From: Vlastimil Babka <vbabka@suse.cz>
To: lijiazi <jqqlijiazi@gmail.com>
Cc: Christoph Lameter <cl@linux.com>,
Pekka Enberg <penberg@kernel.org>,
David Rientjes <rientjes@google.com>,
Joonsoo Kim <iamjoonsoo.kim@lge.com>,
Andrew Morton <akpm@linux-foundation.org>,
Roman Gushchin <roman.gushchin@linux.dev>,
Hyeonggon Yoo <42.hyeyoo@gmail.com>,
"Jiazi.Li" <jiazi.li@transsion.com>,
linux-mm@kvack.org, Kees Cook <keescook@chromium.org>,
Kernel Hardening <kernel-hardening@lists.openwall.com>
Subject: Re: [PATCH] mm/slab: always use cache from obj
Date: Wed, 15 Feb 2023 10:41:32 +0100 [thread overview]
Message-ID: <884f051f-d1ed-756f-aef3-6ed3005de090@suse.cz> (raw)
In-Reply-To: <20230215053748.GA11780@Jiazi.Li>
On 2/15/23 06:49, lijiazi wrote:
> On Tue, Feb 14, 2023 at 11:33:21AM +0100, Vlastimil Babka wrote:
>> On 2/14/23 11:19, Jiazi.Li wrote:
>> > If free obj to a wrong cache, in addition random, different offset
>> > and object_size will also cause problems:
>> > 1. The offset of a cache with a ctor is not zero, free an object from
>> > this cache to cache with offset zero, will write next freepointer to
>> > wrong location, resulting in confusion of freelist.
>>
>> Kernels hardened against freelist corruption will enable
>> CONFIG_SLAB_FREELIST_HARDENED, so that's already covered, no?
>>
> Yes, HARDENED already covered.
>> > 2. If wrong cache want init on free, and cache->object_size is large
>> > than obj size, which may lead to overwrite issue.
>>
>> In general, being defensive against usage errors is part of either hardening
>> or debugging, which is what the existing code takes into account.
>>
> My consideration is for the wrong cache problem on version without
> HARDENED or debugging, it is likely to cause kernel panic, and such
> problem is difficult to analyze on non-debug version.
> When reproducing this problem on debug version, it will not cause kernel
> panic, but only print the WARN log, then use correct cache to free obj.
> Because we want to reproduce kernel panic problem, so may ignore WARN
> log and think that can not reproduce problem on debug version.
If you need the panic in order to e.g. capture a crash dump, you could
enable slab debugging and boot with panic_on_warn to make the WARN result in
panic.
> Thanks for your reply, I will enable CONFIG_SLAB_FREELIST_HARDENED on
> non-debug version later.
>> > Compared with adding a lot of if-else, it may be better to use obj's
>> > cache directly.
>> >
>> > Signed-off-by: Jiazi.Li <jiazi.li@transsion.com>
>> > ---
>> > mm/slab.h | 4 ----
>> > 1 file changed, 4 deletions(-)
>> >
>> > diff --git a/mm/slab.h b/mm/slab.h
>> > index 63fb4c00d529..ed39b2e4f27b 100644
>> > --- a/mm/slab.h
>> > +++ b/mm/slab.h
>> > @@ -670,10 +670,6 @@ static inline struct kmem_cache *cache_from_obj(struct kmem_cache *s, void *x)
>> > {
>> > struct kmem_cache *cachep;
>> >
>> > - if (!IS_ENABLED(CONFIG_SLAB_FREELIST_HARDENED) &&
>> > - !kmem_cache_debug_flags(s, SLAB_CONSISTENCY_CHECKS))
>> > - return s;
>> > -
>> > cachep = virt_to_cache(x);
>> > if (WARN(cachep && cachep != s,
>> > "%s: Wrong slab cache. %s but object is from %s\n",
>>
next prev parent reply other threads:[~2023-02-15 9:41 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
[not found] <20230214101949.7461-1-jiazi.li@transsion.com>
2023-02-14 10:33 ` [PATCH] mm/slab: always use cache from obj Vlastimil Babka
2023-02-15 5:49 ` lijiazi
2023-02-15 9:41 ` Vlastimil Babka [this message]
2023-02-15 10:03 ` lijiazi
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=884f051f-d1ed-756f-aef3-6ed3005de090@suse.cz \
--to=vbabka@suse.cz \
--cc=42.hyeyoo@gmail.com \
--cc=akpm@linux-foundation.org \
--cc=cl@linux.com \
--cc=iamjoonsoo.kim@lge.com \
--cc=jiazi.li@transsion.com \
--cc=jqqlijiazi@gmail.com \
--cc=keescook@chromium.org \
--cc=kernel-hardening@lists.openwall.com \
--cc=linux-mm@kvack.org \
--cc=penberg@kernel.org \
--cc=rientjes@google.com \
--cc=roman.gushchin@linux.dev \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).