From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id 44F91C3DA61 for ; Wed, 24 Jul 2024 21:17:17 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id CFA6F6B0088; Wed, 24 Jul 2024 17:17:16 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id CB3D36B0089; Wed, 24 Jul 2024 17:17:16 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id B4A716B008A; Wed, 24 Jul 2024 17:17:16 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0012.hostedemail.com [216.40.44.12]) by kanga.kvack.org (Postfix) with ESMTP id 950856B0088 for ; Wed, 24 Jul 2024 17:17:16 -0400 (EDT) Received: from smtpin23.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay10.hostedemail.com (Postfix) with ESMTP id 38CD0C0C57 for ; Wed, 24 Jul 2024 21:17:16 +0000 (UTC) X-FDA: 82375906872.23.55631F7 Received: from sin.source.kernel.org (sin.source.kernel.org [145.40.73.55]) by imf11.hostedemail.com (Postfix) with ESMTP id 0E7CF40007 for ; Wed, 24 Jul 2024 21:17:13 +0000 (UTC) Authentication-Results: imf11.hostedemail.com; dkim=pass header.d=linux-foundation.org header.s=korg header.b=P7Y7O8l1; dmarc=none; spf=pass (imf11.hostedemail.com: domain of akpm@linux-foundation.org designates 145.40.73.55 as permitted sender) smtp.mailfrom=akpm@linux-foundation.org ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1721855780; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references:dkim-signature; bh=33jHwZQKsKsI96L6IRoFs6G93mswFxjWZc8vGx8w+wI=; b=vjW0Sik8TsrMD4Br9itnDA/FYX4h2aDF2M+UnTH43HwpMImp2oecoukLVGh0q2ryzkSJ5i D+r6qibcX6Rw2vjrwtIo1I3WJcA7EdcEd56BRRj2nFzGGj3IrKpDHKN24UJSJmO/Ygg23p S2QGOx6Mb6yIG/1pNHE8Dv8/dUXHbqE= ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1721855780; a=rsa-sha256; cv=none; b=JOFaoENqj+TigRmCtP6JA1qpHGnu3JomEhba3Jm/8/tG4yX0Qw5TbyMOo6RKuh1qzhV9MP 63mXIYGlVExMb+lqZ/zze7VmmiRB5GQS6TbGZmHv90LIdz4X8fMIGWZzXAY3mvU8JGO1QY RKIszQ9Lx8hafLxbf4FQ0T7iLV9DG7U= ARC-Authentication-Results: i=1; imf11.hostedemail.com; dkim=pass header.d=linux-foundation.org header.s=korg header.b=P7Y7O8l1; dmarc=none; spf=pass (imf11.hostedemail.com: domain of akpm@linux-foundation.org designates 145.40.73.55 as permitted sender) smtp.mailfrom=akpm@linux-foundation.org Received: from smtp.kernel.org (transwarp.subspace.kernel.org [100.75.92.58]) by sin.source.kernel.org (Postfix) with ESMTP id EC592CE12BD; Wed, 24 Jul 2024 21:17:10 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id B9AB2C32781; Wed, 24 Jul 2024 21:17:09 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linux-foundation.org; s=korg; t=1721855830; bh=CtU01g2cCRY8Yc3D5EGXN7sqJewwORULkSqRWpWQe7E=; h=Date:From:To:Cc:Subject:In-Reply-To:References:From; b=P7Y7O8l1H1DXEr/5YsFuXJR2ydkIdZjePru7UM2U5trRvNItdsCwyMvqTb9C4eh7Z WSHPkWDzXMrEXygL3+ympmYYKOKRdNT/IyEUGc6bNpX/QliCP0rfM3Q2AdslESJpSK ZRR/48ITmHhhXhdo7Zlj8wmFL+nGAsFpVzfmCabA= Date: Wed, 24 Jul 2024 14:17:09 -0700 From: Andrew Morton To: Jann Horn Cc: Andrey Ryabinin , Alexander Potapenko , Andrey Konovalov , Dmitry Vyukov , Vincenzo Frascino , Christoph Lameter , Pekka Enberg , David Rientjes , Joonsoo Kim , Vlastimil Babka , Roman Gushchin , Hyeonggon Yoo <42.hyeyoo@gmail.com>, Marco Elver , kasan-dev@googlegroups.com, linux-kernel@vger.kernel.org, linux-mm@kvack.org Subject: Re: [PATCH v2 1/2] kasan: catch invalid free before SLUB reinitializes the object Message-Id: <20240724141709.8350097a90d88f7d6d14c363@linux-foundation.org> In-Reply-To: <20240724-kasan-tsbrcu-v2-1-45f898064468@google.com> References: <20240724-kasan-tsbrcu-v2-0-45f898064468@google.com> <20240724-kasan-tsbrcu-v2-1-45f898064468@google.com> X-Mailer: Sylpheed 3.8.0beta1 (GTK+ 2.24.33; x86_64-pc-linux-gnu) Mime-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit X-Rspamd-Server: rspam07 X-Rspamd-Queue-Id: 0E7CF40007 X-Stat-Signature: ieh3dg7o6rf7ofbhnxaem83t7h1996x4 X-Rspam-User: X-HE-Tag: 1721855833-492123 X-HE-Meta: U2FsdGVkX189Ot/MpPZToZ/8ZwA82tLytrE+cSh5TrLR5H4tBmirZwGv3Bpz5bCbTZzojjzoUOfsKp5bp0mBrUhhHFBitOaHf61xwuS4JfOrvB02AruEbLvA0DPnCQuH6IU/Y44BHEat1i85XSdPl+VjNcByd/7reVvsuoJe5UJ0ABw+vBFr4ud+o0jurGq9dpu1GbQKY6WaAf0wmKx47kieMDuIVdrGdA8u7CiXWLbmRx5R1UUG3S4xl7nmDbPmk6AnjugOhT9LNGVVqMFym5+pBi5gBpSqHnauRAUpqU6rZfRH/rvbnUkAnFjNlNIDMpgUs+toPCqkJmzBOvQLWCmUZcEBkdLpKHIZPJqUbPVFrqbw09L2eyHYgD9a9MENe2dD7VGj/h5CNNrImNGYr+1g/+btv143iRwxMUU8Y1tVTFgM3ch/WSSUwkTgtlmNu7qYf5rTm+P43CO6xAMD9IH+Od1RZRGVj93ckwHhtKTl1tr/DdfKmLNV+2spQph/9k+pD2P2a6afVUHV/FI+1fo0QqHPn6Vr/tTUfa52IbmU3G1QWtFIYJTszgf155Rhtbeyib4Fi1SbkWs5JybsmO1H96U3qhGkv/uS3N01Tpm0oiq9IUszVkVDrqadjwbs3faZV+GPSQFm9k+B7QRW68iqJzrWN6Rgcma4Uskp9gg3xJjFJs/Bi6A13fJrmaX/Y+RLNOWaK5UywUrcqPtbB1fktR8Yvkwe5Xvqo6B19w1mtkMEWTNuTFPxncCz8MILAjvOaxOsOWRhcGfpZoXbA+i7NhNfQdWXcyQVbIglWs4WiWT/nAG8p0vkIiNr8GLQIAnualq51eYW8qOtJ9OcLWRY4vOBQ01fSoDr++TaSWy7LN4Ki2jibhkuDdhOO19Lxmt8AysOqlI0VmI3UNFV7qRh1NQLAIbXpxx1cl+ra3WEIS6cBJ/JOIGhmfAwKkRWDw02CcckaWwhDQM3UOA hxOscAOV Kgy0MgIvkwBHHVxnfoPtdrsHIPRsUeV5tdDpnG7nFppwwmwlWF0FO+dDsW3rG5BcLk1bN9Ls26A0H7I0RpJLW2qzQeLpt7P/czSzgwmoQNNww7YQU0mIUtbEOt4+p7FdQ19Xdyi9myNOPXrc/Wu+BMheAPMWjoJq35n4FeVoHR/3qItBFzCrRSLKQK3WXl7b9kz03Mm/8nE5C2RwmewEiT9D5ck26KgZO9oGOllnamuiFhiUrQub3XnkllnX871tfcFE3/5samQ6JaahX+f1ww88rSIoZIW4V5DgHNR4PsakUSI0TzD4PtmJTrHES+bHhBC4X X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: List-Subscribe: List-Unsubscribe: On Wed, 24 Jul 2024 18:34:12 +0200 Jann Horn wrote: > Currently, when KASAN is combined with init-on-free behavior, the > initialization happens before KASAN's "invalid free" checks. > > More importantly, a subsequent commit will want to use the object metadata > region to store an rcu_head, and we should let KASAN check that the object > pointer is valid before that. (Otherwise that change will make the existing > testcase kmem_cache_invalid_free fail.) > > So add a new KASAN hook that allows KASAN to pre-validate a > kmem_cache_free() operation before SLUB actually starts modifying the > object or its metadata. I added this, to fix the CONFIG_KASAN=n build --- a/include/linux/kasan.h~kasan-catch-invalid-free-before-slub-reinitializes-the-object-fix +++ a/include/linux/kasan.h @@ -381,6 +381,12 @@ static inline void *kasan_init_slab_obj( { return (void *)object; } + +static inline bool kasan_slab_pre_free(struct kmem_cache *s, void *object) +{ + return false; +} + static inline bool kasan_slab_free(struct kmem_cache *s, void *object, bool init) { return false; _