From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-23.2 required=3.0 tests=BAYES_00,DKIMWL_WL_MED, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS, INCLUDES_CR_TRAILER,INCLUDES_PATCH,MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS, URIBL_BLOCKED,USER_IN_DEF_DKIM_WL autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 7C79AC433B4 for ; Sat, 3 Apr 2021 10:03:34 +0000 (UTC) Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by mail.kernel.org (Postfix) with ESMTP id E649C61103 for ; Sat, 3 Apr 2021 10:03:33 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org E649C61103 Authentication-Results: mail.kernel.org; dmarc=fail (p=reject dis=none) header.from=google.com Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=owner-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix) id EC8396B0071; Sat, 3 Apr 2021 06:03:32 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id E78106B0075; Sat, 3 Apr 2021 06:03:32 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id D1A0B6B0078; Sat, 3 Apr 2021 06:03:32 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from forelay.hostedemail.com (smtprelay0022.hostedemail.com [216.40.44.22]) by kanga.kvack.org (Postfix) with ESMTP id B11336B0071 for ; Sat, 3 Apr 2021 06:03:32 -0400 (EDT) Received: from smtpin15.hostedemail.com (10.5.19.251.rfc1918.com [10.5.19.251]) by forelay05.hostedemail.com (Postfix) with ESMTP id 620E818007033 for ; Sat, 3 Apr 2021 10:03:32 +0000 (UTC) X-FDA: 77990618664.15.F42A4DC Received: from mail-ot1-f53.google.com (mail-ot1-f53.google.com [209.85.210.53]) by imf12.hostedemail.com (Postfix) with ESMTP id 6AB70D6 for ; Sat, 3 Apr 2021 10:03:30 +0000 (UTC) Received: by mail-ot1-f53.google.com with SMTP id h6-20020a0568300346b02901b71a850ab4so6974097ote.6 for ; Sat, 03 Apr 2021 03:03:31 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=lzznQH22yWtsRp0zpmbNBDOhjWliTmLsMaUUCDRZqWU=; b=WsTuNkJiHYcunUHGy+BKwjRs4cQUzngNneyv1SE4xitILHumSeFd48R4Bz7uuG7kFz DqxlJADmyBJBgt1ShL1HFTGJVotJm5LG/VeDlNbJbuPAolpb3XPPNjhF477Rrcet7S6W Ve8YVhoPyX6JIEuoGQUyQVlhiz4UVrM7FpS8poNuuMexsAKOdQ6jzJFwypHag/eSLTtI A7Mtmt3H+Lu5yWU6HtGNUIqFd40t1GiJG6VhPJUGEEOPo0TQQZpaHGPJUwkvO3wN9U0i 50dmzUNDoH2rIoTRkfZkV0AkY/rVcZvDY4a8iUQPvA14oapHOytndQHkUKqXCLvxhmP9 DSoQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=lzznQH22yWtsRp0zpmbNBDOhjWliTmLsMaUUCDRZqWU=; b=YeqZWKw5auhb4zqHZNaZkB4OHKJ2nUrKlLfNm8FtHQpOYhbbCYvQHrisNC1qdeol6c Zi3hK0Wz8KXBlMvJgFy9qpBSvrSk6jz+mJh6HxJPh1SOYGuxJjkvD2p+gl4reGlA94Jm 2b62rBNCiOlsu1zAdM9ZdjlDpFnTqKo6FJQOG/ccHQltfXmuiy2X2KmwBlaJmWpejCpX LghI4MEdjYueztPbk1otDSztNieFWT6qMPQhwkaP27/n3aNO54K7Dsjsj5GKvwpMKDYK QbAOzYtVbJslSEDVtqvQEKcsCbuKFeQ8c8YvQB/Ynu9d3upV4VoEPH7969oOLuSFm1cm 7WGQ== X-Gm-Message-State: AOAM532lba8RWpB/w7S9j8YmMn4ILYSVZDwBN8e5ybXsj0oY8i2JWJuO qb5/33FRx0g9IGgR5NIClpam6uSYa5IeSn0ZBSqc8g== X-Google-Smtp-Source: ABdhPJy9nRdJ1mOeryQNUqr84sASHWKsEkAqJ7k0iPlWW2IpEfJl7corCGDkV20S9TIdZ5xk8CMxWRvPS9Qhi0IiFiE= X-Received: by 2002:a05:6830:148c:: with SMTP id s12mr15142475otq.251.1617444211171; Sat, 03 Apr 2021 03:03:31 -0700 (PDT) MIME-Version: 1.0 References: <20210403051325.683071-1-pcc@google.com> In-Reply-To: <20210403051325.683071-1-pcc@google.com> From: Marco Elver Date: Sat, 3 Apr 2021 12:03:19 +0200 Message-ID: Subject: Re: [PATCH] kfence: unpoison pool region before use To: Peter Collingbourne Cc: Dmitry Vyukov , Alexander Potapenko , Evgenii Stepanov , Andrey Konovalov , Linux Memory Management List , LKML , Andrew Morton Content-Type: text/plain; charset="UTF-8" X-Stat-Signature: ns3egm5tm5murxopzac3grb88r8h5wt4 X-Rspamd-Server: rspam04 X-Rspamd-Queue-Id: 6AB70D6 Received-SPF: none (google.com>: No applicable sender policy available) receiver=imf12; identity=mailfrom; envelope-from=""; helo=mail-ot1-f53.google.com; client-ip=209.85.210.53 X-HE-DKIM-Result: pass/pass X-HE-Tag: 1617444210-398276 X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: On Sat, 3 Apr 2021 at 07:13, Peter Collingbourne wrote: > If the memory region allocated by KFENCE had previously been poisoned, > any validity checks done using kasan_byte_accessible() will fail. Fix > it by unpoisoning the memory before using it as the pool region. > > Link: https://linux-review.googlesource.com/id/I0af99e9f1c25eaf7e1ec295836b5d148d76940c5 > Signed-off-by: Peter Collingbourne Thanks, at a high level this seems reasonable, because we always want to ensure that KFENCE memory remains unpoisoned with KASAN on. FWIW I subjected a config with KFENCE+KASAN (generic, SW_TAGS, and HW_TAGS) to syzkaller testing and ran kfence_test: Tested-by: Marco Elver However, it is unclear to me under which circumstances we actually need this, i.e. something would grab some memblock memory, somehow poison it, and then release the memory back during early boot (note, kfence_alloc_pool() is called before slab setup). If we can somehow understand what actually did this, perhaps it'd help tell us if this actually needs fixing in KFENCE or it's the other thing that needs a fix. Given all this is happening during really early boot, I'd expect no or very few calls to kasan_poison() until kfence_alloc_pool() is called. We can probably debug it more by having kasan_poison() do a "if (!__kfence_pool) dump_stack();" somewhere. Can you try this on the system where you can repro the problem? I tried this just now on the latest mainline kernel, and saw 0 calls until kfence_alloc_pool(). Thanks, -- Marco > --- > mm/kfence/core.c | 12 +++++++++--- > 1 file changed, 9 insertions(+), 3 deletions(-) > > diff --git a/mm/kfence/core.c b/mm/kfence/core.c > index d53c91f881a4..bb22b0cf77aa 100644 > --- a/mm/kfence/core.c > +++ b/mm/kfence/core.c > @@ -633,13 +633,19 @@ static DECLARE_DELAYED_WORK(kfence_timer, toggle_allocation_gate); > > void __init kfence_alloc_pool(void) > { > + void *pool; > + > if (!kfence_sample_interval) > return; > > - __kfence_pool = memblock_alloc(KFENCE_POOL_SIZE, PAGE_SIZE); > - > - if (!__kfence_pool) > + pool = memblock_alloc(KFENCE_POOL_SIZE, PAGE_SIZE); > + if (!pool) { > pr_err("failed to allocate pool\n"); > + return; > + } > + > + kasan_unpoison_range(pool, KFENCE_POOL_SIZE); > + __kfence_pool = pool; > } > > void __init kfence_init(void) > -- > 2.31.0.208.g409f899ff0-goog >