From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id 1E517C00140 for ; Tue, 2 Aug 2022 14:39:14 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id 6AD146B0071; Tue, 2 Aug 2022 10:39:14 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id 65CBE6B0072; Tue, 2 Aug 2022 10:39:14 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 4FDDB8E0001; Tue, 2 Aug 2022 10:39:14 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0013.hostedemail.com [216.40.44.13]) by kanga.kvack.org (Postfix) with ESMTP id 3B9F56B0071 for ; Tue, 2 Aug 2022 10:39:14 -0400 (EDT) Received: from smtpin28.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay10.hostedemail.com (Postfix) with ESMTP id 1295CC0E33 for ; Tue, 2 Aug 2022 14:39:14 +0000 (UTC) X-FDA: 79754910228.28.C64932C Received: from mail-lf1-f43.google.com (mail-lf1-f43.google.com [209.85.167.43]) by imf26.hostedemail.com (Postfix) with ESMTP id BCB8F140109 for ; Tue, 2 Aug 2022 14:39:13 +0000 (UTC) Received: by mail-lf1-f43.google.com with SMTP id m22so10437042lfl.9 for ; Tue, 02 Aug 2022 07:39:13 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20210112; h=cc:to:subject:message-id:date:from:in-reply-to:references :mime-version:from:to:cc; bh=QZohr85P+ue0277oQoXbNYepoltTriUZ0lDtYLukdEI=; b=In4Gth7uTqyX8d4c/jU4A1a3LUb7Ejek3CNoVeJDkIPLGIVyFA2feDxeBeqCcKkDzG QmTeQdgEWK4Rg+IiIbsGfuwX9OuyUWP/cVK3vbquhimWiApMpzmkVMXQzjmqjXtSjCvA Ry3qAIwPWQJ3g+LYFVPjbFgUjoPlDCzNKHnUgn6Qk4n6eKEU2AKpAe7223gFiU0f1LoP X1Uy1YFjytlVYG/zp25sywzbOYG9Hc5/tcCUJB7L4ZkPrzKVTz/N0nJ8sZc7Y6wR10Tb V+oKrvLKEmBdduZtEDHdbI372KlaR5EO8xVdo2jxaffZYhoC68r6SX43ZFjSdgkFSHgb otMg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=cc:to:subject:message-id:date:from:in-reply-to:references :mime-version:x-gm-message-state:from:to:cc; bh=QZohr85P+ue0277oQoXbNYepoltTriUZ0lDtYLukdEI=; b=yUN4DZXE1zCLWFtuL+hOWSVl1nK79pboPnzXf8/LHFwp4vd3yP+FuBnYZUQzWALgX9 OcYZxB+h/0Z+m8GtpNWyoXVPq016FpAaE5YpZ2u/h6htS6xGv5Hkrecuf1k/iOXMdS1M /0Gjgp6He2Fw4CSf6GajAAI/qUUf/b2QwahxnMc9w6fbKOy70ZrYKDL1eKm741owiNK0 ROAyF/TDwWUX5k+HGATDqFX2lrIwX2ot6daQpnWDbTBV+G8VhOmE+8vhzK2hgCoqaK6G xA4/6cL2ZXNqWcLXkRPcUzAc4TaIVLr9Vby+2sJoqki0rGoEAPmhdLypcxCjzx9aUQxh ei1w== X-Gm-Message-State: ACgBeo3z2+FFwvEv5if/fgLn+96ukXlCNWmEka+g9+h1FKNX0XlMM1/P ZRayxubRz+snYFLlGTTuHGUtaJ2T4QMBUY9Z/FDB3Q== X-Google-Smtp-Source: AA6agR7GQ0hPXGj/I2EGL6yMSJqOgGm0PgvFkEvxGTPiBXGekS2WzqDBk8olBpXVfvuFq5+b1MoKmw7DxZGbeU64I2I= X-Received: by 2002:a05:6512:1287:b0:48b:7f3:658 with SMTP id u7-20020a056512128700b0048b07f30658mr1547028lfs.417.1659451151874; Tue, 02 Aug 2022 07:39:11 -0700 (PDT) MIME-Version: 1.0 References: <20220727071042.8796-4-feng.tang@intel.com> <0e545088-d140-4c84-bbb2-a3be669740b2@suse.cz> <85ec4ea8-ae4c-3592-5491-3db6d0ad8c59@suse.cz> In-Reply-To: From: Dmitry Vyukov Date: Tue, 2 Aug 2022 16:38:59 +0200 Message-ID: Subject: Re: [mm/slub] 3616799128: BUG_kmalloc-#(Not_tainted):kmalloc_Redzone_overwritten To: Feng Tang Cc: Vlastimil Babka , "Sang, Oliver" , lkp , LKML , "linux-mm@kvack.org" , "lkp@lists.01.org" , Andrew Morton , Christoph Lameter , Pekka Enberg , David Rientjes , Joonsoo Kim , Roman Gushchin , Hyeonggon Yoo <42.hyeyoo@gmail.com>, "Hansen, Dave" , Robin Murphy , John Garry , Kefeng Wang , Andrey Konovalov , Andrey Ryabinin , Alexander Potapenko , "kasan-dev@googlegroups.com" Content-Type: text/plain; charset="UTF-8" ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1659451153; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type:content-transfer-encoding: in-reply-to:in-reply-to:references:references:dkim-signature; bh=QZohr85P+ue0277oQoXbNYepoltTriUZ0lDtYLukdEI=; b=4HVGCK0n+iuGgXp0ojWxErvhfZgzZINquGhx3HkPyEhOsiMoGFKUGRVczWqEeGAcJk/Wpm LU5/fAqnl/wMdrTpiCBo37jSW6xEDlWJ9rUu1vfMHt/0Dbc5pmIotFnJtgZv4MnqDHPDTW uAapjHRRkSrovFj8kBcgE6wiAgU6lHo= ARC-Authentication-Results: i=1; imf26.hostedemail.com; dkim=pass header.d=google.com header.s=20210112 header.b=In4Gth7u; spf=pass (imf26.hostedemail.com: domain of dvyukov@google.com designates 209.85.167.43 as permitted sender) smtp.mailfrom=dvyukov@google.com; dmarc=pass (policy=reject) header.from=google.com ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1659451153; a=rsa-sha256; cv=none; b=m0hWh8qRDsK/s5STd0Gylk4S1tb+cs0BXziOOMSOfKvMCWwGVWenPrzwjAijzyfWIJobNc oGPaFCXs2KaTjvhDxI5PyZIzfbo8rl0EvTSvIHMstkdXdx/+JlVLZPJs821VTeyGcCTmud NdBT8KmfR5H1+33sz92LB1JiMlYxX8o= X-Rspam-User: X-Stat-Signature: rtp1fdk5j1qz1xshw5qrggwod83tr7kt X-Rspamd-Queue-Id: BCB8F140109 Authentication-Results: imf26.hostedemail.com; dkim=pass header.d=google.com header.s=20210112 header.b=In4Gth7u; spf=pass (imf26.hostedemail.com: domain of dvyukov@google.com designates 209.85.167.43 as permitted sender) smtp.mailfrom=dvyukov@google.com; dmarc=pass (policy=reject) header.from=google.com X-Rspamd-Server: rspam08 X-HE-Tag: 1659451153-796234 X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: On Tue, 2 Aug 2022 at 15:37, Feng Tang wrote: > > On Tue, Aug 02, 2022 at 06:30:44PM +0800, Dmitry Vyukov wrote: > > .On Tue, 2 Aug 2022 at 11:43, Vlastimil Babka wrote: > > > > > > On 8/2/22 09:06, Dmitry Vyukov wrote: > > > > On Tue, 2 Aug 2022 at 08:55, Feng Tang wrote: > > > >> > > > >> On Mon, Aug 01, 2022 at 10:23:23PM +0800, Vlastimil Babka wrote: > > > >> > On 8/1/22 08:21, Feng Tang wrote: > > > >> [snip] > > > >> > > Cc kansan mail list. > > > >> > > > > > >> > > This is really related with KASAN debug, that in free path, some > > > >> > > kmalloc redzone ([orig_size+1, object_size]) area is written by > > > >> > > kasan to save free meta info. > > > >> > > > > > >> > > The callstack is: > > > >> > > > > > >> > > kfree > > > >> > > slab_free > > > >> > > slab_free_freelist_hook > > > >> > > slab_free_hook > > > >> > > __kasan_slab_free > > > >> > > ____kasan_slab_free > > > >> > > kasan_set_free_info > > > >> > > kasan_set_track > > > >> > > > > > >> > > And this issue only happens with "kmalloc-16" slab. Kasan has 2 > > > >> > > tracks: alloc_track and free_track, for x86_64 test platform, most > > > >> > > of the slabs will reserve space for alloc_track, and reuse the > > > >> > > 'object' area for free_track. The kasan free_track is 16 bytes > > > >> > > large, that it will occupy the whole 'kmalloc-16's object area, > > > >> > > so when kmalloc-redzone is enabled by this patch, the 'overwritten' > > > >> > > error is triggered. > > > >> > > > > > >> > > But it won't hurt other kmalloc slabs, as kasan's free meta won't > > > >> > > conflict with kmalloc-redzone which stay in the latter part of > > > >> > > kmalloc area. > > > >> > > > > > >> > > So the solution I can think of is: > > > >> > > * skip the kmalloc-redzone for kmalloc-16 only, or > > > >> > > * skip kmalloc-redzone if kasan is enabled, or > > > >> > > * let kasan reserve the free meta (16 bytes) outside of object > > > >> > > just like for alloc meta > > > >> > > > > >> > Maybe we could add some hack that if both kasan and SLAB_STORE_USER is > > > >> > enabled, we bump the stored orig_size from <16 to 16? Similar to what > > > >> > __ksize() does. > > > >> > > > >> How about the following patch: > > > >> > > > >> --- > > > >> diff --git a/mm/slub.c b/mm/slub.c > > > >> index added2653bb0..33bbac2afaef 100644 > > > >> --- a/mm/slub.c > > > >> +++ b/mm/slub.c > > > >> @@ -830,6 +830,16 @@ static inline void set_orig_size(struct kmem_cache *s, > > > >> if (!slub_debug_orig_size(s)) > > > >> return; > > > >> > > > >> +#ifdef CONFIG_KASAN > > > >> + /* > > > >> + * When kasan is enabled, it could save its free meta data in the > > > >> + * start part of object area, so skip the kmalloc redzone check > > > >> + * for small kmalloc slabs to avoid the data conflict. > > > >> + */ > > > >> + if (s->object_size <= 32) > > > >> + orig_size = s->object_size; > > > >> +#endif > > > >> + > > > >> p += get_info_end(s); > > > >> p += sizeof(struct track) * 2; > > > >> > > > >> I extend the size to 32 for potential's kasan meta data size increase. > > > >> This is tested locally, if people are OK with it, I can ask for 0Day's > > > >> help to verify this. > > > > > > Is there maybe some KASAN macro we can use instead of hardcoding 32? > > > > kasan_free_meta is placed in the object data after freeing, so it can > > be sizeof(kasan_free_meta) > > 'kasan_free_meta' is defined in mm/kasan/kasan.h, to use it we need to > include "../kasan/kasan.h" in slub.c, or move its definition to > "include/linux/kasan.h" > > Another idea is to save the info in kasan_info, like: > > --- > diff --git a/include/linux/kasan.h b/include/linux/kasan.h > index b092277bf48d..97e899948d0b 100644 > --- a/include/linux/kasan.h > +++ b/include/linux/kasan.h > @@ -100,6 +100,7 @@ static inline bool kasan_has_integrated_init(void) > struct kasan_cache { > int alloc_meta_offset; > int free_meta_offset; > + int free_meta_size; Storing it here looks fine to me. But I would name it based on the meaning for external users (i.e. that many bytes are occupied by kasan in freed objects). For some caches KASAN does not store anything in freed objects at all. > bool is_kmalloc; > }; > > diff --git a/mm/kasan/common.c b/mm/kasan/common.c > index c40c0e7b3b5f..7bd82c5ec264 100644 > --- a/mm/kasan/common.c > +++ b/mm/kasan/common.c > @@ -178,6 +178,8 @@ void __kasan_cache_create(struct kmem_cache *cache, unsigned int *size, > return; > } > > + cache->kasan_info.free_meta_size = sizeof(struct free_meta_offset); > + > /* > * Add free meta into redzone when it's not possible to store > * it in the object. This is the case when: