From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id 0CEA6FA3740 for ; Mon, 31 Oct 2022 10:55:21 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id 661726B0071; Mon, 31 Oct 2022 06:55:21 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id 610A86B0073; Mon, 31 Oct 2022 06:55:21 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 4D8366B0074; Mon, 31 Oct 2022 06:55:21 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0014.hostedemail.com [216.40.44.14]) by kanga.kvack.org (Postfix) with ESMTP id 238DA6B0071 for ; Mon, 31 Oct 2022 06:55:21 -0400 (EDT) Received: from smtpin17.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay06.hostedemail.com (Postfix) with ESMTP id CE936AB177 for ; Mon, 31 Oct 2022 10:55:20 +0000 (UTC) X-FDA: 80080938000.17.D3A8B95 Received: from mail-lj1-f174.google.com (mail-lj1-f174.google.com [209.85.208.174]) by imf02.hostedemail.com (Postfix) with ESMTP id B36F880010 for ; Mon, 31 Oct 2022 10:55:18 +0000 (UTC) Received: by mail-lj1-f174.google.com with SMTP id s24so16209868ljs.11 for ; Mon, 31 Oct 2022 03:55:18 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linaro.org; s=google; h=user-agent:in-reply-to:content-disposition:mime-version:references :message-id:subject:cc:to:from:date:from:to:cc:subject:date :message-id:reply-to; bh=Vs8b348OkSvTZqWJZHM3b1AfWz+B6VWXkmO4oUM6MwQ=; b=GLQL1XmTK3l1MirtqdQhFQskqagjOJx76LN8rUQJq3GZ4Mkv1D49mfJND9JGc/6WJ9 L9KjFp0hJNQHI2P0+u/PretVy/enlwJknoyBAFt+pyfT8nHuCe+rrplW1fChhyLSwDvp a44TAW8ApFiZHwEPywv7GPSba8s0tlAP97J8tlCGsHyGLb+EoO7gz5ajTKK4iU7sQRx9 uSqZEKEMHbUDIfApVz4DoxRDtoIe1ekrT3Wexfmqs/PloIaVGp8UAwrcqp2IoiDHFteZ qJVF9+n7X9UXmdSWz4xqySyZt0+XLyJOcya1rl/VYPtkT1HmejeJyNyxE4cSLHLrekei iulQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=user-agent:in-reply-to:content-disposition:mime-version:references :message-id:subject:cc:to:from:date:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=Vs8b348OkSvTZqWJZHM3b1AfWz+B6VWXkmO4oUM6MwQ=; b=49pQIxbbmZouXPaIk4TNN9oE7+yDlBa1RSD6PHnKO9pJvy+CO5qBGEyYi4lwd0C2XW B7Q6ep7N9TozHANJv1G5BsZy8beTklCD6l7U6xG2iTi2xt0Bch494CZIxsWhijZySZEP b5tGizri1J7fpkwmNXZPJtDNhVg3VM7xHjI5f8pXkCfu9Yu5kR0JDyOu0h+wAMgyA+CI hdUTg80T/yeq29JGrqmkQNC1W0sHTEBUPEJkKGsIezU63FD2I91cRukGu5IWmNTnvm1l 8JnlpTU4dDgeIIO0YGxEOxz+UcfQ/TpgKxzXbSD+mLezXrnUQqL4mOHhB3ufZqJEy+I8 MmAA== X-Gm-Message-State: ACrzQf0S6RXA7qVOvPSj+iRQ1ecXiv0ZhH5No/nKv7NeaxG5vKpBW/49 7Bz1fe7WF8RXEIkN3zAjzPHbsA== X-Google-Smtp-Source: AMsMyM5LkywZEAMftHb2Eca7dcpiTQKMZhT2b3Mw0/Ejx0460lEOmxkSj2AeSl5MitKpJv2S5HizeA== X-Received: by 2002:a2e:8781:0:b0:26d:e758:ce84 with SMTP id n1-20020a2e8781000000b0026de758ce84mr4895538lji.178.1667213716770; Mon, 31 Oct 2022 03:55:16 -0700 (PDT) Received: from mutt (c-e429e555.07-21-73746f28.bbcust.telenor.se. [85.229.41.228]) by smtp.gmail.com with ESMTPSA id o17-20020ac25e31000000b0049476667228sm1234690lfg.65.2022.10.31.03.55.16 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 31 Oct 2022 03:55:16 -0700 (PDT) Date: Mon, 31 Oct 2022 11:55:14 +0100 From: Anders Roxell To: Kees Cook Cc: Andrew Morton , Vlastimil Babka , David Rientjes , Marco Elver , Vincenzo Frascino , linux-mm@kvack.org, Andrey Konovalov , linux-kernel@vger.kernel.org, linux-hardening@vger.kernel.org Subject: Re: [PATCH v4] mempool: Do not use ksize() for poisoning Message-ID: <20221031105514.GB69385@mutt> References: <20221028154823.you.615-kees@kernel.org> MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Disposition: inline In-Reply-To: <20221028154823.you.615-kees@kernel.org> User-Agent: Mutt/1.10.1 (2018-07-13) ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1667213719; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type:content-transfer-encoding: in-reply-to:in-reply-to:references:references:dkim-signature; bh=Vs8b348OkSvTZqWJZHM3b1AfWz+B6VWXkmO4oUM6MwQ=; b=e7o6zMWgLLiJ3E36wmbydctcJyAI/v73gvJyF/xKdlcc5VJJh8vSBvxaOE3fYwmH2Dm4RQ olWIRprGuN0kLCyyDTrZBBp1BWgoJS+cYIQVf5nR5QfEWg5EClvoK1WbwmBE43LJGeFGmS yB1mXsufYTDkujO35+8uRR1lMscf5Z8= ARC-Authentication-Results: i=1; imf02.hostedemail.com; dkim=pass header.d=linaro.org header.s=google header.b=GLQL1XmT; spf=pass (imf02.hostedemail.com: domain of anders.roxell@linaro.org designates 209.85.208.174 as permitted sender) smtp.mailfrom=anders.roxell@linaro.org; dmarc=pass (policy=none) header.from=linaro.org ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1667213719; a=rsa-sha256; cv=none; b=vqZ4RM7lXvCmGikai7B8duS/BVeLBmyeZibHJTMJ3VHn39wKMiOBuKpKOjgpf9Ovn4ig4s E8ZjjNyRUcdT+7i3aSo5hScY6eFWrRNp4SELxo1KiWJ5XNT9y1aDypZ2ACweRv5V7xK3D4 I+wactUKipgCyR7JBJRL3baQi9ifDQE= X-Stat-Signature: 6dsnxipwri3e3o41p6srqh7c9r8ikf1q X-Rspamd-Queue-Id: B36F880010 Authentication-Results: imf02.hostedemail.com; dkim=pass header.d=linaro.org header.s=google header.b=GLQL1XmT; spf=pass (imf02.hostedemail.com: domain of anders.roxell@linaro.org designates 209.85.208.174 as permitted sender) smtp.mailfrom=anders.roxell@linaro.org; dmarc=pass (policy=none) header.from=linaro.org X-Rspam-User: X-Rspamd-Server: rspam01 X-HE-Tag: 1667213718-747512 X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: On 2022-10-28 08:53, Kees Cook wrote: > Nothing appears to be using ksize() within the kmalloc-backed mempools > except the mempool poisoning logic. Use the actual pool size instead > of the ksize() to avoid needing any special handling of the memory as > needed by KASAN, UBSAN_BOUNDS, nor FORTIFY_SOURCE. > > Suggested-by: Vlastimil Babka > Link: https://lore.kernel.org/lkml/f4fc52c4-7c18-1d76-0c7a-4058ea2486b9@suse.cz/ > Cc: David Rientjes > Cc: Marco Elver > Cc: Vincenzo Frascino > Cc: Andrew Morton > Cc: linux-mm@kvack.org > Acked-by: Vlastimil Babka > Reviewed-by: Andrey Konovalov > Signed-off-by: Kees Cook > --- > This replaces mempool-use-kmalloc_size_roundup-to-match-ksize-usage.patch > v4: add review/ack tags, explicitly call out subject change > v3: https://lore.kernel.org/lkml/20221025233421.you.825-kees@kernel.org/ > v2: https://lore.kernel.org/lkml/20221018090323.never.897-kees@kernel.org/ > v1: https://lore.kernel.org/lkml/20220923202822.2667581-14-keescook@chromium.org/ > --- > mm/mempool.c | 6 +++--- > 1 file changed, 3 insertions(+), 3 deletions(-) Hi, I see the following kernel paninc when I boot an arm64 allmodconfig kernel from todays linux-next tag next-20221031 This is the .config file I built [1], and here is the full log [2]. [ 17.445316][ T1] [fffe00001188f9bf] address between user and kernel address ranges [ 17.449021][ T1] Internal error: Oops: 0000000096000044 [#1] PREEMPT SMP [ 17.453097][ T1] Modules linked in: [ 17.455384][ T1] CPU: 0 PID: 1 Comm: swapper/0 Tainted: G B T 6.1.0-rc3-next-20221031 #2 1e3e4f9d63a6fa6d1a293981bef64866cf5e5454 [ 17.463100][ T1] Hardware name: linux,dummy-virt (DT) [ 17.466247][ T1] pstate: 40400005 (nZcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 17.470778][ T1] pc : __poison_element+0x3c/0x80 [ 17.473688][ T1] lr : __poison_element+0x38/0x80 [ 17.476614][ T1] sp : ffff80000eea7b50 [ 17.478996][ T1] x29: ffff80000eea7b50 x28: ffff000008c88468 x27: ffff000008c88450 [ 17.483694][ T1] x26: 0000000000000cc0 x25: ffff000008c88448 x24: ffff000008b3cf80 [ 17.488338][ T1] x23: ffff000008c8844c x22: ffff000008c88460 x21: ffff000008d52a40 [ 17.493032][ T1] x20: ffff000008d52a40 x19: ffff000008b3cf7f x18: 0000000000000000 [ 17.497707][ T1] x17: 0000000000000000 x16: 0000000000000000 x15: 0000000000000000 [ 17.502413][ T1] x14: 0000000000000000 x13: 0000000000000001 x12: 0000000000000001 [ 17.507109][ T1] x11: 0000000000000000 x10: 0000000000000000 x9 : 0000000000000000 [ 17.511775][ T1] x8 : 0000000000000000 x7 : 0000000000000000 x6 : 0000000000000000 [ 17.516447][ T1] x5 : 0000000000000000 x4 : 0000000000000000 x3 : 0000000000000000 [ 17.521116][ T1] x2 : 0000000000000000 x1 : 0000000000000000 x0 : 00000000ffffffa5 [ 17.525782][ T1] Call trace: [ 17.527664][ T1] __poison_element+0x3c/0x80 [ 17.530409][ T1] poison_element.isra.0+0x50/0x180 [ 17.533419][ T1] mempool_init_node+0x224/0x340 [ 17.536298][ T1] mempool_create+0x78/0x100 [ 17.538989][ T1] dma_bus_init+0x124/0x2a4 [ 17.541607][ T1] do_one_initcall+0x29c/0x680 [ 17.544381][ T1] do_initcalls+0x178/0x240 [ 17.547005][ T1] kernel_init_freeable+0x2e4/0x36c [ 17.550018][ T1] kernel_init+0x30/0x180 [ 17.552534][ T1] ret_from_fork+0x10/0x20 [ 17.555130][ T1] Code: 94057fb5 8b130280 940575a3 12800b40 (38336a80) [ 17.559124][ T1] ---[ end trace 0000000000000000 ]--- [ 17.562259][ T1] Kernel panic - not syncing: Oops: Fatal exception [ 17.566094][ T1] ---[ end Kernel panic - not syncing: Oops: Fatal exception ]--- When I revert this patch the kernel boots fine. Any idea what goes wrong? Cheers, Anders [1] https://people.linaro.org/~anders.roxell/next-20221031.config [2] http://ix.io/4eAH