* [PATCH v3 0/2] kasan: reset tag when accessing invalid metadata @ 2021-08-04 9:09 Kuan-Ying Lee 2021-08-04 9:09 ` [PATCH v3 1/2] kasan, kmemleak: reset tags when scanning block Kuan-Ying Lee 2021-08-04 9:09 ` [PATCH v3 2/2] kasan, slub: reset tag when printing address Kuan-Ying Lee 0 siblings, 2 replies; 5+ messages in thread From: Kuan-Ying Lee @ 2021-08-04 9:09 UTC (permalink / raw) To: Nicholas Tang, Andrew Yang, Andrey Konovalov, Andrey Ryabinin, Alexander Potapenko, Marco Elver, Catalin Marinas, Chinwen Chang, Andrew Morton Cc: kasan-dev, linux-mm, linux-kernel, linux-arm-kernel, linux-mediatek, Kuan-Ying Lee With hardware tag-based kasan enabled, we reset the tag when we access metadata to avoid from false alarm. Changes since v3: - Remove inappropriate suggested-by Changes since v2: - Refine the commit message in detail. - Thanks Andrey's explanation about false alarm of kmemleak. Kuan-Ying Lee (2): kasan, kmemleak: reset tags when scanning block kasan, slub: reset tag when printing address mm/kmemleak.c | 6 +++--- mm/slub.c | 4 ++-- 2 files changed, 5 insertions(+), 5 deletions(-) -- 2.18.0 ^ permalink raw reply [flat|nested] 5+ messages in thread
* [PATCH v3 1/2] kasan, kmemleak: reset tags when scanning block 2021-08-04 9:09 [PATCH v3 0/2] kasan: reset tag when accessing invalid metadata Kuan-Ying Lee @ 2021-08-04 9:09 ` Kuan-Ying Lee 2021-08-04 12:44 ` Andrey Konovalov 2021-08-04 9:09 ` [PATCH v3 2/2] kasan, slub: reset tag when printing address Kuan-Ying Lee 1 sibling, 1 reply; 5+ messages in thread From: Kuan-Ying Lee @ 2021-08-04 9:09 UTC (permalink / raw) To: Nicholas Tang, Andrew Yang, Andrey Konovalov, Andrey Ryabinin, Alexander Potapenko, Marco Elver, Catalin Marinas, Chinwen Chang, Andrew Morton Cc: kasan-dev, linux-mm, linux-kernel, linux-arm-kernel, linux-mediatek, Kuan-Ying Lee Kmemleak need to scan kernel memory to check memory leak. With hardware tag-based kasan enabled, when it scans on the invalid slab and dereference, the issue will occur as below. Hardware tag-based KASAN doesn't use compiler instrumentation, we can not use kasan_disable_current() to ignore tag check. Based on the below report, there are 11 0xf7 granules, which amounts to 176 bytes, and the object is allocated from the kmalloc-256 cache. So when kmemleak accesses the last 256-176 bytes, it causes faults, as those are marked with KASAN_KMALLOC_REDZONE == KASAN_TAG_INVALID == 0xfe. Thus, we reset tags before accessing metadata to avoid from false positives. [ 151.905804] ================================================================== [ 151.907120] BUG: KASAN: out-of-bounds in scan_block+0x58/0x170 [ 151.908773] Read at addr f7ff0000c0074eb0 by task kmemleak/138 [ 151.909656] Pointer tag: [f7], memory tag: [fe] [ 151.910195] [ 151.910876] CPU: 7 PID: 138 Comm: kmemleak Not tainted 5.14.0-rc2-00001-g8cae8cd89f05-dirty #134 [ 151.912085] Hardware name: linux,dummy-virt (DT) [ 151.912868] Call trace: [ 151.913211] dump_backtrace+0x0/0x1b0 [ 151.913796] show_stack+0x1c/0x30 [ 151.914248] dump_stack_lvl+0x68/0x84 [ 151.914778] print_address_description+0x7c/0x2b4 [ 151.915340] kasan_report+0x138/0x38c [ 151.915804] __do_kernel_fault+0x190/0x1c4 [ 151.916386] do_tag_check_fault+0x78/0x90 [ 151.916856] do_mem_abort+0x44/0xb4 [ 151.917308] el1_abort+0x40/0x60 [ 151.917754] el1h_64_sync_handler+0xb4/0xd0 [ 151.918270] el1h_64_sync+0x78/0x7c [ 151.918714] scan_block+0x58/0x170 [ 151.919157] scan_gray_list+0xdc/0x1a0 [ 151.919626] kmemleak_scan+0x2ac/0x560 [ 151.920129] kmemleak_scan_thread+0xb0/0xe0 [ 151.920635] kthread+0x154/0x160 [ 151.921115] ret_from_fork+0x10/0x18 [ 151.921717] [ 151.922077] Allocated by task 0: [ 151.922523] kasan_save_stack+0x2c/0x60 [ 151.923099] __kasan_kmalloc+0xec/0x104 [ 151.923502] __kmalloc+0x224/0x3c4 [ 151.924172] __register_sysctl_paths+0x200/0x290 [ 151.924709] register_sysctl_table+0x2c/0x40 [ 151.925175] sysctl_init+0x20/0x34 [ 151.925665] proc_sys_init+0x3c/0x48 [ 151.926136] proc_root_init+0x80/0x9c [ 151.926547] start_kernel+0x648/0x6a4 [ 151.926987] __primary_switched+0xc0/0xc8 [ 151.927557] [ 151.927994] Freed by task 0: [ 151.928340] kasan_save_stack+0x2c/0x60 [ 151.928766] kasan_set_track+0x2c/0x40 [ 151.929173] kasan_set_free_info+0x44/0x54 [ 151.929568] ____kasan_slab_free.constprop.0+0x150/0x1b0 [ 151.930063] __kasan_slab_free+0x14/0x20 [ 151.930449] slab_free_freelist_hook+0xa4/0x1fc [ 151.930924] kfree+0x1e8/0x30c [ 151.931285] put_fs_context+0x124/0x220 [ 151.931731] vfs_kern_mount.part.0+0x60/0xd4 [ 151.932280] kern_mount+0x24/0x4c [ 151.932686] bdev_cache_init+0x70/0x9c [ 151.933122] vfs_caches_init+0xdc/0xf4 [ 151.933578] start_kernel+0x638/0x6a4 [ 151.934014] __primary_switched+0xc0/0xc8 [ 151.934478] [ 151.934757] The buggy address belongs to the object at ffff0000c0074e00 [ 151.934757] which belongs to the cache kmalloc-256 of size 256 [ 151.935744] The buggy address is located 176 bytes inside of [ 151.935744] 256-byte region [ffff0000c0074e00, ffff0000c0074f00) [ 151.936702] The buggy address belongs to the page: [ 151.937378] page:(____ptrval____) refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x100074 [ 151.938682] head:(____ptrval____) order:2 compound_mapcount:0 compound_pincount:0 [ 151.939440] flags: 0xbfffc0000010200(slab|head|node=0|zone=2|lastcpupid=0xffff|kasantag=0x0) [ 151.940886] raw: 0bfffc0000010200 0000000000000000 dead000000000122 f5ff0000c0002300 [ 151.941634] raw: 0000000000000000 0000000000200020 00000001ffffffff 0000000000000000 [ 151.942353] page dumped because: kasan: bad access detected [ 151.942923] [ 151.943214] Memory state around the buggy address: [ 151.943896] ffff0000c0074c00: f0 f0 f0 f0 f0 f0 f0 f0 f0 fe fe fe fe fe fe fe [ 151.944857] ffff0000c0074d00: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe [ 151.945892] >ffff0000c0074e00: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 fe fe fe fe fe [ 151.946407] ^ [ 151.946939] ffff0000c0074f00: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe [ 151.947445] ffff0000c0075000: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 151.947999] ================================================================== [ 151.948524] Disabling lock debugging due to kernel taint [ 156.434569] kmemleak: 181 new suspected memory leaks (see /sys/kernel/debug/kmemleak) Signed-off-by: Kuan-Ying Lee <Kuan-Ying.Lee@mediatek.com> Acked-by: Catalin Marinas <catalin.marinas@arm.com> Cc: Marco Elver <elver@google.com> Cc: Andrey Konovalov <andreyknvl@gmail.com> --- mm/kmemleak.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/mm/kmemleak.c b/mm/kmemleak.c index 228a2fbe0657..73d46d16d575 100644 --- a/mm/kmemleak.c +++ b/mm/kmemleak.c @@ -290,7 +290,7 @@ static void hex_dump_object(struct seq_file *seq, warn_or_seq_printf(seq, " hex dump (first %zu bytes):\n", len); kasan_disable_current(); warn_or_seq_hex_dump(seq, DUMP_PREFIX_NONE, HEX_ROW_SIZE, - HEX_GROUP_SIZE, ptr, len, HEX_ASCII); + HEX_GROUP_SIZE, kasan_reset_tag((void *)ptr), len, HEX_ASCII); kasan_enable_current(); } @@ -1171,7 +1171,7 @@ static bool update_checksum(struct kmemleak_object *object) kasan_disable_current(); kcsan_disable_current(); - object->checksum = crc32(0, (void *)object->pointer, object->size); + object->checksum = crc32(0, kasan_reset_tag((void *)object->pointer), object->size); kasan_enable_current(); kcsan_enable_current(); @@ -1246,7 +1246,7 @@ static void scan_block(void *_start, void *_end, break; kasan_disable_current(); - pointer = *ptr; + pointer = *(unsigned long *)kasan_reset_tag((void *)ptr); kasan_enable_current(); untagged_ptr = (unsigned long)kasan_reset_tag((void *)pointer); -- 2.18.0 ^ permalink raw reply related [flat|nested] 5+ messages in thread
* Re: [PATCH v3 1/2] kasan, kmemleak: reset tags when scanning block 2021-08-04 9:09 ` [PATCH v3 1/2] kasan, kmemleak: reset tags when scanning block Kuan-Ying Lee @ 2021-08-04 12:44 ` Andrey Konovalov 0 siblings, 0 replies; 5+ messages in thread From: Andrey Konovalov @ 2021-08-04 12:44 UTC (permalink / raw) To: Kuan-Ying Lee Cc: Nicholas Tang, Andrew Yang, Andrey Ryabinin, Alexander Potapenko, Marco Elver, Catalin Marinas, Chinwen Chang, Andrew Morton, kasan-dev, Linux Memory Management List, LKML, Linux ARM, moderated list:ARM/Mediatek SoC support On Wed, Aug 4, 2021 at 11:10 AM Kuan-Ying Lee <Kuan-Ying.Lee@mediatek.com> wrote: > > Kmemleak need to scan kernel memory to check memory leak. > With hardware tag-based kasan enabled, when it scans on > the invalid slab and dereference, the issue will occur > as below. > > Hardware tag-based KASAN doesn't use compiler instrumentation, we > can not use kasan_disable_current() to ignore tag check. > > Based on the below report, there are 11 0xf7 granules, which amounts to > 176 bytes, and the object is allocated from the kmalloc-256 cache. So > when kmemleak accesses the last 256-176 bytes, it causes faults, as > those are marked with KASAN_KMALLOC_REDZONE == KASAN_TAG_INVALID == > 0xfe. > > Thus, we reset tags before accessing metadata to avoid from false positives. > > [ 151.905804] ================================================================== > [ 151.907120] BUG: KASAN: out-of-bounds in scan_block+0x58/0x170 > [ 151.908773] Read at addr f7ff0000c0074eb0 by task kmemleak/138 > [ 151.909656] Pointer tag: [f7], memory tag: [fe] > [ 151.910195] > [ 151.910876] CPU: 7 PID: 138 Comm: kmemleak Not tainted 5.14.0-rc2-00001-g8cae8cd89f05-dirty #134 > [ 151.912085] Hardware name: linux,dummy-virt (DT) > [ 151.912868] Call trace: > [ 151.913211] dump_backtrace+0x0/0x1b0 > [ 151.913796] show_stack+0x1c/0x30 > [ 151.914248] dump_stack_lvl+0x68/0x84 > [ 151.914778] print_address_description+0x7c/0x2b4 > [ 151.915340] kasan_report+0x138/0x38c > [ 151.915804] __do_kernel_fault+0x190/0x1c4 > [ 151.916386] do_tag_check_fault+0x78/0x90 > [ 151.916856] do_mem_abort+0x44/0xb4 > [ 151.917308] el1_abort+0x40/0x60 > [ 151.917754] el1h_64_sync_handler+0xb4/0xd0 > [ 151.918270] el1h_64_sync+0x78/0x7c > [ 151.918714] scan_block+0x58/0x170 > [ 151.919157] scan_gray_list+0xdc/0x1a0 > [ 151.919626] kmemleak_scan+0x2ac/0x560 > [ 151.920129] kmemleak_scan_thread+0xb0/0xe0 > [ 151.920635] kthread+0x154/0x160 > [ 151.921115] ret_from_fork+0x10/0x18 > [ 151.921717] > [ 151.922077] Allocated by task 0: > [ 151.922523] kasan_save_stack+0x2c/0x60 > [ 151.923099] __kasan_kmalloc+0xec/0x104 > [ 151.923502] __kmalloc+0x224/0x3c4 > [ 151.924172] __register_sysctl_paths+0x200/0x290 > [ 151.924709] register_sysctl_table+0x2c/0x40 > [ 151.925175] sysctl_init+0x20/0x34 > [ 151.925665] proc_sys_init+0x3c/0x48 > [ 151.926136] proc_root_init+0x80/0x9c > [ 151.926547] start_kernel+0x648/0x6a4 > [ 151.926987] __primary_switched+0xc0/0xc8 > [ 151.927557] > [ 151.927994] Freed by task 0: > [ 151.928340] kasan_save_stack+0x2c/0x60 > [ 151.928766] kasan_set_track+0x2c/0x40 > [ 151.929173] kasan_set_free_info+0x44/0x54 > [ 151.929568] ____kasan_slab_free.constprop.0+0x150/0x1b0 > [ 151.930063] __kasan_slab_free+0x14/0x20 > [ 151.930449] slab_free_freelist_hook+0xa4/0x1fc > [ 151.930924] kfree+0x1e8/0x30c > [ 151.931285] put_fs_context+0x124/0x220 > [ 151.931731] vfs_kern_mount.part.0+0x60/0xd4 > [ 151.932280] kern_mount+0x24/0x4c > [ 151.932686] bdev_cache_init+0x70/0x9c > [ 151.933122] vfs_caches_init+0xdc/0xf4 > [ 151.933578] start_kernel+0x638/0x6a4 > [ 151.934014] __primary_switched+0xc0/0xc8 > [ 151.934478] > [ 151.934757] The buggy address belongs to the object at ffff0000c0074e00 > [ 151.934757] which belongs to the cache kmalloc-256 of size 256 > [ 151.935744] The buggy address is located 176 bytes inside of > [ 151.935744] 256-byte region [ffff0000c0074e00, ffff0000c0074f00) > [ 151.936702] The buggy address belongs to the page: > [ 151.937378] page:(____ptrval____) refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x100074 > [ 151.938682] head:(____ptrval____) order:2 compound_mapcount:0 compound_pincount:0 > [ 151.939440] flags: 0xbfffc0000010200(slab|head|node=0|zone=2|lastcpupid=0xffff|kasantag=0x0) > [ 151.940886] raw: 0bfffc0000010200 0000000000000000 dead000000000122 f5ff0000c0002300 > [ 151.941634] raw: 0000000000000000 0000000000200020 00000001ffffffff 0000000000000000 > [ 151.942353] page dumped because: kasan: bad access detected > [ 151.942923] > [ 151.943214] Memory state around the buggy address: > [ 151.943896] ffff0000c0074c00: f0 f0 f0 f0 f0 f0 f0 f0 f0 fe fe fe fe fe fe fe > [ 151.944857] ffff0000c0074d00: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe > [ 151.945892] >ffff0000c0074e00: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 fe fe fe fe fe > [ 151.946407] ^ > [ 151.946939] ffff0000c0074f00: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe > [ 151.947445] ffff0000c0075000: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb > [ 151.947999] ================================================================== > [ 151.948524] Disabling lock debugging due to kernel taint > [ 156.434569] kmemleak: 181 new suspected memory leaks (see /sys/kernel/debug/kmemleak) > > Signed-off-by: Kuan-Ying Lee <Kuan-Ying.Lee@mediatek.com> > Acked-by: Catalin Marinas <catalin.marinas@arm.com> > Cc: Marco Elver <elver@google.com> > Cc: Andrey Konovalov <andreyknvl@gmail.com> > --- > mm/kmemleak.c | 6 +++--- > 1 file changed, 3 insertions(+), 3 deletions(-) > > diff --git a/mm/kmemleak.c b/mm/kmemleak.c > index 228a2fbe0657..73d46d16d575 100644 > --- a/mm/kmemleak.c > +++ b/mm/kmemleak.c > @@ -290,7 +290,7 @@ static void hex_dump_object(struct seq_file *seq, > warn_or_seq_printf(seq, " hex dump (first %zu bytes):\n", len); > kasan_disable_current(); > warn_or_seq_hex_dump(seq, DUMP_PREFIX_NONE, HEX_ROW_SIZE, > - HEX_GROUP_SIZE, ptr, len, HEX_ASCII); > + HEX_GROUP_SIZE, kasan_reset_tag((void *)ptr), len, HEX_ASCII); > kasan_enable_current(); > } > > @@ -1171,7 +1171,7 @@ static bool update_checksum(struct kmemleak_object *object) > > kasan_disable_current(); > kcsan_disable_current(); > - object->checksum = crc32(0, (void *)object->pointer, object->size); > + object->checksum = crc32(0, kasan_reset_tag((void *)object->pointer), object->size); > kasan_enable_current(); > kcsan_enable_current(); > > @@ -1246,7 +1246,7 @@ static void scan_block(void *_start, void *_end, > break; > > kasan_disable_current(); > - pointer = *ptr; > + pointer = *(unsigned long *)kasan_reset_tag((void *)ptr); > kasan_enable_current(); > > untagged_ptr = (unsigned long)kasan_reset_tag((void *)pointer); > -- > 2.18.0 > Reviewed-by: Andrey Konovalov <andreyknvl@gmail.com> ^ permalink raw reply [flat|nested] 5+ messages in thread
* [PATCH v3 2/2] kasan, slub: reset tag when printing address 2021-08-04 9:09 [PATCH v3 0/2] kasan: reset tag when accessing invalid metadata Kuan-Ying Lee 2021-08-04 9:09 ` [PATCH v3 1/2] kasan, kmemleak: reset tags when scanning block Kuan-Ying Lee @ 2021-08-04 9:09 ` Kuan-Ying Lee 2021-08-04 12:44 ` Andrey Konovalov 1 sibling, 1 reply; 5+ messages in thread From: Kuan-Ying Lee @ 2021-08-04 9:09 UTC (permalink / raw) To: Nicholas Tang, Andrew Yang, Andrey Konovalov, Andrey Ryabinin, Alexander Potapenko, Marco Elver, Catalin Marinas, Chinwen Chang, Andrew Morton Cc: kasan-dev, linux-mm, linux-kernel, linux-arm-kernel, linux-mediatek, Kuan-Ying Lee The address still includes the tags when it is printed. With hardware tag-based kasan enabled, we will get a false positive KASAN issue when we access metadata. Reset the tag before we access the metadata. Fixes: aa1ef4d7b3f6 ("kasan, mm: reset tags when accessing metadata") Signed-off-by: Kuan-Ying Lee <Kuan-Ying.Lee@mediatek.com> Reviewed-by: Marco Elver <elver@google.com> --- mm/slub.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/mm/slub.c b/mm/slub.c index b6c5205252eb..f77d8cd79ef7 100644 --- a/mm/slub.c +++ b/mm/slub.c @@ -576,8 +576,8 @@ static void print_section(char *level, char *text, u8 *addr, unsigned int length) { metadata_access_enable(); - print_hex_dump(level, kasan_reset_tag(text), DUMP_PREFIX_ADDRESS, - 16, 1, addr, length, 1); + print_hex_dump(level, text, DUMP_PREFIX_ADDRESS, + 16, 1, kasan_reset_tag((void *)addr), length, 1); metadata_access_disable(); } -- 2.18.0 ^ permalink raw reply related [flat|nested] 5+ messages in thread
* Re: [PATCH v3 2/2] kasan, slub: reset tag when printing address 2021-08-04 9:09 ` [PATCH v3 2/2] kasan, slub: reset tag when printing address Kuan-Ying Lee @ 2021-08-04 12:44 ` Andrey Konovalov 0 siblings, 0 replies; 5+ messages in thread From: Andrey Konovalov @ 2021-08-04 12:44 UTC (permalink / raw) To: Kuan-Ying Lee Cc: Nicholas Tang, Andrew Yang, Andrey Ryabinin, Alexander Potapenko, Marco Elver, Catalin Marinas, Chinwen Chang, Andrew Morton, kasan-dev, Linux Memory Management List, LKML, Linux ARM, moderated list:ARM/Mediatek SoC support On Wed, Aug 4, 2021 at 11:10 AM Kuan-Ying Lee <Kuan-Ying.Lee@mediatek.com> wrote: > > The address still includes the tags when it is printed. > With hardware tag-based kasan enabled, we will get a > false positive KASAN issue when we access metadata. > > Reset the tag before we access the metadata. > > Fixes: aa1ef4d7b3f6 ("kasan, mm: reset tags when accessing metadata") > Signed-off-by: Kuan-Ying Lee <Kuan-Ying.Lee@mediatek.com> > Reviewed-by: Marco Elver <elver@google.com> > --- > mm/slub.c | 4 ++-- > 1 file changed, 2 insertions(+), 2 deletions(-) > > diff --git a/mm/slub.c b/mm/slub.c > index b6c5205252eb..f77d8cd79ef7 100644 > --- a/mm/slub.c > +++ b/mm/slub.c > @@ -576,8 +576,8 @@ static void print_section(char *level, char *text, u8 *addr, > unsigned int length) > { > metadata_access_enable(); > - print_hex_dump(level, kasan_reset_tag(text), DUMP_PREFIX_ADDRESS, > - 16, 1, addr, length, 1); > + print_hex_dump(level, text, DUMP_PREFIX_ADDRESS, > + 16, 1, kasan_reset_tag((void *)addr), length, 1); > metadata_access_disable(); > } > > -- > 2.18.0 Reviewed-by: Andrey Konovalov <andreyknvl@gmail.com> Thanks! ^ permalink raw reply [flat|nested] 5+ messages in thread
end of thread, other threads:[~2021-08-04 12:46 UTC | newest] Thread overview: 5+ messages (download: mbox.gz / follow: Atom feed) -- links below jump to the message on this page -- 2021-08-04 9:09 [PATCH v3 0/2] kasan: reset tag when accessing invalid metadata Kuan-Ying Lee 2021-08-04 9:09 ` [PATCH v3 1/2] kasan, kmemleak: reset tags when scanning block Kuan-Ying Lee 2021-08-04 12:44 ` Andrey Konovalov 2021-08-04 9:09 ` [PATCH v3 2/2] kasan, slub: reset tag when printing address Kuan-Ying Lee 2021-08-04 12:44 ` Andrey Konovalov
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox; as well as URLs for NNTP newsgroup(s).