From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id 61D1DE7736D for ; Sat, 30 Sep 2023 11:04:16 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id A1B488D0008; Sat, 30 Sep 2023 07:04:15 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id 9A2E98D0006; Sat, 30 Sep 2023 07:04:15 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 86A078D0008; Sat, 30 Sep 2023 07:04:15 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0017.hostedemail.com [216.40.44.17]) by kanga.kvack.org (Postfix) with ESMTP id 73E968D0006 for ; Sat, 30 Sep 2023 07:04:15 -0400 (EDT) Received: from smtpin20.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay10.hostedemail.com (Postfix) with ESMTP id 35783C0141 for ; Sat, 30 Sep 2023 11:04:15 +0000 (UTC) X-FDA: 81292979670.20.1BE7492 Received: from mail-vs1-f54.google.com (mail-vs1-f54.google.com [209.85.217.54]) by imf23.hostedemail.com (Postfix) with ESMTP id 7723514000B for ; Sat, 30 Sep 2023 11:04:13 +0000 (UTC) Authentication-Results: imf23.hostedemail.com; dkim=pass header.d=gmail.com header.s=20230601 header.b=mI7J83tL; dmarc=pass (policy=none) header.from=gmail.com; spf=pass (imf23.hostedemail.com: domain of 42.hyeyoo@gmail.com designates 209.85.217.54 as permitted sender) smtp.mailfrom=42.hyeyoo@gmail.com ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1696071853; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references:dkim-signature; bh=fJo83pwx4y7gaRZ8bey8OSQgDQ8Tv3HF9f55YMBadbY=; b=FwwxggTAtq7pfXKmAmXqATpIsd7gbbLg7LPnPaLUXmWn/EyPHsz5+Si2HVwKbO7r3rzV0E MefXfzahM7sem1tVmbKtm4CerCEia1ufiohsXsfUNwA8qOc4bzowjNhTT1eoX8rmO2PyWh dbMr2yVvYK25/o+EEYh8JVJ3kDVsSAU= ARC-Authentication-Results: i=1; imf23.hostedemail.com; dkim=pass header.d=gmail.com header.s=20230601 header.b=mI7J83tL; dmarc=pass (policy=none) header.from=gmail.com; spf=pass (imf23.hostedemail.com: domain of 42.hyeyoo@gmail.com designates 209.85.217.54 as permitted sender) smtp.mailfrom=42.hyeyoo@gmail.com ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1696071853; a=rsa-sha256; cv=none; b=a8RoeirMyAKDmfh2tpCObHeXFe/RMd+lqdMHfyo68aKErRfkAATOwpuwuiOhTWkFYTbsYk jRBDfHYSoBcdsMpnM/iIblM1ZFdYxsQD9tCUETyS9VgrY0g3BTH/Zwwo1pcLOu3jSDoNB8 HhkmZKStgz/dM0g2MQ1zGBKa7dSjzkI= Received: by mail-vs1-f54.google.com with SMTP id ada2fe7eead31-4525cfe255bso1090566137.1 for ; Sat, 30 Sep 2023 04:04:13 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1696071852; x=1696676652; darn=kvack.org; h=content-transfer-encoding:cc:to:subject:message-id:date:from :in-reply-to:references:mime-version:from:to:cc:subject:date :message-id:reply-to; bh=fJo83pwx4y7gaRZ8bey8OSQgDQ8Tv3HF9f55YMBadbY=; b=mI7J83tLi/F0YYDCL9FyWTwbblpEscPHWdxh2u4pTa6jXgM4I2aXLHzVEvAeW5h7Po Mx1Nl05oyjvkJ7RcpW18Q9oKldS+ScsGkHJDwshoYCpK8FLG77Uh+YMzq+rAhKZxac3d SBBGX2+iCR0bvUTY4ON3yQx+St0g0WOppvgw2xraxIpsdI+/MJp0BcTMj9nZyzAVMDz7 no2d1qGYDnHPbQefT2djKrlOmPnXjUHeU8naHBOJ4TZd/LiQP4CRJQkoWruN7NB+A97v PodKMZWyIo/tgTW3A039RKTsaYk90vp8sdJ9jEI9teLWYfMV2qUdCwhSlEGbWYLZHhY2 Kr6g== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1696071852; x=1696676652; h=content-transfer-encoding:cc:to:subject:message-id:date:from :in-reply-to:references:mime-version:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=fJo83pwx4y7gaRZ8bey8OSQgDQ8Tv3HF9f55YMBadbY=; b=XUzq8/LWgKbl5vagawGqVS2EIMyf8Lk43rEr3TCg8j9KNqmbhIDfAMq7sMaLfKDkKI ijSvCa5vOC1F0MA/t2IU4/lfQn+C4LtEMVxKYjwD/onbzKjz7JkHZ+2K4p2XjQv33J/6 QNt3On3/JDxtfgAGkFLjOtqK3qQXkiWuUJdkSm763qWhOrTK4KVVthlvr4pQ35YjXMxC H83Cufk38SO7rSX8/gzdAcRJ7qjs4WNg+b0eER+kvR6JJtdhASsSMCf32e+19DVHFEW/ g2iuiIOhTsG0ZLoGMZJWdLQ/eIgE0beOxqpIYxO5z1XVuUa2gulQsw9vDGLg56C1Z3Cb 6+WA== X-Gm-Message-State: AOJu0YxOaNy9Ooq0rjgqBKKLfG/nuQ+o/VYO5ZJ1GAIzLOnR4IyMnCyx MUMtIFy22NpqCS88INacAChXr57ofGHnaWzJnQY= X-Google-Smtp-Source: AGHT+IE2qF/n7ShtQDqO7HPLK5FDKy2SymdW2yn4PQByIVeeaU1qQHfQj8OmZG4uK+8n2mr3IzPZWyYWBbSRlWktX0A= X-Received: by 2002:a05:6102:5587:b0:452:6cea:89b7 with SMTP id dc7-20020a056102558700b004526cea89b7mr3719924vsb.14.1696071852334; Sat, 30 Sep 2023 04:04:12 -0700 (PDT) MIME-Version: 1.0 References: <20230915105933.495735-1-matteorizzo@google.com> <20230915105933.495735-2-matteorizzo@google.com> In-Reply-To: <20230915105933.495735-2-matteorizzo@google.com> From: Hyeonggon Yoo <42.hyeyoo@gmail.com> Date: Sat, 30 Sep 2023 20:04:00 +0900 Message-ID: Subject: Re: [RFC PATCH 01/14] mm/slub: don't try to dereference invalid freepointers To: Matteo Rizzo Cc: cl@linux.com, penberg@kernel.org, rientjes@google.com, iamjoonsoo.kim@lge.com, akpm@linux-foundation.org, vbabka@suse.cz, roman.gushchin@linux.dev, keescook@chromium.org, linux-kernel@vger.kernel.org, linux-doc@vger.kernel.org, linux-mm@kvack.org, linux-hardening@vger.kernel.org, tglx@linutronix.de, mingo@redhat.com, bp@alien8.de, dave.hansen@linux.intel.com, x86@kernel.org, hpa@zytor.com, corbet@lwn.net, luto@kernel.org, peterz@infradead.org, jannh@google.com, evn@google.com, poprdi@google.com, jordyzomer@google.com Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable X-Rspamd-Queue-Id: 7723514000B X-Rspam-User: X-Rspamd-Server: rspam04 X-Stat-Signature: 69itrongcq3duxciohci5j8j9zfbn5xj X-HE-Tag: 1696071853-130769 X-HE-Meta: U2FsdGVkX1+0xyeqrk1/mDoAS+7msIrpMmurqqZ1uWhhbnrcL2zBQE3eO7tmtlFM9I0MXv0D4LAeuiSVrduCvOA/Kos6oAwC+uMJsashzmkADKCxhwbTGQB0l1axzwaYYc2KTKBBI/fB2rmJalpEWrTyvvU1gnr68F1Qqcc+3hj1kLaK2xz0o40hbcDGJlOl77ZPEJWV12z39IF/JqTWUXcDL5AsMemQxEXAw7tX6JDWV6A4HvCIdumXtivYefQ29NC1w3xgwEJkjNEZXXEUQXj2Tx4a+7ZluErLf7WX8JGqxhBCaE10IX6G1hdKpCVbNMYb/wpR0d4Ayt/xkrsY0gpX6diFQ8sqckyHStzaDk/lD269hWy5bF9Kp/wYa+Ed/5I1K39jsg8dG+Ah3LmkPfVEnVegUm8vltWIyeLhY2dFuldIRspLNWbU2XcNYkEc4Q3KwQqt0cNagmzj5OvvInx/E2jOuNXTisjkfeFZ1nUPb9eEdnnN1dVfqJ5El8bkwXfMK6U4ANEvIzf8C8JgyeC8hle6oBN25fkWcBvSMlZzdubMB+x6QBzZGRNq/FeaIPEDthBBKr3BvAxWKo7mKFHl72N2rolVu4zGUW0sUWTJuq04YUGrfy9wpW0NN8XdpWuxsV2UCgI7CDuNRkt9BI2DBE0bb3OSRxcYQ6ZzvbW9t+J7GoynhFaaJ/xbqnq2IWEKueFcRwcYThdmaHXe95KfQjhtkm1bsGb4U3u+RE6F+O37CMeFOTiIUKCvZOf+ZRHhdenfmR9Vifq69ughd0D59J7aDzO2h6VhuN+CoSSAdybhcx2+B1zU0NqXF7A1CVqLP5jfsVmFKzTkiJrRlI0/8I3JhdTUBtqdLk9vBTTverbEIRdKBk9o2yyxy4hZGIO4aA3/ylvbLDNvTewaQY4J6x74ubmwfDJg7MX/fDeP2TBs0GP7xSEFsFTEeabgbKlv7L1G1GTyMmq3LzN HlAQd5Ub pxah1q1l+t+En6dX0e1enOSYbH4549t2xSP+wIQnMTBI2XZVWEnGXBrTF0FJwag5Y5nfoZPD5Vrwkznz8mwcXB4GyTFPxB8TuFMCZqBTc5D8gDLgUyoyrd+m4iuUpzhMpykZCE5naOQPHqxtl5+JN0t4BOzvtRIcCqTiuet41hdX4VA5ujdrZzwrUSkcncLyEtBP2geNRUsTyXDZ8YVXgkUECHuGTJH6sIcF87V2mNkWu+L1r62p4MkNxmEom7uDMN9qRo3kFdajQ9ImeVVKPyaI5oPS68RzDMpiDvrp9g/OYUb3vKYB6xZeJTZcWXh+Z1y6cSgt2LYXv7DqehiE79ROX5QY3Eb/h+Fxv2H95zY/afaqxQj1nzenLuEnWSZUFy/0CqEP4DeHqKhoRorq5QZ62QVgTXAAAnReb5A3wnfePysk= X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: On Fri, Sep 15, 2023 at 7:59=E2=80=AFPM Matteo Rizzo wrote: > > slab_free_freelist_hook tries to read a freelist pointer from the > current object even when freeing a single object. This is invalid > because single objects don't actually contain a freelist pointer when > they're freed and the memory contains other data. This causes problems > for checking the integrity of freelist in get_freepointer. > > Signed-off-by: Matteo Rizzo > --- > mm/slub.c | 4 +++- > 1 file changed, 3 insertions(+), 1 deletion(-) > > diff --git a/mm/slub.c b/mm/slub.c > index f7940048138c..a7dae207c2d2 100644 > --- a/mm/slub.c > +++ b/mm/slub.c > @@ -1820,7 +1820,9 @@ static inline bool slab_free_freelist_hook(struct k= mem_cache *s, > > do { > object =3D next; > - next =3D get_freepointer(s, object); > + /* Single objects don't actually contain a freepointer */ > + if (object !=3D old_tail) > + next =3D get_freepointer(s, object); > > /* If object's reuse doesn't have to be delayed */ > if (!slab_free_hook(s, object, slab_want_init_on_free(s))= ) { > -- > 2.42.0.459.ge4e396fd5e-goog > Looks good to me, Reviewed-by: Hyeonggon Yoo <42.hyeyoo@gmail.com>