From: Joonsoo Kim <iamjoonsoo.kim@lge.com>
To: Sergey Senozhatsky <sergey.senozhatsky.work@gmail.com>
Cc: Sergey Senozhatsky <sergey.senozhatsky@gmail.com>,
Andrew Morton <akpm@linux-foundation.org>,
Vlastimil Babka <vbabka@suse.cz>,
linux-mm@kvack.org, linux-kernel@vger.kernel.org
Subject: Re: [PATCH 3/3] mm/page_owner: track page free call chain
Date: Mon, 4 Jul 2016 16:29:45 +0900 [thread overview]
Message-ID: <20160704072944.GA15729@js1304-P5Q-DELUXE> (raw)
In-Reply-To: <20160704054524.GD898@swordfish>
On Mon, Jul 04, 2016 at 02:45:24PM +0900, Sergey Senozhatsky wrote:
> On (07/04/16 14:29), Joonsoo Kim wrote:
> > > > On Sun, Jul 03, 2016 at 01:16:56AM +0900, Sergey Senozhatsky wrote:
> > > > > Introduce PAGE_OWNER_TRACK_FREE config option to extend page owner with
> > > > > free_pages() tracking functionality. This adds to the dump_page_owner()
> > > > > output an additional backtrace, that tells us what path has freed the
> > > > > page.
> > > >
> > > > Hmm... Do you have other ideas to use this feature? Following example is
> > > > just to detect use-after-free and we have other good tools for it
> > > > (KASAN or DEBUG_PAGEALLOC) so I'm not sure whether it's useful or not.
> > >
> > > there is no kasan for ARM32, for example (apart from the fact that
> > > it's really hard to use kasan sometimes due to its cpu cycles and
> > > memory requirements).
> >
> > Hmm... for debugging purpose, KASAN provides many more things so IMO it's
> > better to implement/support KASAN in ARM32 rather than expand
> > PAGE_OWNER for free.
> >
>
> hm, the last time I checked kasan didn't catch that extra put_page() on
Indeed. It seems that kasan only catch double-free of slab object.
> x86_64. AFAIK, kasan on ARM32 is a bit hard to do properly
> http://www.serverphorums.com/read.php?12,1206479,1281087#msg-1281087
Okay.
> I've played with kasan on arm32 (an internal custom version)... and
> extended page_owner turned out to be *incomparably* easier and faster
> to use (especially paired with stackdepot).
Okay.
>
> > > educate me, will DEBUG_PAGEALLOC tell us what path has triggered the
> > > extra put_page()? hm... does ARM32 provide ARCH_SUPPORTS_DEBUG_PAGEALLOC?
> >
> > Hmm... Now, I notice that PAGE_OWNER_TRACK_FREE will detect
> > double-free rather than use-after-free.
>
> well, yes. current hits bad_page(), page_owner helps to find out who
> stole and spoiled it from under current.
>
> CPU a CPU b
>
> alloc_page()
> put_page() << legitimate
> alloc_page()
> err:
> put_page() << legitimate, again.
> << but is actually buggy.
>
> put_page() << double free. but we need
> << to report put_page() from
> << CPU a.
Okay. I think that this patch make finding offending user easier
but it looks like it is a partial solution to detect double-free.
See following example.
CPU a CPU b
alloc_page()
put_page() << legitimate
alloc_page()
err:
put_page() << legitimate, again.
<< but is actually buggy.
alloc_page()
put_page() <<
legitimate,
again.
put_page() << Will report the bug and
page_owner have legitimate call stack.
In kasan, quarantine is used to provide some delay for real free and
it makes use-after-free detection more robust. Double-free also can be
benefit from it. Anyway, I will not object more since it looks
the simplest way to improve doublue-free detection for the page
at least for now.
Thanks.
--
To unsubscribe, send a message with 'unsubscribe linux-mm' in
the body to majordomo@kvack.org. For more info on Linux MM,
see: http://www.linux-mm.org/ .
Don't email: <a href=mailto:"dont@kvack.org"> email@kvack.org </a>
next prev parent reply other threads:[~2016-07-04 7:26 UTC|newest]
Thread overview: 12+ messages / expand[flat|nested] mbox.gz Atom feed top
2016-07-02 16:16 [PATCH 0/3][RFC] mm/page:_owner: track page free call chain Sergey Senozhatsky
2016-07-02 16:16 ` [PATCH 1/3] mm/page_owner: rename page_owner functions Sergey Senozhatsky
2016-07-02 16:16 ` [PATCH 2/3] mm/page_owner: rename PAGE_EXT_OWNER flag Sergey Senozhatsky
2016-07-02 16:16 ` [PATCH 3/3] mm/page_owner: track page free call chain Sergey Senozhatsky
2016-07-03 5:59 ` Sergey Senozhatsky
2016-07-04 4:57 ` Joonsoo Kim
2016-07-04 5:07 ` Sergey Senozhatsky
2016-07-04 5:29 ` Joonsoo Kim
2016-07-04 5:45 ` Sergey Senozhatsky
2016-07-04 7:29 ` Joonsoo Kim [this message]
2016-07-04 7:53 ` Sergey Senozhatsky
2016-07-08 12:11 [RFC][PATCH v2 " Sergey Senozhatsky
2016-07-11 14:27 ` [PATCH " Sergey Senozhatsky
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20160704072944.GA15729@js1304-P5Q-DELUXE \
--to=iamjoonsoo.kim@lge.com \
--cc=akpm@linux-foundation.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-mm@kvack.org \
--cc=sergey.senozhatsky.work@gmail.com \
--cc=sergey.senozhatsky@gmail.com \
--cc=vbabka@suse.cz \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).