From: Andrey Konovalov <andreyknvl@google.com> To: Andrey Ryabinin <aryabinin@virtuozzo.com>, Alexander Potapenko <glider@google.com>, Dmitry Vyukov <dvyukov@google.com>, Catalin Marinas <catalin.marinas@arm.com>, Will Deacon <will.deacon@arm.com>, Christoph Lameter <cl@linux.com>, Andrew Morton <akpm@linux-foundation.org>, Mark Rutland <mark.rutland@arm.com>, Nick Desaulniers <ndesaulniers@google.com>, Marc Zyngier <marc.zyngier@arm.com>, Dave Martin <dave.martin@arm.com>, Ard Biesheuvel <ard.biesheuvel@linaro.org>, "Eric W . Biederman" <ebiederm@xmission.com>, Ingo Molnar <mingo@kernel.org>, Paul Lawrence <paullawrence@google.com>, Geert Uytterhoeven <geert@linux-m68k.org>, Arnd Bergmann <arnd@arndb.de>, "Kirill A . Shutemov" <kirill.shutemov@linux.intel.com>, Greg Kroah-Hartman <gregkh@linuxfoundation.org>, Kate Stewart <kstewart@linuxfoundation.org>, Mike Rapoport <rppt@linux.vnet.ibm.com>, kasan-dev@googlegroups.com, linux-doc@vger.kernel.org, linux-kernel@vger.kernel.org, linux-arm-kernel@lists.infradead.org, linux-sparse@vger.kernel.org, linux-mm@kvack.org, linux-kbuild@vger.kernel.org Cc: Kostya Serebryany <kcc@google.com>, Evgeniy Stepanov <eugenis@google.com>, Lee Smith <Lee.Smith@arm.com>, Ramana Radhakrishnan <Ramana.Radhakrishnan@arm.com>, Jacob Bramley <Jacob.Bramley@arm.com>, Ruben Ayrapetyan <Ruben.Ayrapetyan@arm.com>, Jann Horn <jannh@google.com>, Mark Brand <markbrand@google.com>, Chintan Pandya <cpandya@codeaurora.org>, Vishwath Mohan <vishwath@google.com>, Andrey Konovalov <andreyknvl@google.com> Subject: [PATCH v8 09/20] kasan: preassign tags to objects with ctors or SLAB_TYPESAFE_BY_RCU Date: Wed, 19 Sep 2018 20:54:48 +0200 [thread overview] Message-ID: <d74e710797323db0e43f047ea698fbc85060fc57.1537383101.git.andreyknvl@google.com> (raw) In-Reply-To: <cover.1537383101.git.andreyknvl@google.com> An object constructor can initialize pointers within this objects based on the address of the object. Since the object address might be tagged, we need to assign a tag before calling constructor. The implemented approach is to assign tags to objects with constructors when a slab is allocated and call constructors once as usual. The downside is that such object would always have the same tag when it is reallocated, so we won't catch use-after-frees on it. Also pressign tags for objects from SLAB_TYPESAFE_BY_RCU caches, since they can be validy accessed after having been freed. Signed-off-by: Andrey Konovalov <andreyknvl@google.com> --- mm/slab.c | 2 +- mm/slub.c | 24 ++++++++++++++---------- 2 files changed, 15 insertions(+), 11 deletions(-) diff --git a/mm/slab.c b/mm/slab.c index 6fdca9ec2ea4..fe0ddf08aa2c 100644 --- a/mm/slab.c +++ b/mm/slab.c @@ -2574,7 +2574,7 @@ static void cache_init_objs(struct kmem_cache *cachep, for (i = 0; i < cachep->num; i++) { objp = index_to_obj(cachep, page, i); - kasan_init_slab_obj(cachep, objp); + objp = kasan_init_slab_obj(cachep, objp); /* constructor could break poison info */ if (DEBUG == 0 && cachep->ctor) { diff --git a/mm/slub.c b/mm/slub.c index c4d5f4442ff1..75fc76e42a1e 100644 --- a/mm/slub.c +++ b/mm/slub.c @@ -1413,16 +1413,17 @@ static inline bool slab_free_freelist_hook(struct kmem_cache *s, #endif } -static void setup_object(struct kmem_cache *s, struct page *page, +static void *setup_object(struct kmem_cache *s, struct page *page, void *object) { setup_object_debug(s, page, object); - kasan_init_slab_obj(s, object); + object = kasan_init_slab_obj(s, object); if (unlikely(s->ctor)) { kasan_unpoison_object_data(s, object); s->ctor(object); kasan_poison_object_data(s, object); } + return object; } /* @@ -1530,16 +1531,16 @@ static bool shuffle_freelist(struct kmem_cache *s, struct page *page) /* First entry is used as the base of the freelist */ cur = next_freelist_entry(s, page, &pos, start, page_limit, freelist_count); + cur = setup_object(s, page, cur); page->freelist = cur; for (idx = 1; idx < page->objects; idx++) { - setup_object(s, page, cur); next = next_freelist_entry(s, page, &pos, start, page_limit, freelist_count); + next = setup_object(s, page, next); set_freepointer(s, cur, next); cur = next; } - setup_object(s, page, cur); set_freepointer(s, cur, NULL); return true; @@ -1561,7 +1562,7 @@ static struct page *allocate_slab(struct kmem_cache *s, gfp_t flags, int node) struct page *page; struct kmem_cache_order_objects oo = s->oo; gfp_t alloc_gfp; - void *start, *p; + void *start, *p, *next; int idx, order; bool shuffle; @@ -1613,13 +1614,16 @@ static struct page *allocate_slab(struct kmem_cache *s, gfp_t flags, int node) if (!shuffle) { for_each_object_idx(p, idx, s, start, page->objects) { - setup_object(s, page, p); - if (likely(idx < page->objects)) - set_freepointer(s, p, p + s->size); - else + if (likely(idx < page->objects)) { + next = p + s->size; + next = setup_object(s, page, next); + set_freepointer(s, p, next); + } else set_freepointer(s, p, NULL); } - page->freelist = fixup_red_left(s, start); + start = fixup_red_left(s, start); + start = setup_object(s, page, start); + page->freelist = start; } page->inuse = page->objects; -- 2.19.0.397.gdd90340f6a-goog
WARNING: multiple messages have this Message-ID (diff)
From: andreyknvl@google.com (Andrey Konovalov) To: linux-arm-kernel@lists.infradead.org Subject: [PATCH v8 09/20] kasan: preassign tags to objects with ctors or SLAB_TYPESAFE_BY_RCU Date: Wed, 19 Sep 2018 20:54:48 +0200 [thread overview] Message-ID: <d74e710797323db0e43f047ea698fbc85060fc57.1537383101.git.andreyknvl@google.com> (raw) In-Reply-To: <cover.1537383101.git.andreyknvl@google.com> An object constructor can initialize pointers within this objects based on the address of the object. Since the object address might be tagged, we need to assign a tag before calling constructor. The implemented approach is to assign tags to objects with constructors when a slab is allocated and call constructors once as usual. The downside is that such object would always have the same tag when it is reallocated, so we won't catch use-after-frees on it. Also pressign tags for objects from SLAB_TYPESAFE_BY_RCU caches, since they can be validy accessed after having been freed. Signed-off-by: Andrey Konovalov <andreyknvl@google.com> --- mm/slab.c | 2 +- mm/slub.c | 24 ++++++++++++++---------- 2 files changed, 15 insertions(+), 11 deletions(-) diff --git a/mm/slab.c b/mm/slab.c index 6fdca9ec2ea4..fe0ddf08aa2c 100644 --- a/mm/slab.c +++ b/mm/slab.c @@ -2574,7 +2574,7 @@ static void cache_init_objs(struct kmem_cache *cachep, for (i = 0; i < cachep->num; i++) { objp = index_to_obj(cachep, page, i); - kasan_init_slab_obj(cachep, objp); + objp = kasan_init_slab_obj(cachep, objp); /* constructor could break poison info */ if (DEBUG == 0 && cachep->ctor) { diff --git a/mm/slub.c b/mm/slub.c index c4d5f4442ff1..75fc76e42a1e 100644 --- a/mm/slub.c +++ b/mm/slub.c @@ -1413,16 +1413,17 @@ static inline bool slab_free_freelist_hook(struct kmem_cache *s, #endif } -static void setup_object(struct kmem_cache *s, struct page *page, +static void *setup_object(struct kmem_cache *s, struct page *page, void *object) { setup_object_debug(s, page, object); - kasan_init_slab_obj(s, object); + object = kasan_init_slab_obj(s, object); if (unlikely(s->ctor)) { kasan_unpoison_object_data(s, object); s->ctor(object); kasan_poison_object_data(s, object); } + return object; } /* @@ -1530,16 +1531,16 @@ static bool shuffle_freelist(struct kmem_cache *s, struct page *page) /* First entry is used as the base of the freelist */ cur = next_freelist_entry(s, page, &pos, start, page_limit, freelist_count); + cur = setup_object(s, page, cur); page->freelist = cur; for (idx = 1; idx < page->objects; idx++) { - setup_object(s, page, cur); next = next_freelist_entry(s, page, &pos, start, page_limit, freelist_count); + next = setup_object(s, page, next); set_freepointer(s, cur, next); cur = next; } - setup_object(s, page, cur); set_freepointer(s, cur, NULL); return true; @@ -1561,7 +1562,7 @@ static struct page *allocate_slab(struct kmem_cache *s, gfp_t flags, int node) struct page *page; struct kmem_cache_order_objects oo = s->oo; gfp_t alloc_gfp; - void *start, *p; + void *start, *p, *next; int idx, order; bool shuffle; @@ -1613,13 +1614,16 @@ static struct page *allocate_slab(struct kmem_cache *s, gfp_t flags, int node) if (!shuffle) { for_each_object_idx(p, idx, s, start, page->objects) { - setup_object(s, page, p); - if (likely(idx < page->objects)) - set_freepointer(s, p, p + s->size); - else + if (likely(idx < page->objects)) { + next = p + s->size; + next = setup_object(s, page, next); + set_freepointer(s, p, next); + } else set_freepointer(s, p, NULL); } - page->freelist = fixup_red_left(s, start); + start = fixup_red_left(s, start); + start = setup_object(s, page, start); + page->freelist = start; } page->inuse = page->objects; -- 2.19.0.397.gdd90340f6a-goog
next prev parent reply other threads:[~2018-09-19 18:55 UTC|newest] Thread overview: 75+ messages / expand[flat|nested] mbox.gz Atom feed top 2018-09-19 18:54 [PATCH v8 00/20] kasan: add software tag-based mode for arm64 Andrey Konovalov 2018-09-19 18:54 ` Andrey Konovalov 2018-09-19 18:54 ` Andrey Konovalov 2018-09-19 18:54 ` [PATCH v8 01/20] kasan, mm: change hooks signatures Andrey Konovalov 2018-09-19 18:54 ` Andrey Konovalov 2018-09-21 4:05 ` kbuild test robot 2018-09-21 4:05 ` kbuild test robot 2018-09-21 4:05 ` kbuild test robot 2018-09-21 4:05 ` kbuild test robot 2018-09-21 12:13 ` Andrey Konovalov 2018-09-21 12:13 ` Andrey Konovalov 2018-09-21 12:13 ` Andrey Konovalov 2018-09-21 7:03 ` kbuild test robot 2018-09-21 7:03 ` kbuild test robot 2018-09-21 7:03 ` kbuild test robot 2018-09-21 7:03 ` kbuild test robot 2018-09-19 18:54 ` [PATCH v8 02/20] kasan: move common generic and tag-based code to common.c Andrey Konovalov 2018-09-19 18:54 ` Andrey Konovalov 2018-09-19 18:54 ` [PATCH v8 03/20] kasan: rename source files to reflect the new naming scheme Andrey Konovalov 2018-09-19 18:54 ` Andrey Konovalov 2018-09-19 18:54 ` [PATCH v8 04/20] kasan: add CONFIG_KASAN_GENERIC and CONFIG_KASAN_SW_TAGS Andrey Konovalov 2018-09-19 18:54 ` Andrey Konovalov 2018-09-19 18:54 ` [PATCH v8 05/20] kasan, arm64: adjust shadow size for tag-based mode Andrey Konovalov 2018-09-19 18:54 ` Andrey Konovalov 2018-09-19 18:54 ` [PATCH v8 06/20] kasan: initialize shadow to 0xff " Andrey Konovalov 2018-09-19 18:54 ` Andrey Konovalov 2018-09-19 18:54 ` [PATCH v8 07/20] kasan, arm64: untag address in __kimg_to_phys and _virt_addr_is_linear Andrey Konovalov 2018-09-19 18:54 ` Andrey Konovalov 2018-09-19 18:54 ` [PATCH v8 08/20] kasan: add tag related helper functions Andrey Konovalov 2018-09-19 18:54 ` Andrey Konovalov 2018-09-19 18:54 ` Andrey Konovalov 2018-09-19 18:54 ` Andrey Konovalov [this message] 2018-09-19 18:54 ` [PATCH v8 09/20] kasan: preassign tags to objects with ctors or SLAB_TYPESAFE_BY_RCU Andrey Konovalov 2018-09-21 11:25 ` Dmitry Vyukov 2018-09-21 11:25 ` Dmitry Vyukov 2018-09-21 11:25 ` Dmitry Vyukov 2018-09-21 12:24 ` Andrey Konovalov 2018-09-21 12:24 ` Andrey Konovalov 2018-09-21 12:24 ` Andrey Konovalov 2018-09-24 9:19 ` Dmitry Vyukov 2018-09-24 9:19 ` Dmitry Vyukov 2018-09-24 9:19 ` Dmitry Vyukov 2018-09-19 18:54 ` [PATCH v8 10/20] mm: move obj_to_index to include/linux/slab_def.h Andrey Konovalov 2018-09-19 18:54 ` Andrey Konovalov 2018-09-19 18:54 ` [PATCH v8 11/20] kasan, arm64: fix up fault handling logic Andrey Konovalov 2018-09-19 18:54 ` Andrey Konovalov 2018-09-19 18:54 ` [PATCH v8 12/20] kasan, arm64: enable top byte ignore for the kernel Andrey Konovalov 2018-09-19 18:54 ` Andrey Konovalov 2018-09-19 18:54 ` [PATCH v8 13/20] kasan, mm: perform untagged pointers comparison in krealloc Andrey Konovalov 2018-09-19 18:54 ` Andrey Konovalov 2018-09-19 18:54 ` [PATCH v8 14/20] kasan: split out generic_report.c from report.c Andrey Konovalov 2018-09-19 18:54 ` Andrey Konovalov 2018-09-19 18:54 ` [PATCH v8 15/20] kasan: add bug reporting routines for tag-based mode Andrey Konovalov 2018-09-19 18:54 ` Andrey Konovalov 2018-09-19 18:54 ` [PATCH v8 16/20] kasan: add hooks implementation " Andrey Konovalov 2018-09-19 18:54 ` Andrey Konovalov 2018-09-21 11:37 ` Dmitry Vyukov 2018-09-21 11:37 ` Dmitry Vyukov 2018-09-21 11:37 ` Dmitry Vyukov 2018-09-21 14:28 ` Andrey Konovalov 2018-09-21 14:28 ` Andrey Konovalov 2018-09-21 14:28 ` Andrey Konovalov 2018-09-19 18:54 ` [PATCH v8 17/20] kasan, arm64: add brk handler for inline instrumentation Andrey Konovalov 2018-09-19 18:54 ` Andrey Konovalov 2018-09-19 18:54 ` [PATCH v8 18/20] kasan, mm, arm64: tag non slab memory allocated via pagealloc Andrey Konovalov 2018-09-19 18:54 ` Andrey Konovalov 2018-09-19 18:54 ` [PATCH v8 19/20] kasan: update documentation Andrey Konovalov 2018-09-19 18:54 ` Andrey Konovalov 2018-09-19 18:54 ` [PATCH v8 20/20] kasan: add SPDX-License-Identifier mark to source files Andrey Konovalov 2018-09-19 18:54 ` Andrey Konovalov 2018-09-19 18:57 ` [PATCH v8 00/20] kasan: add software tag-based mode for arm64 Andrey Konovalov 2018-09-19 18:57 ` Andrey Konovalov 2018-09-19 19:01 ` Andrey Konovalov 2018-09-19 19:01 ` Andrey Konovalov 2018-09-19 19:01 ` Andrey Konovalov
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=d74e710797323db0e43f047ea698fbc85060fc57.1537383101.git.andreyknvl@google.com \ --to=andreyknvl@google.com \ --cc=Jacob.Bramley@arm.com \ --cc=Lee.Smith@arm.com \ --cc=Ramana.Radhakrishnan@arm.com \ --cc=Ruben.Ayrapetyan@arm.com \ --cc=akpm@linux-foundation.org \ --cc=ard.biesheuvel@linaro.org \ --cc=arnd@arndb.de \ --cc=aryabinin@virtuozzo.com \ --cc=catalin.marinas@arm.com \ --cc=cl@linux.com \ --cc=cpandya@codeaurora.org \ --cc=dave.martin@arm.com \ --cc=dvyukov@google.com \ --cc=ebiederm@xmission.com \ --cc=eugenis@google.com \ --cc=geert@linux-m68k.org \ --cc=glider@google.com \ --cc=gregkh@linuxfoundation.org \ --cc=jannh@google.com \ --cc=kasan-dev@googlegroups.com \ --cc=kcc@google.com \ --cc=kirill.shutemov@linux.intel.com \ --cc=kstewart@linuxfoundation.org \ --cc=linux-arm-kernel@lists.infradead.org \ --cc=linux-doc@vger.kernel.org \ --cc=linux-kbuild@vger.kernel.org \ --cc=linux-kernel@vger.kernel.org \ --cc=linux-mm@kvack.org \ --cc=linux-sparse@vger.kernel.org \ --cc=marc.zyngier@arm.com \ --cc=mark.rutland@arm.com \ --cc=markbrand@google.com \ --cc=mingo@kernel.org \ --cc=ndesaulniers@google.com \ --cc=paullawrence@google.com \ --cc=rppt@linux.vnet.ibm.com \ --cc=vishwath@google.com \ --cc=will.deacon@arm.com \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: linkBe sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.