535462971.git.andreyknvl@google.com> (raw) In-Reply-To: <cover.1535462971.git.andreyknvl@google.com> An object constructor can initialize pointers within this objects based on the address of the object. Since the object address might be tagged, we need to assign a tag before calling constructor. The implemented approach is to assign tags to objects with constructors when a slab is allocated and call constructors once as usual. The downside is that such object would always have the same tag when it is reallocated, so we won't catch use-after-frees on it. Also pressign tags for objects from SLAB_TYPESAFE_BY_RCU caches, since they can be validy accessed after having been freed. Signed-off-by: Andrey Konovalov <andreyknvl@google.com> --- mm/slab.c | 6 +++++- mm/slub.c | 4 ++++ 2 files changed, 9 insertions(+), 1 deletion(-) diff --git a/mm/slab.c b/mm/slab.c index 6fdca9ec2ea4..3b4227059f2e 100644 --- a/mm/slab.c +++ b/mm/slab.c @@ -403,7 +403,11 @@ static inline struct kmem_cache *virt_to_cache(const void *obj) static inline void *index_to_obj(struct kmem_cache *cache, struct page *page, unsigned int idx) { - return page->s_mem + cache->size * idx; + void *obj; + + obj = page->s_mem + cache->size * idx; + obj = khwasan_preset_slab_tag(cache, idx, obj); + return obj; } /* diff --git a/mm/slub.c b/mm/slub.c index 4206e1b616e7..086d6558a6b6 100644 --- a/mm/slub.c +++ b/mm/slub.c @@ -1531,12 +1531,14 @@ static bool shuffle_freelist(struct kmem_cache *s, struct page *page) /* First entry is used as the base of the freelist */ cur = next_freelist_entry(s, page, &pos, start, page_limit, freelist_count); + cur = khwasan_preset_slub_tag(s, cur); page->freelist = cur; for (idx = 1; idx < page->objects; idx++) { setup_object(s, page, cur); next = next_freelist_entry(s, page, &pos, start, page_limit, freelist_count); + next = khwasan_preset_slub_tag(s, next); set_freepointer(s, cur, next); cur = next; } @@ -1613,8 +1615,10 @@ static struct page *allocate_slab(struct kmem_cache *s, gfp_t flags, int node) shuffle = shuffle_freelist(s, page); if (!shuffle) { + start = khwasan_preset_slub_tag(s, start); for_each_object_idx(p, idx, s, start, page->objects) { setup_object(s, page, p); + p = khwasan_preset_slub_tag(s, p); if (likely(idx < page->objects)) set_freepointer(s, p, p + s->size); else -- 2.19.0.rc0.228.g281dcd1b4d0-goog
WARNING: multiple messages have this Message-ID (diff)
From: andreyknvl@google.com (Andrey Konovalov) To: linux-arm-kernel@lists.infradead.org Subject: [PATCH v6 08/18] khwasan: preassign tags to objects with ctors or SLAB_TYPESAFE_BY_RCU Date: Wed, 29 Aug 2018 13:35:12 +0200 [thread overview] Message-ID: <95b5beb7ec13b7e998efe84c9a7a5c1fa49a9fe3.1535462971.git.andreyknvl@google.com> (raw) In-Reply-To: <cover.1535462971.git.andreyknvl@google.com> An object constructor can initialize pointers within this objects based on the address of the object. Since the object address might be tagged, we need to assign a tag before calling constructor. The implemented approach is to assign tags to objects with constructors when a slab is allocated and call constructors once as usual. The downside is that such object would always have the same tag when it is reallocated, so we won't catch use-after-frees on it. Also pressign tags for objects from SLAB_TYPESAFE_BY_RCU caches, since they can be validy accessed after having been freed. Signed-off-by: Andrey Konovalov <andreyknvl@google.com> --- mm/slab.c | 6 +++++- mm/slub.c | 4 ++++ 2 files changed, 9 insertions(+), 1 deletion(-) diff --git a/mm/slab.c b/mm/slab.c index 6fdca9ec2ea4..3b4227059f2e 100644 --- a/mm/slab.c +++ b/mm/slab.c @@ -403,7 +403,11 @@ static inline struct kmem_cache *virt_to_cache(const void *obj) static inline void *index_to_obj(struct kmem_cache *cache, struct page *page, unsigned int idx) { - return page->s_mem + cache->size * idx; + void *obj; + + obj = page->s_mem + cache->size * idx; + obj = khwasan_preset_slab_tag(cache, idx, obj); + return obj; } /* diff --git a/mm/slub.c b/mm/slub.c index 4206e1b616e7..086d6558a6b6 100644 --- a/mm/slub.c +++ b/mm/slub.c @@ -1531,12 +1531,14 @@ static bool shuffle_freelist(struct kmem_cache *s, struct page *page) /* First entry is used as the base of the freelist */ cur = next_freelist_entry(s, page, &pos, start, page_limit, freelist_count); + cur = khwasan_preset_slub_tag(s, cur); page->freelist = cur; for (idx = 1; idx < page->objects; idx++) { setup_object(s, page, cur); next = next_freelist_entry(s, page, &pos, start, page_limit, freelist_count); + next = khwasan_preset_slub_tag(s, next); set_freepointer(s, cur, next); cur = next; } @@ -1613,8 +1615,10 @@ static struct page *allocate_slab(struct kmem_cache *s, gfp_t flags, int node) shuffle = shuffle_freelist(s, page); if (!shuffle) { + start = khwasan_preset_slub_tag(s, start); for_each_object_idx(p, idx, s, start, page->objects) { setup_object(s, page, p); + p = khwasan_preset_slub_tag(s, p); if (likely(idx < page->objects)) set_freepointer(s, p, p + s->size); else -- 2.19.0.rc0.228.g281dcd1b4d0-goog
next prev parent reply other threads:[~2018-08-29 11:35 UTC|newest] Thread overview: 148+ messages / expand[flat|nested] mbox.gz Atom feed top 2018-08-29 11:35 [PATCH v6 00/18] khwasan: kernel hardware assisted address sanitizer Andrey Konovalov 2018-08-29 11:35 ` Andrey Konovalov 2018-08-29 11:35 ` Andrey Konovalov 2018-08-29 11:35 ` [PATCH v6 01/18] khwasan, mm: change kasan hooks signatures Andrey Konovalov 2018-08-29 11:35 ` Andrey Konovalov 2018-08-29 11:35 ` [PATCH v6 02/18] khwasan: move common kasan and khwasan code to common.c Andrey Konovalov 2018-08-29 11:35 ` Andrey Konovalov 2018-08-29 11:35 ` [PATCH v6 03/18] khwasan: add CONFIG_KASAN_GENERIC and CONFIG_KASAN_HW Andrey Konovalov 2018-08-29 11:35 ` Andrey Konovalov 2018-09-12 14:47 ` Dmitry Vyukov 2018-09-12 14:47 ` Dmitry Vyukov 2018-09-12 14:47 ` Dmitry Vyukov 2018-09-12 14:51 ` Dmitry Vyukov 2018-09-12 14:51 ` Dmitry Vyukov 2018-09-12 14:51 ` Dmitry Vyukov 2018-09-17 18:42 ` Andrey Konovalov 2018-09-17 18:42 ` Andrey Konovalov 2018-09-17 18:42 ` Andrey Konovalov 2018-08-29 11:35 ` [PATCH v6 04/18] khwasan, arm64: adjust shadow size for CONFIG_KASAN_HW Andrey Konovalov 2018-08-29 11:35 ` Andrey Konovalov 2018-09-12 14:54 ` Dmitry Vyukov 2018-09-12 14:54 ` Dmitry Vyukov 2018-09-12 14:54 ` Dmitry Vyukov 2018-09-19 17:27 ` Andrey Konovalov 2018-09-19 17:27 ` Andrey Konovalov 2018-09-19 17:27 ` Andrey Konovalov 2018-08-29 11:35 ` [PATCH v6 05/18] khwasan: initialize shadow to 0xff Andrey Konovalov 2018-08-29 11:35 ` Andrey Konovalov 2018-08-29 11:35 ` [PATCH v6 06/18] khwasan, arm64: untag virt address in __kimg_to_phys and _virt_addr_is_linear Andrey Konovalov 2018-08-29 11:35 ` Andrey Konovalov 2018-09-12 16:33 ` Dmitry Vyukov 2018-09-12 16:33 ` Dmitry Vyukov 2018-09-12 16:33 ` Dmitry Vyukov 2018-09-18 17:09 ` Andrey Konovalov 2018-09-18 17:09 ` Andrey Konovalov 2018-09-18 17:09 ` Andrey Konovalov 2018-08-29 11:35 ` [PATCH v6 07/18] khwasan: add tag related helper functions Andrey Konovalov 2018-08-29 11:35 ` Andrey Konovalov 2018-08-29 11:35 ` Andrey Konovalov 2018-09-12 16:21 ` Dmitry Vyukov 2018-09-12 16:21 ` Dmitry Vyukov 2018-09-12 16:21 ` Dmitry Vyukov 2018-09-17 18:59 ` Andrey Konovalov 2018-09-17 18:59 ` Andrey Konovalov 2018-09-17 18:59 ` Andrey Konovalov 2018-09-18 15:45 ` Dmitry Vyukov 2018-09-18 15:45 ` Dmitry Vyukov 2018-09-18 15:45 ` Dmitry Vyukov 2018-08-29 11:35 ` Andrey Konovalov [this message] 2018-08-29 11:35 ` [PATCH v6 08/18] khwasan: preassign tags to objects with ctors or SLAB_TYPESAFE_BY_RCU Andrey Konovalov 2018-09-04 15:17 ` Christopher Lameter 2018-09-12 16:36 ` Dmitry Vyukov 2018-09-12 16:36 ` Dmitry Vyukov 2018-09-12 16:36 ` Dmitry Vyukov 2018-09-18 16:50 ` Andrey Konovalov 2018-09-18 16:50 ` Andrey Konovalov 2018-09-18 16:50 ` Andrey Konovalov 2018-08-29 11:35 ` [PATCH v6 09/18] khwasan, arm64: fix up fault handling logic Andrey Konovalov 2018-08-29 11:35 ` Andrey Konovalov 2018-08-29 11:35 ` [PATCH v6 10/18] khwasan, arm64: enable top byte ignore for the kernel Andrey Konovalov 2018-08-29 11:35 ` Andrey Konovalov 2018-08-29 11:35 ` [PATCH v6 11/18] khwasan, mm: perform untagged pointers comparison in krealloc Andrey Konovalov 2018-08-29 11:35 ` Andrey Konovalov 2018-09-04 15:18 ` Christopher Lameter 2018-08-29 11:35 ` [PATCH v6 12/18] khwasan: split out kasan_report.c from report.c Andrey Konovalov 2018-08-29 11:35 ` Andrey Konovalov 2018-08-29 11:35 ` [PATCH v6 13/18] khwasan: add bug reporting routines Andrey Konovalov 2018-08-29 11:35 ` Andrey Konovalov 2018-09-12 17:50 ` Dmitry Vyukov 2018-09-12 17:50 ` Dmitry Vyukov 2018-09-12 17:50 ` Dmitry Vyukov 2018-09-18 17:36 ` Andrey Konovalov 2018-09-18 17:36 ` Andrey Konovalov 2018-09-18 17:36 ` Andrey Konovalov 2018-08-29 11:35 ` [PATCH v6 14/18] khwasan: add hooks implementation Andrey Konovalov 2018-08-29 11:35 ` Andrey Konovalov 2018-09-12 18:30 ` Dmitry Vyukov 2018-09-12 18:30 ` Dmitry Vyukov 2018-09-12 18:30 ` Dmitry Vyukov 2018-09-19 11:54 ` Andrey Konovalov 2018-09-19 11:54 ` Andrey Konovalov 2018-09-19 11:54 ` Andrey Konovalov 2018-08-29 11:35 ` [PATCH v6 15/18] khwasan, arm64: add brk handler for inline instrumentation Andrey Konovalov 2018-08-29 11:35 ` Andrey Konovalov 2018-09-12 17:13 ` Dmitry Vyukov 2018-09-12 17:13 ` Dmitry Vyukov 2018-09-12 17:13 ` Dmitry Vyukov 2018-09-17 19:12 ` Andrey Konovalov 2018-09-17 19:12 ` Andrey Konovalov 2018-09-17 19:12 ` Andrey Konovalov 2018-09-12 17:15 ` Dmitry Vyukov 2018-09-12 17:15 ` Dmitry Vyukov 2018-09-12 17:15 ` Dmitry Vyukov 2018-09-12 17:39 ` Jann Horn 2018-09-12 17:39 ` Jann Horn 2018-09-12 17:39 ` Jann Horn 2018-09-13 8:37 ` Dmitry Vyukov 2018-09-13 8:37 ` Dmitry Vyukov 2018-09-13 8:37 ` Dmitry Vyukov 2018-09-13 18:09 ` Nick Desaulniers 2018-09-13 18:09 ` Nick Desaulniers 2018-09-13 18:09 ` Nick Desaulniers 2018-09-13 18:23 ` Jann Horn 2018-09-13 18:23 ` Jann Horn 2018-09-13 18:23 ` Jann Horn 2018-09-14 5:11 ` Dmitry Vyukov 2018-09-14 5:11 ` Dmitry Vyukov 2018-09-14 5:11 ` Dmitry Vyukov 2018-08-29 11:35 ` [PATCH v6 16/18] khwasan, mm, arm64: tag non slab memory allocated via pagealloc Andrey Konovalov 2018-08-29 11:35 ` Andrey Konovalov 2018-09-07 16:06 ` Andrey Ryabinin 2018-09-07 16:06 ` Andrey Ryabinin 2018-09-11 16:10 ` Andrey Konovalov 2018-09-11 16:10 ` Andrey Konovalov 2018-09-11 16:10 ` Andrey Konovalov 2018-08-29 11:35 ` [PATCH v6 17/18] khwasan: update kasan documentation Andrey Konovalov 2018-08-29 11:35 ` Andrey Konovalov 2018-09-12 18:39 ` Dmitry Vyukov 2018-09-12 18:39 ` Dmitry Vyukov 2018-09-12 18:39 ` Dmitry Vyukov 2018-09-18 18:42 ` Andrey Konovalov 2018-09-18 18:42 ` Andrey Konovalov 2018-09-18 18:42 ` Andrey Konovalov 2018-08-29 11:35 ` [PATCH v6 18/18] kasan: add SPDX-License-Identifier mark to source files Andrey Konovalov 2018-08-29 11:35 ` Andrey Konovalov 2018-09-05 21:10 ` [PATCH v6 00/18] khwasan: kernel hardware assisted address sanitizer Andrew Morton 2018-09-05 21:10 ` Andrew Morton 2018-09-05 21:10 ` Andrew Morton 2018-09-05 21:55 ` Nick Desaulniers 2018-09-05 21:55 ` Nick Desaulniers 2018-09-05 21:55 ` Nick Desaulniers 2018-09-06 10:05 ` Will Deacon 2018-09-06 10:05 ` Will Deacon 2018-09-06 10:05 ` Will Deacon 2018-09-06 11:06 ` Andrey Konovalov 2018-09-06 11:06 ` Andrey Konovalov 2018-09-06 11:06 ` Andrey Konovalov 2018-09-06 16:39 ` Nick Desaulniers 2018-09-06 16:39 ` Nick Desaulniers 2018-09-06 16:39 ` Nick Desaulniers 2018-09-14 15:28 ` Will Deacon 2018-09-14 15:28 ` Will Deacon 2018-09-14 15:28 ` Will Deacon 2018-09-19 18:53 ` Andrey Konovalov 2018-09-19 18:53 ` Andrey Konovalov 2018-09-19 18:53 ` Andrey Konovalov 2018-09-07 16:10 ` Andrey Ryabinin 2018-09-07 16:10 ` Andrey Ryabinin
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=95b5beb7ec13b7e998efe84c9a7a5c1fa49a9fe3.1535462971.git.andreyknvl@google.com \ --to=andreyknvl@google.com \ --cc=Jacob.Bramley@arm.com \ --cc=Lee.Smith@arm.com \ --cc=Ramana.Radhakrishnan@arm.com \ --cc=Ruben.Ayrapetyan@arm.com \ --cc=akpm@linux-foundation.org \ --cc=ard.biesheuvel@linaro.org \ --cc=arnd@arndb.de \ --cc=aryabinin@virtuozzo.com \ --cc=catalin.marinas@arm.com \ --cc=cl@linux.com \ --cc=cpandya@codeaurora.org \ --cc=dave.martin@arm.com \ --cc=dvyukov@google.com \ --cc=ebiederm@xmission.com \ --cc=eugenis@google.com \ --cc=geert@linux-m68k.org \ --cc=glider@google.com \ --cc=gregkh@linuxfoundation.org \ --cc=jannh@google.com \ --cc=kasan-dev@googlegroups.com \ --cc=kcc@google.com \ --cc=kirill.shutemov@linux.intel.com \ --cc=kstewart@linuxfoundation.org \ --cc=linux-arm-kernel@lists.infradead.org \ --cc=linux-doc@vger.kernel.org \ --cc=linux-kbuild@vger.kernel.org \ --cc=linux-kernel@vger.kernel.org \ --cc=linux-mm@kvack.org \ --cc=linux-sparse@vger.kernel.org \ --cc=marc.zyngier@arm.com \ --cc=mark.rutland@arm.com \ --cc=markbrand@google.com \ --cc=mingo@kernel.org \ --cc=ndesaulniers@google.com \ --cc=paullawrence@google.com \ --cc=rppt@linux.vnet.ibm.com \ --cc=vishwath@google.com \ --cc=will.deacon@arm.com \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: linkBe sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.