From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id 50B79C4167B for ; Wed, 6 Dec 2023 14:45:43 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id B189B6B0082; Wed, 6 Dec 2023 09:45:42 -0500 (EST) Received: by kanga.kvack.org (Postfix, from userid 40) id AC8CE6B0083; Wed, 6 Dec 2023 09:45:42 -0500 (EST) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 98FBE6B0085; Wed, 6 Dec 2023 09:45:42 -0500 (EST) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0014.hostedemail.com [216.40.44.14]) by kanga.kvack.org (Postfix) with ESMTP id 89A0E6B0082 for ; Wed, 6 Dec 2023 09:45:42 -0500 (EST) Received: from smtpin16.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay01.hostedemail.com (Postfix) with ESMTP id 5645D1C01DD for ; Wed, 6 Dec 2023 14:45:42 +0000 (UTC) X-FDA: 81536667324.16.AACD327 Received: from mail-ua1-f54.google.com (mail-ua1-f54.google.com [209.85.222.54]) by imf11.hostedemail.com (Postfix) with ESMTP id 836AB40007 for ; Wed, 6 Dec 2023 14:45:39 +0000 (UTC) Authentication-Results: imf11.hostedemail.com; dkim=pass header.d=google.com header.s=20230601 header.b=OvDDsn7u; dmarc=pass (policy=reject) header.from=google.com; spf=pass (imf11.hostedemail.com: domain of elver@google.com designates 209.85.222.54 as permitted sender) smtp.mailfrom=elver@google.com ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1701873939; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type:content-transfer-encoding: in-reply-to:in-reply-to:references:references:dkim-signature; bh=RvuRYbFdpoGcm/YpWzxHjiZOvKmQglmv2U2Hz0xPJx8=; b=ljVsdALOHDqlGcWbJAyDSGsRb4cAbwY6Rcud0i0wYn9QQB+YfMnB+nYW5h6a/iRTUZK4Ui fx/wFunb6sZ5vccJU32KyM7e6FdvHPyO1t5SsW/u6e2knN3rKJYBDm3+thpy1nEdI4Yu29 d477bEtWhzfz6FLh3nAVrBlBSfGHfxg= ARC-Authentication-Results: i=1; imf11.hostedemail.com; dkim=pass header.d=google.com header.s=20230601 header.b=OvDDsn7u; dmarc=pass (policy=reject) header.from=google.com; spf=pass (imf11.hostedemail.com: domain of elver@google.com designates 209.85.222.54 as permitted sender) smtp.mailfrom=elver@google.com ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1701873939; a=rsa-sha256; cv=none; b=sJ0ktfkW1S/+lqt5n/J7dal2NU8hdZdMG2aR+56EOu8BUlnXftwdFPpViy6JoyuXbBg7pI 94+9w23LBdA2MBK1gvBU3PyD0lPUXJWZJJ6Z5F3r1z5VW2gMz7AgtXlmvEGKhPlf0Lzudz FVJLV1E94Ns3XFdXW16ber4ZALHU+C8= Received: by mail-ua1-f54.google.com with SMTP id a1e0cc1a2514c-7c5524f258aso582298241.1 for ; Wed, 06 Dec 2023 06:45:39 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20230601; t=1701873938; x=1702478738; darn=kvack.org; h=cc:to:subject:message-id:date:from:in-reply-to:references :mime-version:from:to:cc:subject:date:message-id:reply-to; bh=RvuRYbFdpoGcm/YpWzxHjiZOvKmQglmv2U2Hz0xPJx8=; b=OvDDsn7uybu8TYJHch+aUyDDKK1BHFQmq847HT+2l60tLZ3nBTi1ExPx4+JxwVQZ/p dcL8mcaw2BN01b88mCn95iBRrYoAP2KqITdxuka9VBXkAym+4LfG96ye2fF1L0RQWOrn Co//bc6T7WIt4mWgq7Syq3/HrOXAjQn1LGwKxi1GwtYldDoTNZtV+dRfj/sxMaMG526r aDbQJncZtwB37c6cu3yYtX85eCqkI9p4TnAAfWt1ufC/zrsbzYBX3hTvoVYQntjrRjtA BbPDyKdcbmTyJOEU4JUR7k+V+KBq0leiinOIwseUnG5gTOZc5mi+6WnbQZJ7g2rnLydt p80Q== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1701873938; x=1702478738; h=cc:to:subject:message-id:date:from:in-reply-to:references :mime-version:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to; bh=RvuRYbFdpoGcm/YpWzxHjiZOvKmQglmv2U2Hz0xPJx8=; b=KlFaHAihTsLleU4E2084xKhXzp1gNY5aPKMfyVcTGM5UNILxMcNh7l0YTPJ3qy5IvZ Yi41tlzLiC1NmAwlWJ+oUW/JWqP7EB2jutleahESjL1OssnyX48b24dVuTAF0cFWbnT6 biCpbWPF2zdi7cVUC+iihx96FKHzhZYYXIcaHLrbJUwnPbBQzDhAOeQKngZltWMCnVsn FPd0czB0YxVzJhBjZF69DNskRCZ0+K9ZqVn/cCAz8RQKmfjju7k/HNYguUKUdO02sCHw HvPQNcSLB9rQadsF2JfLb0q0cS1TXorrXb3TeQ3wHQgF4NYAR0uLjNLpSHeZGcVciWGV 9IGA== X-Gm-Message-State: AOJu0Yx/IsSNBPYJjC8N/DBsvsRZhwtM5uJK08YYlEEIHfeI+czaWz8K gM+4qNrgVUvb4JBWsFwd34bA0Z1BKmtw5TbunKK9OA== X-Google-Smtp-Source: AGHT+IEgL5yvB/HTZPlguEGLqaPQzS0tF7ycaxggqTmtRTi/HtiNen24cxKjMyhwMWV/GacNHVs8A8iBwvtM4AFSvUI= X-Received: by 2002:a05:6102:1901:b0:464:9f88:8310 with SMTP id jk1-20020a056102190100b004649f888310mr511241vsb.10.1701873938446; Wed, 06 Dec 2023 06:45:38 -0800 (PST) MIME-Version: 1.0 References: <20231204-slub-cleanup-hooks-v1-0-88b65f7cd9d5@suse.cz> <20231204-slub-cleanup-hooks-v1-4-88b65f7cd9d5@suse.cz> <44421a37-4343-46d0-9e5c-17c2cd038cf2@linux.dev> <79e29576-12a2-a423-92f3-d8a7bcd2f0ce@suse.cz> In-Reply-To: From: Marco Elver Date: Wed, 6 Dec 2023 15:44:59 +0100 Message-ID: Subject: Re: [PATCH 4/4] mm/slub: free KFENCE objects in slab_free_hook() To: Chengming Zhou , Andrey Konovalov Cc: Vlastimil Babka , Christoph Lameter , Pekka Enberg , David Rientjes , Joonsoo Kim , Andrew Morton , Roman Gushchin , Hyeonggon Yoo <42.hyeyoo@gmail.com>, Alexander Potapenko , Dmitry Vyukov , linux-mm@kvack.org, linux-kernel@vger.kernel.org, kasan-dev@googlegroups.com Content-Type: text/plain; charset="UTF-8" X-Rspamd-Queue-Id: 836AB40007 X-Rspam-User: X-Rspamd-Server: rspam05 X-Stat-Signature: tso8h58ei5tr94pjjs8ps617zsndcq5r X-HE-Tag: 1701873939-496844 X-HE-Meta: U2FsdGVkX18Ec1act/3uSxOuOxGbAjd6JEK8ABGsEFjnCyppTqTT9BC5Jepe/w+yseb08bV2dGVfPan89tU//PzyOn1pmz1RFBDSW3sCsgFPcV8X8wdWFzm5frSN2wPt8Dja0RtOhaImZ0uqdI1uVPqMKBeRGthn+NUhjJkZVGCSx295QXhj8/1svygD/rCZ7Y9hkct6luhH0LcENsDV+hxAxBgyJqcGjOb1aYczd7YxAUPjvt0EFOV4wIt/G8rCvyeCQaD3Jq1qg56UCuK56APgml1twyWKf8aHlUJEXLndI/wF09zIZNZ1FScUXsqq5zNUQDgJ26hckyxinDkM+9Nqv2Ke62kHfXlmfpcJoVT8RNlaxbVQ2DkMELkmTeASpciOZQS7ZohHkb2oPH4zlvgePMOQ5Fam8fo/hCMv5+NKfS8NBo7hALuHtc/M3kaFPRWTfExxtr+179g7hzVG2UvLtF1Z8bbztLJRrFuwUFMKDMGK9ghPWuMUZLf5kO41DyFEvBr4Q5fUBKzKohQMZ8YjmD6eyC55hDX4oY/uZVMwSs0uGvg1Li+/fOSYEi6RY5gjeGhO2B5NEsWQP48MwjNPXCaqkAdbi7zx5ft4PLos633uC9mwiQ8KNbOlq/JH1unEaxoXXQJKXBYQ6lzxcA8DgM1+JIzIX8gyLu5uqYofjsnJrMcr0CxV4ZSVgYoCwoRBynBjlMhLXMs+Xjt0/ea69i2/AeerDBIh7gM2IFjxI2YrdQbSY1IkRgGcrkJo1DhI6MZ8cGRih4oPvalKrGmhwk18W6iydihpKkr0iLPjQoDV2jQO1yFPmtWK6trQZ+9fdoBLN51UMHV1ZMHU6GpBfn9XgqOyKjKJrLzmmJV19xRILK1/8As8CPas4CxIF8Z0WpAgMT2euCsP8MpIYoKAuJY653DavyeuJPICsQmel3jt6HSfmyZcmaNkpva2SS+OC7Ork9r9k5oB3cL NzycTIBI 67oMthnIsjYia8/T9IxvU9CUgMVEU9pbmdiCV47cU9s6rCWs6j2+iyT3K4kn0UZsONXvepu6OnJZYnNZboz/hzbhW2jqPiz2vDduPzheHlsfL0fkbdMBlQ+PAT1iaVrgoT2atn4H/D0jMMpy4/12ohMZ0yU6hO14VFssYGGy50Xl7InxeIJOIAFYNoUK107PzKefLVuwfctu1XS2J+jzTDh1RbABt3iXJFIK0riaM1qF4yuu6o/0KmdmB9E/dL6xhy1ib8EWtZdtgxIb7TWE5ANijlHy0DWOyLSLiLy44FjjH3+8GoW+PkXYq9L1CJTR2rosiYiTwhVcXQYXhaHD6qRVLgQmBP9y4HkZ7IUs+2j3V8j0qq6RNZkAkTnb2CsBOvHrL2ySXL3hxntToTZGq227DjnDfs5k6i7LaceXFOYiFtWE= X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: List-Subscribe: List-Unsubscribe: On Wed, 6 Dec 2023 at 14:02, Chengming Zhou wrote: > > On 2023/12/6 17:58, Vlastimil Babka wrote: > > On 12/5/23 14:27, Chengming Zhou wrote: > >> On 2023/12/5 03:34, Vlastimil Babka wrote: > >>> When freeing an object that was allocated from KFENCE, we do that in the > >>> slowpath __slab_free(), relying on the fact that KFENCE "slab" cannot be > >>> the cpu slab, so the fastpath has to fallback to the slowpath. > >>> > >>> This optimization doesn't help much though, because is_kfence_address() > >>> is checked earlier anyway during the free hook processing or detached > >>> freelist building. Thus we can simplify the code by making the > >>> slab_free_hook() free the KFENCE object immediately, similarly to KASAN > >>> quarantine. > >>> > >>> In slab_free_hook() we can place kfence_free() above init processing, as > >>> callers have been making sure to set init to false for KFENCE objects. > >>> This simplifies slab_free(). This places it also above kasan_slab_free() > >>> which is ok as that skips KFENCE objects anyway. > >>> > >>> While at it also determine the init value in slab_free_freelist_hook() > >>> outside of the loop. > >>> > >>> This change will also make introducing per cpu array caches easier. > >>> > >>> Tested-by: Marco Elver > >>> Signed-off-by: Vlastimil Babka > >>> --- > >>> mm/slub.c | 22 ++++++++++------------ > >>> 1 file changed, 10 insertions(+), 12 deletions(-) > >>> > >>> diff --git a/mm/slub.c b/mm/slub.c > >>> index ed2fa92e914c..e38c2b712f6c 100644 > >>> --- a/mm/slub.c > >>> +++ b/mm/slub.c > >>> @@ -2039,7 +2039,7 @@ static inline void memcg_slab_free_hook(struct kmem_cache *s, struct slab *slab, > >>> * production configuration these hooks all should produce no code at all. > >>> * > >>> * Returns true if freeing of the object can proceed, false if its reuse > >>> - * was delayed by KASAN quarantine. > >>> + * was delayed by KASAN quarantine, or it was returned to KFENCE. > >>> */ > >>> static __always_inline > >>> bool slab_free_hook(struct kmem_cache *s, void *x, bool init) > >>> @@ -2057,6 +2057,9 @@ bool slab_free_hook(struct kmem_cache *s, void *x, bool init) > >>> __kcsan_check_access(x, s->object_size, > >>> KCSAN_ACCESS_WRITE | KCSAN_ACCESS_ASSERT); > >>> > >>> + if (kfence_free(kasan_reset_tag(x))) > >> > >> I'm wondering if "kasan_reset_tag()" is needed here? > > > > I think so, because AFAICS the is_kfence_address() check in kfence_free() > > could be a false negative otherwise. In fact now I even question some of the > > Ok. > > > other is_kfence_address() checks in mm/slub.c, mainly > > build_detached_freelist() which starts from pointers coming directly from > > slab users. Insight from KASAN/KFENCE folks appreciated :) > > > I know very little about KASAN/KFENCE, looking forward to their insight. :) > > Just saw a check in __kasan_slab_alloc(): > > if (is_kfence_address(object)) > return (void *)object; > > So thought it seems that a kfence object would be skipped by KASAN. The is_kfence_address() implementation tolerates tagged addresses, i.e. if it receives a tagged non-kfence address, it will never return true. The KASAN_HW_TAGS patches and KFENCE patches were in development concurrently, and at the time there was some conflict resolution that happened when both were merged. The is_kfence_address(kasan_reset_tag(..)) initially came from [1] but was squashed into 2b8305260fb. [1] https://lore.kernel.org/all/9dc196006921b191d25d10f6e611316db7da2efc.1611946152.git.andreyknvl@google.com/ Andrey, do you recall what issue you encountered that needed kasan_reset_tag()?