From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-2.2 required=3.0 tests=DKIMWL_WL_HIGH,DKIM_SIGNED, DKIM_VALID,HEADER_FROM_DIFFERENT_DOMAINS,MAILING_LIST_MULTI,SPF_HELO_NONE, SPF_PASS,URIBL_BLOCKED,USER_AGENT_SANE_1 autolearn=no autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id C1D6EC74A35 for ; Wed, 10 Jul 2019 18:25:11 +0000 (UTC) Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.133]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPS id 93E1A2087F for ; Wed, 10 Jul 2019 18:25:11 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=pass (2048-bit key) header.d=lists.infradead.org header.i=@lists.infradead.org header.b="uYU+U24M" DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org 93E1A2087F Authentication-Results: mail.kernel.org; dmarc=fail (p=none dis=none) header.from=virtuozzo.com Authentication-Results: mail.kernel.org; spf=none smtp.mailfrom=linux-arm-kernel-bounces+infradead-linux-arm-kernel=archiver.kernel.org@lists.infradead.org DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20170209; h=Sender: Content-Transfer-Encoding:Content-Type:Cc:List-Subscribe:List-Help:List-Post: List-Archive:List-Unsubscribe:List-Id:In-Reply-To:MIME-Version:Date: Message-ID:From:References:To:Subject:Reply-To:Content-ID:Content-Description :Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID: List-Owner; bh=Y4N2V/ynHZg+aUI4T/QDTKCllXPL+XHQeOmCCrltbYg=; b=uYU+U24MgvY4mH FKj+dWHY6w0GGwR5j0XraHvGFsyNOklsCqwqnV/HtdR5wB/KW751WnJRmlO/jODzttTp4YuBUw4GL ii7XtRl8VRiM0IUbCXu+hMy6sSvTtMUjNg0p+5CaWkJPpiGH58aC8FfASoFZAoxnTzLzDLsBgQE6J bpXQzAsU5RFQzghwF2Q2IBFTTIpohh+zznrVxt6DMlJ6Grt9lZqMW4U1IjRW+3fncjxtNEuescBr7 7tO6fl94PzdFmQe4u8en/r+melfqDOH1QN4KmFc8WUcKCL1/WmK3tAq9no9nm2sTtntSr7QxnlLGO 7vcEb1aB9a6sVC/zSmZQ==; Received: from localhost ([127.0.0.1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.92 #3 (Red Hat Linux)) id 1hlHGy-0002LW-2g; Wed, 10 Jul 2019 18:24:56 +0000 Received: from relay.sw.ru ([185.231.240.75]) by bombadil.infradead.org with esmtps (Exim 4.92 #3 (Red Hat Linux)) id 1hlHGl-0002J8-2Z; Wed, 10 Jul 2019 18:24:45 +0000 Received: from [172.16.25.12] by relay.sw.ru with esmtp (Exim 4.92) (envelope-from ) id 1hlHGV-0006Kk-L9; Wed, 10 Jul 2019 21:24:27 +0300 Subject: Re: [PATCH v3] kasan: add memory corruption identification for software tag-based mode To: Walter Wu , Dmitry Vyukov References: <20190613081357.1360-1-walter-zh.wu@mediatek.com> <1560447999.15814.15.camel@mtksdccf07> <1560479520.15814.34.camel@mtksdccf07> <1560744017.15814.49.camel@mtksdccf07> <1560774735.15814.54.camel@mtksdccf07> <1561974995.18866.1.camel@mtksdccf07> <1562640832.9077.32.camel@mtksdccf07> From: Andrey Ryabinin Message-ID: Date: Wed, 10 Jul 2019 21:24:22 +0300 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Thunderbird/60.7.2 MIME-Version: 1.0 In-Reply-To: <1562640832.9077.32.camel@mtksdccf07> Content-Language: en-US X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20190710_112443_128648_2D8DD351 X-CRM114-Status: GOOD ( 12.67 ) X-BeenThere: linux-arm-kernel@lists.infradead.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: wsd_upstream , "Jason A . Donenfeld" , Vasily Gorbik , Arnd Bergmann , Linux-MM , Andrey Konovalov , LKML , kasan-dev , Pekka Enberg , Martin Schwidefsky , Miles Chen , Alexander Potapenko , David Rientjes , Matthias Brugger , linux-mediatek@lists.infradead.org, Christoph Lameter , Joonsoo Kim , Linux ARM Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: "linux-arm-kernel" Errors-To: linux-arm-kernel-bounces+infradead-linux-arm-kernel=archiver.kernel.org@lists.infradead.org On 7/9/19 5:53 AM, Walter Wu wrote: > On Mon, 2019-07-08 at 19:33 +0300, Andrey Ryabinin wrote: >> >> On 7/5/19 4:34 PM, Dmitry Vyukov wrote: >>> On Mon, Jul 1, 2019 at 11:56 AM Walter Wu wrote: >>> >>> Sorry for delays. I am overwhelm by some urgent work. I afraid to >>> promise any dates because the next week I am on a conference, then >>> again a backlog and an intern starting... >>> >>> Andrey, do you still have concerns re this patch? This change allows >>> to print the free stack. >> >> I 'm not sure that quarantine is a best way to do that. Quarantine is made to delay freeing, but we don't that here. >> If we want to remember more free stacks wouldn't be easier simply to remember more stacks in object itself? >> Same for previously used tags for better use-after-free identification. >> > > Hi Andrey, > > We ever tried to use object itself to determine use-after-free > identification, but tag-based KASAN immediately released the pointer > after call kfree(), the original object will be used by another > pointer, if we use object itself to determine use-after-free issue, then > it has many false negative cases. so we create a lite quarantine(ring > buffers) to record recent free stacks in order to avoid those false > negative situations. I'm telling that *more* than one free stack and also tags per object can be stored. If object reused we would still have information about n-last usages of the object. It seems like much easier and more efficient solution than patch you proposing. As for other concern about this particular patch - It wasn't tested. There is deadlock (sleep in atomic) on the report path which would have been noticed it tested. Also GFP_NOWAIT allocation which fails very noisy and very often, especially in memory constraint enviromnent where tag-based KASAN supposed to be used. - Inefficient usage of memory: 48 bytes (sizeof (qlist_object) + sizeof(kasan_alloc_meta)) per kfree() call seems like a lot. It could be less. The same 'struct kasan_track' stored twice in two different places (in object and in quarantine). Basically, at least some part of the quarantine always duplicates information that we already know about recently freed object. Since now we call kmalloc() from kfree() path, every unique kfree() stacktrace now generates additional unique stacktrace that takes space in stackdepot. _______________________________________________ linux-arm-kernel mailing list linux-arm-kernel@lists.infradead.org http://lists.infradead.org/mailman/listinfo/linux-arm-kernel