From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-14.4 required=3.0 tests=DKIMWL_WL_MED,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_PATCH, MAILING_LIST_MULTI,SIGNED_OFF_BY,SPF_HELO_NONE,SPF_PASS,USER_IN_DEF_DKIM_WL autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 6A51BC38A2A for ; Wed, 6 May 2020 09:50:39 +0000 (UTC) Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by mail.kernel.org (Postfix) with ESMTP id 19A242070B for ; Wed, 6 May 2020 09:50:38 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b="WpjHBPWX" DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org 19A242070B Authentication-Results: mail.kernel.org; dmarc=fail (p=reject dis=none) header.from=google.com Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=owner-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix) id 9CC3A8E0005; Wed, 6 May 2020 05:50:38 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id 97D8F8E0003; Wed, 6 May 2020 05:50:38 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 892328E0005; Wed, 6 May 2020 05:50:38 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from forelay.hostedemail.com (smtprelay0199.hostedemail.com [216.40.44.199]) by kanga.kvack.org (Postfix) with ESMTP id 733D48E0003 for ; Wed, 6 May 2020 05:50:38 -0400 (EDT) Received: from smtpin25.hostedemail.com (10.5.19.251.rfc1918.com [10.5.19.251]) by forelay05.hostedemail.com (Postfix) with ESMTP id 2A02A181AEF0B for ; Wed, 6 May 2020 09:50:38 +0000 (UTC) X-FDA: 76785824556.25.worm29_5cd1055e7cc30 X-HE-Tag: worm29_5cd1055e7cc30 X-Filterd-Recvd-Size: 7930 Received: from mail-qv1-f65.google.com (mail-qv1-f65.google.com [209.85.219.65]) by imf17.hostedemail.com (Postfix) with ESMTP for ; Wed, 6 May 2020 09:50:37 +0000 (UTC) Received: by mail-qv1-f65.google.com with SMTP id v10so386618qvr.2 for ; Wed, 06 May 2020 02:50:37 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=j5iMU2d4N/4y18awBTt8gjljQLvXQSdia/Cv9QIxeQc=; b=WpjHBPWXGTysRpxifjir4tXVCuKqA1X+l/deTz186nKbtDUTwu3h5569FI40ufr7Y0 jelE3jp7G8bz9axcn6AXPJXy6yfrpiDVcXv0zhsWqOhRjsO3WgmfH7ZCZnmkigqa4CSc q5bLcMsoWaA+5a+SMWP7taOFMyIwdHJvpRFbVP4FxIiipCJgab6ceIi695Dt4wA+u3yL GbRaFkMKtyllv59YmxI8lsW8o+eq1DZmYfTlIEYNwMT1+thAJ7nAoGws0qpEBQnuZFMb iJi5Q5bF59al+NHZaNPO/j/U3J1D8HIFH/czkNrVkDGUd8O1qc/wX+u/6bj+EjX1BhxR oB5w== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=j5iMU2d4N/4y18awBTt8gjljQLvXQSdia/Cv9QIxeQc=; b=oY5A8rdv8f5nia7/mhh6uCNbot0Hsh3Z4wuCfkU0V2c56D1fPJPtrN5GGiY/ge+trX qR9141hPdcaH8zdjlcXAwOT8x3IXO1VnY+jwdAaQ2FjRpDolNaGclcyiigkZeYegd+eA 6NAPPYjqb0q17ULNoOpXuO8iM6v1aCRoycEz1KLFhwdcjvbE7obIHuUGD3VsOUfl3s9n mTejqlX9kjHKqQUXruY7lXv0QqZdbSfR2pxfEptKLhcSaCV9Tqw6PM5q4MZE2qyMhoCw LmM17H486OyCDSWzge4eUTHauU+Saa8J36VgF2jz9UiGh5SZdFS3Z1ASRE2YTQayjTk1 470w== X-Gm-Message-State: AGi0PuZpikL1jKknP1R50KYQsUtg7rhLMLtOMYWoV8IZKB7c6U4hD2MT HRdtzlFK5PKk3kxqQH62rleyQHToeqvNFHWeDuXkLQ== X-Google-Smtp-Source: APiQypJznpPYxdfEFeeA/QM+9LIu8pWPgSCbjVVq0Lf5+We9+p6YyIWg00C4LnkrqUZfh4/TEvzyLyHWExLaxty7q4s= X-Received: by 2002:ad4:5a48:: with SMTP id ej8mr7241682qvb.122.1588758636814; Wed, 06 May 2020 02:50:36 -0700 (PDT) MIME-Version: 1.0 References: <20200506052155.14515-1-walter-zh.wu@mediatek.com> In-Reply-To: <20200506052155.14515-1-walter-zh.wu@mediatek.com> From: Dmitry Vyukov Date: Wed, 6 May 2020 11:50:25 +0200 Message-ID: Subject: Re: [PATCH 2/3] kasan: record and print the free track To: Walter Wu Cc: Andrey Ryabinin , Alexander Potapenko , Matthias Brugger , kasan-dev , Linux-MM , LKML , Linux ARM , wsd_upstream , linux-mediatek@lists.infradead.org Content-Type: text/plain; charset="UTF-8" X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: On Wed, May 6, 2020 at 7:22 AM Walter Wu wrote: > > We add new KASAN_RCU_STACK_RECORD configuration option. It will move > free track from slub meta-data (struct kasan_alloc_meta) into freed object. > Because we hope this options doesn't enlarge slub meta-data size. > > This option doesn't enlarge struct kasan_alloc_meta size. > - add two call_rcu() call stack into kasan_alloc_meta, size is 8 bytes. > - remove free track from kasan_alloc_meta, size is 8 bytes. > > This option is only suitable for generic KASAN, because we move free track > into the freed object, so free track is valid information only when it > exists in quarantine. If the object is in-use state, then the KASAN report > doesn't print call_rcu() free track information. > > [1]https://bugzilla.kernel.org/show_bug.cgi?id=198437 > > Signed-off-by: Walter Wu > Cc: Andrey Ryabinin > Cc: Dmitry Vyukov > Cc: Alexander Potapenko > --- > mm/kasan/common.c | 10 +++++++++- > mm/kasan/report.c | 24 +++++++++++++++++++++--- > 2 files changed, 30 insertions(+), 4 deletions(-) > > diff --git a/mm/kasan/common.c b/mm/kasan/common.c > index 32d422bdf127..13ec03e225a7 100644 > --- a/mm/kasan/common.c > +++ b/mm/kasan/common.c > @@ -321,8 +321,15 @@ void kasan_record_callrcu(void *addr) > /* record last call_rcu() call stack */ > alloc_info->rcu_free_stack[1] = save_stack(GFP_NOWAIT); > } > -#endif > > +static void kasan_set_free_info(struct kmem_cache *cache, > + void *object, u8 tag) > +{ > + /* store free track into freed object */ > + set_track((struct kasan_track *)(object + BYTES_PER_WORD), GFP_NOWAIT); > +} > + > +#else > static void kasan_set_free_info(struct kmem_cache *cache, > void *object, u8 tag) > { > @@ -339,6 +346,7 @@ static void kasan_set_free_info(struct kmem_cache *cache, > > set_track(&alloc_meta->free_track[idx], GFP_NOWAIT); > } > +#endif > > void kasan_poison_slab(struct page *page) > { > diff --git a/mm/kasan/report.c b/mm/kasan/report.c > index 7aaccc70b65b..f2b0c6b9dffa 100644 > --- a/mm/kasan/report.c > +++ b/mm/kasan/report.c > @@ -175,8 +175,23 @@ static void kasan_print_rcu_free_stack(struct kasan_alloc_meta *alloc_info) > print_track(&free_track, "Last call_rcu() call stack", true); > pr_err("\n"); > } > -#endif > > +static struct kasan_track *kasan_get_free_track(struct kmem_cache *cache, > + void *object, u8 tag, const void *addr) > +{ > + u8 *shadow_addr = (u8 *)kasan_mem_to_shadow(addr); > + > + /* > + * Only the freed object can get free track, > + * because free track information is stored to freed object. > + */ > + if (*shadow_addr == KASAN_KMALLOC_FREE) > + return (struct kasan_track *)(object + BYTES_PER_WORD); Humm... the other patch defines BYTES_PER_WORD as 4... I would assume seeing 8 (or sizeof(long)) here. Why 4? Have you tested all 4 modes (RCU/no-RCU x SLAB/SLUB)? As far as I remember one of the allocators stored something in the object. Also, does this work with objects with ctors and slabs destroyed by rcu? kasan_track may smash other things in these cases. Have you looked at the KASAN implementation when free_track was removed? That may have useful details :) > + else > + return NULL; > +} > + > +#else > static struct kasan_track *kasan_get_free_track(struct kmem_cache *cache, > void *object, u8 tag, const void *addr) > { > @@ -196,6 +211,7 @@ static struct kasan_track *kasan_get_free_track(struct kmem_cache *cache, > > return &alloc_meta->free_track[i]; > } > +#endif > > static void describe_object(struct kmem_cache *cache, void *object, > const void *addr, u8 tag) > @@ -208,8 +224,10 @@ static void describe_object(struct kmem_cache *cache, void *object, > print_track(&alloc_info->alloc_track, "Allocated", false); > pr_err("\n"); > free_track = kasan_get_free_track(cache, object, tag, addr); > - print_track(free_track, "Freed", false); > - pr_err("\n"); > + if (free_track) { > + print_track(free_track, "Freed", false); > + pr_err("\n"); > + } > #ifdef CONFIG_KASAN_RCU_STACK_RECORD > kasan_print_rcu_free_stack(alloc_info); > #endif > -- > 2.18.0 > > -- > You received this message because you are subscribed to the Google Groups "kasan-dev" group. > To unsubscribe from this group and stop receiving emails from it, send an email to kasan-dev+unsubscribe@googlegroups.com. > To view this discussion on the web visit https://groups.google.com/d/msgid/kasan-dev/20200506052155.14515-1-walter-zh.wu%40mediatek.com.