From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 556F6C433F5 for ; Fri, 19 Nov 2021 14:36:33 +0000 (UTC) Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by mail.kernel.org (Postfix) with ESMTP id F2948615E2 for ; Fri, 19 Nov 2021 14:36:32 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.4.1 mail.kernel.org F2948615E2 Authentication-Results: mail.kernel.org; dmarc=fail (p=none dis=none) header.from=gmail.com Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=kvack.org Received: by kanga.kvack.org (Postfix) id 8056C6B00AE; Fri, 19 Nov 2021 09:36:22 -0500 (EST) Received: by kanga.kvack.org (Postfix, from userid 40) id 78DF56B00AF; Fri, 19 Nov 2021 09:36:22 -0500 (EST) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 607B86B00B0; Fri, 19 Nov 2021 09:36:22 -0500 (EST) X-Delivered-To: linux-mm@kvack.org Received: from forelay.hostedemail.com (smtprelay0029.hostedemail.com [216.40.44.29]) by kanga.kvack.org (Postfix) with ESMTP id 4E8C26B00AE for ; Fri, 19 Nov 2021 09:36:22 -0500 (EST) Received: from smtpin26.hostedemail.com (10.5.19.251.rfc1918.com [10.5.19.251]) by forelay04.hostedemail.com (Postfix) with ESMTP id 11072852E0 for ; Fri, 19 Nov 2021 14:36:12 +0000 (UTC) X-FDA: 78825929784.26.32CD498 Received: from mail-il1-f178.google.com (mail-il1-f178.google.com [209.85.166.178]) by imf05.hostedemail.com (Postfix) with ESMTP id 5330F5092EE4 for ; Fri, 19 Nov 2021 14:36:09 +0000 (UTC) Received: by mail-il1-f178.google.com with SMTP id t8so518321ilu.8 for ; Fri, 19 Nov 2021 06:36:11 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20210112; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=n+RDH+9iEIrcuUvczXJii8lb9lf6yHmXP37Xa9ufdcY=; b=S09SVRr+zWdUHbTD/+aAN5QR8Hsi1IqqM0LJ0U3MMPyAECPNGmdb43U/ARrEA69M47 tlnsKy4QlTD2c10h8SPqDfJx0umnVVqvJdwR5FHT3M13/fYcdac9DHLd62xQD28PH9Jy OxRzmERtSWd9wKNPb229m8W/4AlD4GjAlogfStR49oPQlUqt9Y4K/24DHcNDlEWv54Do KXZlzclychv7CB4Y/ZJwAJmbMYys91ybHXiyq3cQ8qbLopylJG0Cb6OxCZIQo3MDkm8T sf2QFNLsJsUMQtPKgsIMUtYgZwDbp0W+jkqpnyniHYGxqJNP9T/cGfEdcWoMQwHQk3+y HEuw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=n+RDH+9iEIrcuUvczXJii8lb9lf6yHmXP37Xa9ufdcY=; b=kWYv9euOBCyCb0SDYsi78+cfqzV57twdhyqoVSCcwwSIsOSnPsR1etlkcpWuYYIX7H 1Ju68GC5/a7egJEuB9fsvMZKUNHDTnRxVFSPjb2L096MMZ9mTZNoMd1C1H/atWINyTLZ Ly9jSA+byV4kAyqfLdKF7e2A6VJ6UHcYkqtyoZUpJGP6+62jUZX66mWibrkVr1qXuRdR ifpUf2bm6UhosUr3gApmrUBpchaFbtg0/HH4muV7Tr/JXExXlyrnZpbxtOQOhj2ErKT4 wbTLfNWEFOE5CHRHcaPY5i2wBGWFpuULjGyeic40RRzTJsMUmPuiJrepzz/yMUbcYPz6 aGSQ== X-Gm-Message-State: AOAM530gscGmXRsTlqvR0YGMAJe3UnP069opRULMOAZcRXutc0wJ+C4C 6BDgWBt6gkBFtT8hUS0KBkHcniub0RHYfQeoLR0= X-Google-Smtp-Source: ABdhPJyAiozoEc+fe7KgSFNpGGDIWeRw8ZbJ0IFuJnE6kS8Ffn5g9NM1DEQBPBJXLdKgdaNqBRi+pRK+tnpKQd3OotE= X-Received: by 2002:a05:6e02:1d1b:: with SMTP id i27mr269533ila.248.1637332571116; Fri, 19 Nov 2021 06:36:11 -0800 (PST) MIME-Version: 1.0 References: <20211119142219.1519617-1-elver@google.com> In-Reply-To: <20211119142219.1519617-1-elver@google.com> From: Andrey Konovalov Date: Fri, 19 Nov 2021 15:36:00 +0100 Message-ID: Subject: Re: [PATCH 1/2] kasan: add ability to detect double-kmem_cache_destroy() To: Marco Elver Cc: Andrew Morton , Andrey Ryabinin , Alexander Potapenko , Dmitry Vyukov , Christoph Lameter , Pekka Enberg , David Rientjes , Joonsoo Kim , Vlastimil Babka , kasan-dev , LKML , Linux Memory Management List Content-Type: text/plain; charset="UTF-8" X-Rspamd-Server: rspam08 X-Rspamd-Queue-Id: 5330F5092EE4 X-Stat-Signature: pdg8h181cxmrzndyy8ootd9rrjubrpwo Authentication-Results: imf05.hostedemail.com; dkim=pass header.d=gmail.com header.s=20210112 header.b=S09SVRr+; dmarc=pass (policy=none) header.from=gmail.com; spf=pass (imf05.hostedemail.com: domain of andreyknvl@gmail.com designates 209.85.166.178 as permitted sender) smtp.mailfrom=andreyknvl@gmail.com X-HE-Tag: 1637332569-309889 X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: On Fri, Nov 19, 2021 at 3:22 PM Marco Elver wrote: > > Because mm/slab_common.c is not instrumented with software KASAN modes, > it is not possible to detect use-after-free of the kmem_cache passed > into kmem_cache_destroy(). In particular, because of the s->refcount-- > and subsequent early return if non-zero, KASAN would never be able to > see the double-free via kmem_cache_free(kmem_cache, s). To be able to > detect a double-kmem_cache_destroy(), check accessibility of the > kmem_cache, and in case of failure return early. > > While KASAN_HW_TAGS is able to detect such bugs, by checking > accessibility and returning early we fail more gracefully and also > avoid corrupting reused objects (where tags mismatch). > > A recent case of a double-kmem_cache_destroy() was detected by KFENCE: > https://lkml.kernel.org/r/0000000000003f654905c168b09d@google.com > , which was not detectable by software KASAN modes. > > Signed-off-by: Marco Elver > --- > mm/slab_common.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/mm/slab_common.c b/mm/slab_common.c > index e5d080a93009..4bef4b6a2c76 100644 > --- a/mm/slab_common.c > +++ b/mm/slab_common.c > @@ -491,7 +491,7 @@ void kmem_cache_destroy(struct kmem_cache *s) > { > int err; > > - if (unlikely(!s)) > + if (unlikely(!s || !kasan_check_byte(s))) > return; > > cpus_read_lock(); > -- > 2.34.0.rc2.393.gf8c9666880-goog > Reviewed-by: Andrey Konovalov Thanks!