From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-11.3 required=3.0 tests=BAYES_00,DKIMWL_WL_MED, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_IN_DEF_DKIM_WL autolearn=no autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 80CB8C43466 for ; Fri, 18 Sep 2020 11:59:30 +0000 (UTC) Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by mail.kernel.org (Postfix) with ESMTP id F34DB2311B for ; Fri, 18 Sep 2020 11:59:29 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b="DFPRb7Y9" DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org F34DB2311B Authentication-Results: mail.kernel.org; dmarc=fail (p=reject dis=none) header.from=google.com Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=owner-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix) id 34F576B0003; Fri, 18 Sep 2020 07:59:29 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id 2FDBD6B0055; Fri, 18 Sep 2020 07:59:29 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 1EED18E0001; Fri, 18 Sep 2020 07:59:29 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from forelay.hostedemail.com (smtprelay0073.hostedemail.com [216.40.44.73]) by kanga.kvack.org (Postfix) with ESMTP id 0918C6B0003 for ; Fri, 18 Sep 2020 07:59:29 -0400 (EDT) Received: from smtpin14.hostedemail.com (10.5.19.251.rfc1918.com [10.5.19.251]) by forelay02.hostedemail.com (Postfix) with ESMTP id BEB4C363E for ; Fri, 18 Sep 2020 11:59:28 +0000 (UTC) X-FDA: 77276037216.14.eyes37_49017912712b Received: from filter.hostedemail.com (10.5.16.251.rfc1918.com [10.5.16.251]) by smtpin14.hostedemail.com (Postfix) with ESMTP id A072F18229818 for ; Fri, 18 Sep 2020 11:59:28 +0000 (UTC) X-HE-Tag: eyes37_49017912712b X-Filterd-Recvd-Size: 8539 Received: from mail-oi1-f194.google.com (mail-oi1-f194.google.com [209.85.167.194]) by imf02.hostedemail.com (Postfix) with ESMTP for ; Fri, 18 Sep 2020 11:59:27 +0000 (UTC) Received: by mail-oi1-f194.google.com with SMTP id x69so6666146oia.8 for ; Fri, 18 Sep 2020 04:59:27 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=p0D5X7Y+m7ttT/u5XV6+XFjpJPYZ+5nXOo1ENk9Sr6U=; b=DFPRb7Y9Hq4pascynXFSCCYpr/a4bl7ggPfVH9GJKFUO/ayct1amaR3wsxiMtCJvQ/ uU9aqLvE4+HXrlO+1KmjR1ZdHm6nGOfYqOI56XcYbAoZM0igN3mx+nI9ZJpSYU8yrxJZ u+AZWJMVJIFe/bRMVGVi0Hi19qqYnmeQhZrR086TXXE4MzJZ6mBTzqOZdkbZePSwHv+b NlzY544p6SNnIG7ZfXxC5dhxyENzUj8syiofKsaVyI8Ug7qrh9/+qUTSkKFX7uk83X41 cbPJFBW/Aoc0uFVMTF8ywh5ITaTxh+WCeIudQ5uchSvzeztt8D1HgMc80XgPqZ1p6LoH P58Q== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=p0D5X7Y+m7ttT/u5XV6+XFjpJPYZ+5nXOo1ENk9Sr6U=; b=fU9XzphVw9mQIWPv+WMNWnTO5fRMNXJAUi56tXHc6PbA/cIRw2ecQpyYHCbX/sLniC Lc3QxxNRe/1rzbdfTxN/VEY3LdjogrWLnAzGKCrnV4KmrZaaIxYeDhXQT1WGxNuBtfto IA6FR4AhJbQENb68ILAtVTrQwZiaZfNxUVjbXiGMkwITpGpB923w5WarsHF8JqZBiKGX EvzryGH7W6TAtIBi1kHiz9grH67E8u/o7fIbMSlwyMXlEVnh4EISANb85ArsEITu732H AFj7wvaJhh7tCwRmwMNGG4JvyblCi5qdZTUCCDUzyCgCkXSYB1Bh/j2GcwyrmGPHZJKI i7iw== X-Gm-Message-State: AOAM533XUyKS6/wQgs+LI22+RDGRf2BnJKpTMUpEw0RJmlkblHDqzBLn 9uln6VpPkRdvRxT+SNeeMI5vqh6poUnTwwxAVRALig== X-Google-Smtp-Source: ABdhPJx1YWIbj0a3kj+XHGq4l0nWGyQu8DX2tequbx+9ACWXzIIk8edPn+mRXVtmJXtgCrXRQzALviAeMqM1jJ7KNJc= X-Received: by 2002:aca:5158:: with SMTP id f85mr9503239oib.121.1600430367017; Fri, 18 Sep 2020 04:59:27 -0700 (PDT) MIME-Version: 1.0 References: <20200915132046.3332537-1-elver@google.com> <115e74b249417340b5c411f286768dbdb916fd12.camel@redhat.com> In-Reply-To: <115e74b249417340b5c411f286768dbdb916fd12.camel@redhat.com> From: Marco Elver Date: Fri, 18 Sep 2020 13:59:15 +0200 Message-ID: Subject: Re: [PATCH v2 00/10] KFENCE: A low-overhead sampling-based memory safety error detector To: Qian Cai Cc: Andrew Morton , Alexander Potapenko , "H. Peter Anvin" , "Paul E. McKenney" , Andrey Konovalov , Andrey Ryabinin , Andy Lutomirski , Borislav Petkov , Catalin Marinas , Christoph Lameter , Dave Hansen , David Rientjes , Dmitry Vyukov , Eric Dumazet , Greg Kroah-Hartman , Ingo Molnar , Jann Horn , Jonathan Cameron , Jonathan Corbet , Joonsoo Kim , Kees Cook , Mark Rutland , Pekka Enberg , Peter Zijlstra , Thomas Gleixner , Vlastimil Babka , Will Deacon , "the arch/x86 maintainers" , "open list:DOCUMENTATION" , LKML , kasan-dev , Linux ARM , Linux Memory Management List Content-Type: text/plain; charset="UTF-8" X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: On Fri, 18 Sep 2020 at 13:17, Qian Cai wrote: > > On Tue, 2020-09-15 at 15:20 +0200, Marco Elver wrote: > > This adds the Kernel Electric-Fence (KFENCE) infrastructure. KFENCE is a > > low-overhead sampling-based memory safety error detector of heap > > use-after-free, invalid-free, and out-of-bounds access errors. This > > series enables KFENCE for the x86 and arm64 architectures, and adds > > KFENCE hooks to the SLAB and SLUB allocators. > > > > KFENCE is designed to be enabled in production kernels, and has near > > zero performance overhead. Compared to KASAN, KFENCE trades performance > > for precision. The main motivation behind KFENCE's design, is that with > > enough total uptime KFENCE will detect bugs in code paths not typically > > exercised by non-production test workloads. One way to quickly achieve a > > large enough total uptime is when the tool is deployed across a large > > fleet of machines. > > > > KFENCE objects each reside on a dedicated page, at either the left or > > right page boundaries. The pages to the left and right of the object > > page are "guard pages", whose attributes are changed to a protected > > state, and cause page faults on any attempted access to them. Such page > > faults are then intercepted by KFENCE, which handles the fault > > gracefully by reporting a memory access error. > > > > Guarded allocations are set up based on a sample interval (can be set > > via kfence.sample_interval). After expiration of the sample interval, > > the next allocation through the main allocator (SLAB or SLUB) returns a > > guarded allocation from the KFENCE object pool. At this point, the timer > > is reset, and the next allocation is set up after the expiration of the > > interval. > > > > To enable/disable a KFENCE allocation through the main allocator's > > fast-path without overhead, KFENCE relies on static branches via the > > static keys infrastructure. The static branch is toggled to redirect the > > allocation to KFENCE. > > > > The KFENCE memory pool is of fixed size, and if the pool is exhausted no > > further KFENCE allocations occur. The default config is conservative > > with only 255 objects, resulting in a pool size of 2 MiB (with 4 KiB > > pages). > > > > We have verified by running synthetic benchmarks (sysbench I/O, > > hackbench) that a kernel with KFENCE is performance-neutral compared to > > a non-KFENCE baseline kernel. > > > > KFENCE is inspired by GWP-ASan [1], a userspace tool with similar > > properties. The name "KFENCE" is a homage to the Electric Fence Malloc > > Debugger [2]. > > > > For more details, see Documentation/dev-tools/kfence.rst added in the > > series -- also viewable here: > > Does anybody else grow tried of all those different *imperfect* versions of in- > kernel memory safety error detectors? KASAN-generic, KFENCE, KASAN-tag-based > etc. Then, we have old things like page_poison, SLUB debugging, debug_pagealloc > etc which are pretty much inefficient to detect bugs those days compared to > KASAN. Can't we work towards having a single implementation and clean up all > those mess? If you have suggestions on how to get a zero-overhead, precise ("perfect") memory safety error detector without new hardware extensions, we're open to suggestions -- many people over many years have researched this problems, and while we're making progress for C (and C++), the fact remains that what you're asking is likely impossible. This might be useful background: https://arxiv.org/pdf/1802.09517.pdf The fact remains that requirements and environments vary across applications and usecases. Maybe for one usecase (debugging, test env) normal KASAN is just fine. But that doesn't work for production, where we want to have max performance. MTE will get us closer (no silicon yet, and ARM64 only for now), but depending on implementation might come with small overheads, although quite acceptable for most environments with increasing processing power modern CPUs deliver. Yet for other environments, where even a small performance regression is unacceptable, and where it's infeasible to capture in tests what the workloads execute, KFENCE is a very attractive option. There have also been discussions on using Rust in the kernel [1], but this is just not feasible for core kernel code in the near future (even then, you'll still need dynamic error detection tools for all the unsafe bits, of which there are many in an OS kernel). [1] https://lwn.net/Articles/829858/ Thanks, -- Marco