From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail-it0-f70.google.com (mail-it0-f70.google.com [209.85.214.70]) by kanga.kvack.org (Postfix) with ESMTP id 033406B0005 for ; Thu, 12 Apr 2018 12:45:39 -0400 (EDT) Received: by mail-it0-f70.google.com with SMTP id h81-v6so5449428itb.0 for ; Thu, 12 Apr 2018 09:45:38 -0700 (PDT) Received: from mail-sor-f41.google.com (mail-sor-f41.google.com. [209.85.220.41]) by mx.google.com with SMTPS id j71-v6sor2324620itj.5.2018.04.12.09.45.37 for (Google Transport Security); Thu, 12 Apr 2018 09:45:37 -0700 (PDT) MIME-Version: 1.0 In-Reply-To: References: <805d1e85-2d3c-2327-6e6c-f14a56dc0b67@virtuozzo.com> <0c4397da-e231-0044-986f-b8468314be76@virtuozzo.com> <0857f052-a27a-501e-8923-c6f31510e4fe@virtuozzo.com> <0f448799-3a06-a25d-d604-21db3e8577fc@virtuozzo.com> From: Andrey Konovalov Date: Thu, 12 Apr 2018 18:45:35 +0200 Message-ID: Subject: Re: [RFC PATCH v2 13/15] khwasan: add hooks implementation Content-Type: text/plain; charset="UTF-8" Sender: owner-linux-mm@kvack.org List-ID: To: Andrey Ryabinin Cc: Alexander Potapenko , Dmitry Vyukov , Jonathan Corbet , Catalin Marinas , Will Deacon , Marc Zyngier , Christopher Li , Christoph Lameter , Pekka Enberg , David Rientjes , Joonsoo Kim , Andrew Morton , Masahiro Yamada , Michal Marek , Mark Rutland , Ard Biesheuvel , Yury Norov , Nick Desaulniers , Suzuki K Poulose , Kristina Martsenko , Punit Agrawal , Dave Martin , Michael Weiser , James Morse , Julien Thierry , Steve Capper , Tyler Baicar , "Eric W . Biederman" , Thomas Gleixner , Ingo Molnar , Paul Lawrence , Greg Kroah-Hartman , David Woodhouse , Sandipan Das , Kees Cook , Herbert Xu , Geert Uytterhoeven , Josh Poimboeuf , Arnd Bergmann , kasan-dev , linux-doc@vger.kernel.org, LKML , Linux ARM , kvmarm@lists.cs.columbia.edu, linux-sparse@vger.kernel.org, Linux Memory Management List , Linux Kbuild mailing list , Kostya Serebryany , Evgeniy Stepanov , Lee Smith , Ramana Radhakrishnan , Jacob Bramley , Ruben Ayrapetyan , Kees Cook , Jann Horn , Mark Brand On Tue, Apr 10, 2018 at 6:31 PM, Andrey Ryabinin wrote: > > > On 04/10/2018 07:07 PM, Andrey Konovalov wrote: >> On Fri, Apr 6, 2018 at 2:27 PM, Andrey Ryabinin wrote: >>> On 04/06/2018 03:14 PM, Andrey Konovalov wrote: >>>> On Thu, Apr 5, 2018 at 3:02 PM, Andrey Ryabinin wrote: >>>>> Nevertheless, this doesn't mean that we should ignore *all* accesses to !slab memory. >>>> >>>> So you mean we need to find a way to ignore accesses via pointers >>>> returned by page_address(), but still check accesses through all other >>>> pointers tagged with 0xFF? I don't see an obvious way to do this. I'm >>>> open to suggestions though. >>>> >>> >>> I'm saying that we need to ignore accesses to slab objects if pointer >>> to slab object obtained via page_address() + offset_in_page() trick, but don't ignore >>> anything else. >>> >>> So, save tag somewhere in page struct and poison shadow with that tag. Make page_address() to >>> return tagged address for all !PageSlab() pages. For PageSlab() pages page_address() should return >>> 0xff tagged address, so we could ignore such accesses. >> >> Which pages do you mean by !PageSlab()? > > Literally the "PageSlab(page) == false" pages. > >> The ones that are allocated and freed by pagealloc, but mot managed by the slab allocator? > > Yes. > >> Perhaps we should then add tagging to the pagealloc hook instead? >> > > Of course the tagging would be in kasan_alloc_pages(), where else that could be? And instead of what? I think I misunderstood your suggestion twice already :) To make it clear, you're suggesting: 1. Tag memory with a random tag in kasan_alloc_pages() and returned a tagged pointer from pagealloc. 2. Restore the tag for the pointers returned from page_address for !PageSlab() pages. 3. Set the tag to 0xff for the pointers returned from page_address for PageSlab() pages. Is this correct? In 2 instead of storing the tag in page_struct, we can just recover it from the shadow memory that corresponds to that page. What do you think about this?