From: David Rientjes <rientjes@google.com> To: Andrew Morton <akpm@linux-foundation.org> Cc: Sebastian Ott <sebott@linux.vnet.ibm.com>, Mikulas Patocka <mpatocka@redhat.com>, Catalin Marinas <catalin.marinas@arm.com>, linux-kernel@vger.kernel.org, linux-mm@kvack.org Subject: [patch 1/2] mm, mempool: poison elements backed by slab allocator Date: Mon, 9 Mar 2015 00:21:56 -0700 (PDT) [thread overview] Message-ID: <alpine.DEB.2.10.1503090021380.19148@chino.kir.corp.google.com> (raw) Mempools keep elements in a reserved pool for contexts in which allocation may not be possible. When an element is allocated from the reserved pool, its memory contents is the same as when it was added to the reserved pool. Because of this, elements lack any free poisoning to detect use-after-free errors. This patch adds free poisoning for elements backed by the slab allocator. This is possible because the mempool layer knows the object size of each element. When an element is added to the reserved pool, it is poisoned with POISON_FREE. When it is removed from the reserved pool, the contents are checked for POISON_FREE. If there is a mismatch, a warning is emitted to the kernel log. This is only effective for configs with CONFIG_DEBUG_VM. Signed-off-by: David Rientjes <rientjes@google.com> --- mm/mempool.c | 65 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++-- 1 file changed, 63 insertions(+), 2 deletions(-) diff --git a/mm/mempool.c b/mm/mempool.c --- a/mm/mempool.c +++ b/mm/mempool.c @@ -16,16 +16,77 @@ #include <linux/blkdev.h> #include <linux/writeback.h> +#ifdef CONFIG_DEBUG_VM +static void poison_error(mempool_t *pool, void *element, size_t size, + size_t byte) +{ + const int nr = pool->curr_nr; + const int start = max_t(int, byte - (BITS_PER_LONG / 8), 0); + const int end = min_t(int, byte + (BITS_PER_LONG / 8), size); + int i; + + pr_err("BUG: mempool element poison mismatch\n"); + pr_err("Mempool %p size %ld\n", pool, size); + pr_err(" nr=%d @ %p: %s0x", nr, element, start > 0 ? "... " : ""); + for (i = start; i < end; i++) + pr_cont("%x ", *(u8 *)(element + i)); + pr_cont("%s\n", end < size ? "..." : ""); + dump_stack(); +} + +static void check_slab_element(mempool_t *pool, void *element) +{ + if (pool->free == mempool_free_slab || pool->free == mempool_kfree) { + size_t size = ksize(element); + u8 *obj = element; + size_t i; + + for (i = 0; i < size; i++) { + u8 exp = (i < size - 1) ? POISON_FREE : POISON_END; + + if (obj[i] != exp) { + poison_error(pool, element, size, i); + return; + } + } + memset(obj, POISON_INUSE, size); + } +} + +static void poison_slab_element(mempool_t *pool, void *element) +{ + if (pool->alloc == mempool_alloc_slab || + pool->alloc == mempool_kmalloc) { + size_t size = ksize(element); + u8 *obj = element; + + memset(obj, POISON_FREE, size - 1); + obj[size - 1] = POISON_END; + } +} +#else /* CONFIG_DEBUG_VM */ +static inline void check_slab_element(mempool_t *pool, void *element) +{ +} +static inline void poison_slab_element(mempool_t *pool, void *element) +{ +} +#endif /* CONFIG_DEBUG_VM */ + static void add_element(mempool_t *pool, void *element) { BUG_ON(pool->curr_nr >= pool->min_nr); + poison_slab_element(pool, element); pool->elements[pool->curr_nr++] = element; } static void *remove_element(mempool_t *pool) { - BUG_ON(pool->curr_nr <= 0); - return pool->elements[--pool->curr_nr]; + void *element = pool->elements[--pool->curr_nr]; + + BUG_ON(pool->curr_nr < 0); + check_slab_element(pool, element); + return element; } /**
WARNING: multiple messages have this Message-ID (diff)
From: David Rientjes <rientjes@google.com> To: Andrew Morton <akpm@linux-foundation.org> Cc: Sebastian Ott <sebott@linux.vnet.ibm.com>, Mikulas Patocka <mpatocka@redhat.com>, Catalin Marinas <catalin.marinas@arm.com>, linux-kernel@vger.kernel.org, linux-mm@kvack.org Subject: [patch 1/2] mm, mempool: poison elements backed by slab allocator Date: Mon, 9 Mar 2015 00:21:56 -0700 (PDT) [thread overview] Message-ID: <alpine.DEB.2.10.1503090021380.19148@chino.kir.corp.google.com> (raw) Mempools keep elements in a reserved pool for contexts in which allocation may not be possible. When an element is allocated from the reserved pool, its memory contents is the same as when it was added to the reserved pool. Because of this, elements lack any free poisoning to detect use-after-free errors. This patch adds free poisoning for elements backed by the slab allocator. This is possible because the mempool layer knows the object size of each element. When an element is added to the reserved pool, it is poisoned with POISON_FREE. When it is removed from the reserved pool, the contents are checked for POISON_FREE. If there is a mismatch, a warning is emitted to the kernel log. This is only effective for configs with CONFIG_DEBUG_VM. Signed-off-by: David Rientjes <rientjes@google.com> --- mm/mempool.c | 65 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++-- 1 file changed, 63 insertions(+), 2 deletions(-) diff --git a/mm/mempool.c b/mm/mempool.c --- a/mm/mempool.c +++ b/mm/mempool.c @@ -16,16 +16,77 @@ #include <linux/blkdev.h> #include <linux/writeback.h> +#ifdef CONFIG_DEBUG_VM +static void poison_error(mempool_t *pool, void *element, size_t size, + size_t byte) +{ + const int nr = pool->curr_nr; + const int start = max_t(int, byte - (BITS_PER_LONG / 8), 0); + const int end = min_t(int, byte + (BITS_PER_LONG / 8), size); + int i; + + pr_err("BUG: mempool element poison mismatch\n"); + pr_err("Mempool %p size %ld\n", pool, size); + pr_err(" nr=%d @ %p: %s0x", nr, element, start > 0 ? "... " : ""); + for (i = start; i < end; i++) + pr_cont("%x ", *(u8 *)(element + i)); + pr_cont("%s\n", end < size ? "..." : ""); + dump_stack(); +} + +static void check_slab_element(mempool_t *pool, void *element) +{ + if (pool->free == mempool_free_slab || pool->free == mempool_kfree) { + size_t size = ksize(element); + u8 *obj = element; + size_t i; + + for (i = 0; i < size; i++) { + u8 exp = (i < size - 1) ? POISON_FREE : POISON_END; + + if (obj[i] != exp) { + poison_error(pool, element, size, i); + return; + } + } + memset(obj, POISON_INUSE, size); + } +} + +static void poison_slab_element(mempool_t *pool, void *element) +{ + if (pool->alloc == mempool_alloc_slab || + pool->alloc == mempool_kmalloc) { + size_t size = ksize(element); + u8 *obj = element; + + memset(obj, POISON_FREE, size - 1); + obj[size - 1] = POISON_END; + } +} +#else /* CONFIG_DEBUG_VM */ +static inline void check_slab_element(mempool_t *pool, void *element) +{ +} +static inline void poison_slab_element(mempool_t *pool, void *element) +{ +} +#endif /* CONFIG_DEBUG_VM */ + static void add_element(mempool_t *pool, void *element) { BUG_ON(pool->curr_nr >= pool->min_nr); + poison_slab_element(pool, element); pool->elements[pool->curr_nr++] = element; } static void *remove_element(mempool_t *pool) { - BUG_ON(pool->curr_nr <= 0); - return pool->elements[--pool->curr_nr]; + void *element = pool->elements[--pool->curr_nr]; + + BUG_ON(pool->curr_nr < 0); + check_slab_element(pool, element); + return element; } /** -- To unsubscribe, send a message with 'unsubscribe linux-mm' in the body to majordomo@kvack.org. For more info on Linux MM, see: http://www.linux-mm.org/ . Don't email: <a href=mailto:"dont@kvack.org"> email@kvack.org </a>
next reply other threads:[~2015-03-09 7:22 UTC|newest] Thread overview: 14+ messages / expand[flat|nested] mbox.gz Atom feed top 2015-03-09 7:21 David Rientjes [this message] 2015-03-09 7:21 ` [patch 1/2] mm, mempool: poison elements backed by slab allocator David Rientjes 2015-03-09 7:22 ` [patch 2/2] mm, mempool: poison elements backed by page allocator David Rientjes 2015-03-09 7:22 ` David Rientjes 2015-03-12 20:28 ` [patch 1/2] mm, mempool: poison elements backed by slab allocator Andrew Morton 2015-03-12 20:28 ` Andrew Morton 2015-03-14 0:06 ` David Rientjes 2015-03-14 0:06 ` David Rientjes 2015-03-16 10:46 ` Rasmus Villemoes 2015-03-16 10:46 ` Rasmus Villemoes 2015-03-19 23:20 ` David Rientjes 2015-03-19 23:20 ` David Rientjes 2015-03-19 23:26 ` Dave Kleikamp 2015-03-19 23:26 ` Dave Kleikamp
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=alpine.DEB.2.10.1503090021380.19148@chino.kir.corp.google.com \ --to=rientjes@google.com \ --cc=akpm@linux-foundation.org \ --cc=catalin.marinas@arm.com \ --cc=linux-kernel@vger.kernel.org \ --cc=linux-mm@kvack.org \ --cc=mpatocka@redhat.com \ --cc=sebott@linux.vnet.ibm.com \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: linkBe sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.