From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-10.2 required=3.0 tests=BAYES_00, HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_CR_TRAILER,MAILING_LIST_MULTI, SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_AGENT_SANE_1 autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 8F617C4338F for ; Tue, 27 Jul 2021 19:22:29 +0000 (UTC) Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by mail.kernel.org (Postfix) with ESMTP id 30C0E60F6E for ; Tue, 27 Jul 2021 19:22:29 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.4.1 mail.kernel.org 30C0E60F6E Authentication-Results: mail.kernel.org; dmarc=fail (p=none dis=none) header.from=arm.com Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=kvack.org Received: by kanga.kvack.org (Postfix) id C73A56B0036; Tue, 27 Jul 2021 15:22:28 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id C23776B005D; Tue, 27 Jul 2021 15:22:28 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id B115D8D0001; Tue, 27 Jul 2021 15:22:28 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from forelay.hostedemail.com (smtprelay0243.hostedemail.com [216.40.44.243]) by kanga.kvack.org (Postfix) with ESMTP id 94E706B0036 for ; Tue, 27 Jul 2021 15:22:28 -0400 (EDT) Received: from smtpin16.hostedemail.com (10.5.19.251.rfc1918.com [10.5.19.251]) by forelay04.hostedemail.com (Postfix) with ESMTP id 34B861AEEF for ; Tue, 27 Jul 2021 19:22:28 +0000 (UTC) X-FDA: 78409339176.16.F40F8B8 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by imf08.hostedemail.com (Postfix) with ESMTP id 98662300CDEA for ; Tue, 27 Jul 2021 19:22:27 +0000 (UTC) Received: by mail.kernel.org (Postfix) with ESMTPSA id 9A76E60F6E; Tue, 27 Jul 2021 19:22:21 +0000 (UTC) Date: Tue, 27 Jul 2021 20:22:18 +0100 From: Catalin Marinas To: Kuan-Ying Lee Cc: Marco Elver , Nicholas Tang , Andrew Yang , Andrey Konovalov , Andrey Ryabinin , Alexander Potapenko , Chinwen Chang , Andrew Morton , kasan-dev@googlegroups.com, linux-mm@kvack.org, linux-kernel@vger.kernel.org, linux-arm-kernel@lists.infradead.org, linux-mediatek@lists.infradead.org Subject: Re: [PATCH 1/2] kasan, mm: reset tag when access metadata Message-ID: <20210727192217.GV13920@arm.com> References: <20210727040021.21371-1-Kuan-Ying.Lee@mediatek.com> <20210727040021.21371-2-Kuan-Ying.Lee@mediatek.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: User-Agent: Mutt/1.10.1 (2018-07-13) Authentication-Results: imf08.hostedemail.com; dkim=none; spf=pass (imf08.hostedemail.com: domain of cmarinas@kernel.org designates 198.145.29.99 as permitted sender) smtp.mailfrom=cmarinas@kernel.org; dmarc=fail reason="SPF not aligned (relaxed), No valid DKIM" header.from=arm.com (policy=none) X-Rspamd-Server: rspam02 X-Stat-Signature: oubu3m3h5jg9ayqtpc4pzc6sfzgoh5y9 X-Rspamd-Queue-Id: 98662300CDEA X-HE-Tag: 1627413747-445391 X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: On Tue, Jul 27, 2021 at 04:32:02PM +0800, Kuan-Ying Lee wrote: > On Tue, 2021-07-27 at 09:10 +0200, Marco Elver wrote: > > +Cc Catalin > > > > On Tue, 27 Jul 2021 at 06:00, Kuan-Ying Lee < > > Kuan-Ying.Lee@mediatek.com> wrote: > > > > > > Hardware tag-based KASAN doesn't use compiler instrumentation, we > > > can not use kasan_disable_current() to ignore tag check. > > > > > > Thus, we need to reset tags when accessing metadata. > > > > > > Signed-off-by: Kuan-Ying Lee > > > > This looks reasonable, but the patch title is not saying this is > > kmemleak, nor does the description say what the problem is. What > > problem did you encounter? Was it a false positive? > > kmemleak would scan kernel memory to check memory leak. > When it scans on the invalid slab and dereference, the issue > will occur like below. > > So I think we should reset the tag before scanning. > > # echo scan > /sys/kernel/debug/kmemleak > [ 151.905804] > ================================================================== > [ 151.907120] BUG: KASAN: out-of-bounds in scan_block+0x58/0x170 > [ 151.908773] Read at addr f7ff0000c0074eb0 by task kmemleak/138 > [ 151.909656] Pointer tag: [f7], memory tag: [fe] It would be interesting to find out why the tag doesn't match. Kmemleak should in principle only scan valid objects that have been allocated and the pointer can be safely dereferenced. 0xfe is KASAN_TAG_INVALID, so it either goes past the size of the object (into the red zone) or it still accesses the object after it was marked as freed but before being released from kmemleak. With slab, looking at __cache_free(), it calls kasan_slab_free() before ___cache_free() -> kmemleak_free_recursive(), so the second scenario is possible. With slub, however, slab_free_hook() first releases the object from kmemleak before poisoning it. Based on the stack dump, you are using slub, so it may be that kmemleak goes into the object red zones. I'd like this clarified before blindly resetting the tag. -- Catalin