Re: [PATCH v2 01/10] mm: add Kernel Electric-Fence infrastructure

[Hillf Danton <hdanton@sina.com>]

Tue, 15 Sep 2020 15:20:37 +0200
> From: Alexander Potapenko <glider@google.com>
> 
> This adds the Kernel Electric-Fence (KFENCE) infrastructure. KFENCE is a
> low-overhead sampling-based memory safety error detector of heap
> use-after-free, invalid-free, and out-of-bounds access errors.
> 
> KFENCE is designed to be enabled in production kernels, and has near
> zero performance overhead. Compared to KASAN, KFENCE trades performance
> for precision. The main motivation behind KFENCE's design, is that with
> enough total uptime KFENCE will detect bugs in code paths not typically
> exercised by non-production test workloads. One way to quickly achieve a
> large enough total uptime is when the tool is deployed across a large
> fleet of machines.
> 
> KFENCE objects each reside on a dedicated page, at either the left or
> right page boundaries. The pages to the left and right of the object
> page are "guard pages", whose attributes are changed to a protected
> state, and cause page faults on any attempted access to them. Such page
> faults are then intercepted by KFENCE, which handles the fault
> gracefully by reporting a memory access error.

To help understand the magic of KFENCE, a simple diagram looks needed to
illustrate the relations between obj and guard pages, something like the
below asiic chart.

	|-----------------|-----------------------------------|------------------|
	| left guard page | the page containing KFENCE object | right guard page |
	|-----------------|-----------------------------------|------------------|