From: Walter Wu <walter-zh.wu@mediatek.com>
To: Dmitry Vyukov <dvyukov@google.com>
Cc: Andrey Ryabinin <aryabinin@virtuozzo.com>,
Alexander Potapenko <glider@google.com>,
Matthias Brugger <matthias.bgg@gmail.com>,
"Paul E . McKenney" <paulmck@kernel.org>,
Josh Triplett <josh@joshtriplett.org>,
Mathieu Desnoyers <mathieu.desnoyers@efficios.com>,
Lai Jiangshan <jiangshanlai@gmail.com>,
Joel Fernandes <joel@joelfernandes.org>,
"Andrew Morton" <akpm@linux-foundation.org>,
kasan-dev <kasan-dev@googlegroups.com>,
Linux-MM <linux-mm@kvack.org>,
LKML <linux-kernel@vger.kernel.org>,
"Linux ARM" <linux-arm-kernel@lists.infradead.org>
Subject: Re: [PATCH v2 1/3] rcu/kasan: record and print call_rcu() call stack
Date: Wed, 13 May 2020 17:05:44 +0800 [thread overview]
Message-ID: <1589360744.14554.10.camel@mtksdccf07> (raw)
In-Reply-To: <CACT4Y+Zv3rCZs8z56NHM0hHWMwQr_2AT8nx0vUigzMG2v3Rt8Q@mail.gmail.com>
On Wed, 2020-05-13 at 08:51 +0200, 'Dmitry Vyukov' via kasan-dev wrote:
> On Wed, May 13, 2020 at 3:48 AM Walter Wu <walter-zh.wu@mediatek.com> wrote:
> > > > > Are you sure it will increase object size?
> > > > > I think we overlap kasan_free_meta with the object as well. The only
> > > > > case we don't overlap kasan_free_meta with the object are
> > > > > SLAB_TYPESAFE_BY_RCU || cache->ctor. But these are rare and it should
> > > > > only affect small objects with small redzones.
> > > > > And I think now we simply have a bug for these objects, we check
> > > > > KASAN_KMALLOC_FREE and then assume object contains free stack, but for
> > > > > objects with ctor, they still contain live object data, we don't store
> > > > > free stack in them.
> > > > > Such objects can be both free and still contain user data.
> > > > >
> > > >
> > > > Overlay kasan_free_meta. I see. but overlay it only when the object was
> > > > freed. kasan_free_meta will be used until free object.
> > > > 1). When put object into quarantine, it need kasan_free_meta.
> > > > 2). When the object exit from quarantine, it need kasan_free_meta
> > > >
> > > > If we choose to overlay kasan_free_meta, then the free stack will be
> > > > stored very late. It may has no free stack in report.
> > >
> > > Sorry, I don't understand what you mean.
> > >
> > > Why will it be stored too late?
> > > In __kasan_slab_free() putting into quarantine and recording free
> > > stack are literally adjacent lines of code:
> > >
> > > static bool __kasan_slab_free(struct kmem_cache *cache, void *object,
> > > unsigned long ip, bool quarantine)
> > > {
> > > ...
> > > kasan_set_free_info(cache, object, tag);
> > > quarantine_put(get_free_info(cache, object), cache);
> > >
> > >
> > > Just to make sure, what I meant is that we add free_track to kasan_free_meta:
> > >
> > > struct kasan_free_meta {
> > > struct qlist_node quarantine_link;
> > > + struct kasan_track free_track;
> > > };
> > >
> >
> > When I see above struct kasan_free_meta, I know why you don't understand
> > my meaning, because I thought you were going to overlay the
> > quarantine_link by free_track, but it seems like to add free_track to
> > kasan_free_meta. Does it enlarge meta-data size?
>
> I would assume it should not increase meta-data size. In both cases we
> store exactly the same information inside of the object: quarantine
> link and free track.
> I see it more as a question of code organization. We already have a
> concept of "this data is placed inside of the freed object", we
> already have a name for it (kasan_free_meta), we already have code to
> choose where to place it, we already have helper functions to access
> it. And your change effectively duplicates all of this to place the
> free track.
>
I want to make a summary. Which of the following is the approach we
want? or if I have some misunderstandings, please help me to correct.
Thanks.
1) For different object, then it will has two ways.
1.a) When object are LAB_TYPESAFE_BY_RCU || cache->ctor, then store free
stack into free track of struct kasan_free_meta.
2.b) Except 1.a), store free stack into freed object.
or
2) We always store free stack into free track of struct kasan_free_meta
> > > And I think its life-time and everything should be exactly what we need.
> > >
> > > Also it should help to fix the problem with ctors: kasan_free_meta is
> > > already allocated on the side for such objects, and that's exactly
> > > what we need for objects with ctor's.
> >
> > I see.
>
next prev parent reply other threads:[~2020-05-13 9:05 UTC|newest]
Thread overview: 26+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-05-11 2:31 [PATCH v2 1/3] rcu/kasan: record and print call_rcu() call stack Walter Wu
2020-05-11 11:08 ` Dmitry Vyukov
2020-05-11 12:29 ` Walter Wu
2020-05-11 11:14 ` Dmitry Vyukov
2020-05-11 12:20 ` Dmitry Vyukov
2020-05-11 12:54 ` Walter Wu
2020-05-11 13:00 ` Dmitry Vyukov
2020-05-11 12:31 ` Dmitry Vyukov
2020-05-11 12:43 ` Dmitry Vyukov
[not found] ` <1589203771.21284.22.camel@mtksdccf07>
2020-05-11 14:19 ` Dmitry Vyukov
2020-05-12 3:38 ` Walter Wu
2020-05-12 14:03 ` Dmitry Vyukov
2020-05-13 1:47 ` Walter Wu
2020-05-13 6:51 ` Dmitry Vyukov
2020-05-13 9:05 ` Walter Wu [this message]
2020-05-13 9:16 ` Dmitry Vyukov
2020-05-13 9:22 ` Walter Wu
2020-05-11 18:05 ` Paul E. McKenney
2020-05-12 2:36 ` Walter Wu
2020-05-12 13:56 ` Dmitry Vyukov
2020-05-12 14:25 ` Paul E. McKenney
2020-05-12 15:50 ` Dmitry Vyukov
2020-05-12 16:14 ` Paul E. McKenney
2020-05-12 16:22 ` Dmitry Vyukov
2020-05-13 2:05 ` Walter Wu
2020-05-13 3:19 ` Paul E. McKenney
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1589360744.14554.10.camel@mtksdccf07 \
--to=walter-zh.wu@mediatek.com \
--cc=akpm@linux-foundation.org \
--cc=aryabinin@virtuozzo.com \
--cc=dvyukov@google.com \
--cc=glider@google.com \
--cc=jiangshanlai@gmail.com \
--cc=joel@joelfernandes.org \
--cc=josh@joshtriplett.org \
--cc=kasan-dev@googlegroups.com \
--cc=linux-arm-kernel@lists.infradead.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-mm@kvack.org \
--cc=mathieu.desnoyers@efficios.com \
--cc=matthias.bgg@gmail.com \
--cc=paulmck@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).