From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id 6AECAC433F5 for ; Sun, 24 Apr 2022 13:32:22 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id C29FB6B0073; Sun, 24 Apr 2022 09:32:21 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id BB2296B0074; Sun, 24 Apr 2022 09:32:21 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id A2C456B0075; Sun, 24 Apr 2022 09:32:21 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (relay.hostedemail.com [64.99.140.28]) by kanga.kvack.org (Postfix) with ESMTP id 912D16B0073 for ; Sun, 24 Apr 2022 09:32:21 -0400 (EDT) Received: from smtpin09.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay07.hostedemail.com (Postfix) with ESMTP id BB62F213B6 for ; Sun, 24 Apr 2022 13:32:19 +0000 (UTC) X-FDA: 79391861598.09.B70C6B1 Received: from mail-yb1-f169.google.com (mail-yb1-f169.google.com [209.85.219.169]) by imf21.hostedemail.com (Postfix) with ESMTP id E066B1C003C for ; Sun, 24 Apr 2022 13:32:16 +0000 (UTC) Received: by mail-yb1-f169.google.com with SMTP id p65so22625976ybp.9 for ; Sun, 24 Apr 2022 06:32:18 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20210112; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=IRmaRiNmR93d3ALdKPyXM8y47NNkfnslNRnhmG/iMDk=; b=qca+pRIJH72KejbH7dQifTMVoEpBq603vlSllvC8/+XJV/Ih+tkDSp1xTIZKx2bE7P wCKyf1kNMUAqzbJ5iN0WRlbjk0QRWkYJp9ssmHO3QGsK+3ApoKmUX9kT32Ms56iktgng 94KQiSr8dxktplNVKUpJiBdArm/g8UziNqYKaykdC8pjNZQu8koRjvXnsVAhPr19DzDy j0WOTu52VoVwREh+exoFNohOOkMc4YecRCzQywPfzzugMZW4px5vPpWtO1hKa4kKQfLA FbV++sAaqsLLj5haVMl5kJ5xr1BiOOgUUmy/PDByI68776hGr8Wk1eDH6O/itMx2D1Bj f7HA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=IRmaRiNmR93d3ALdKPyXM8y47NNkfnslNRnhmG/iMDk=; b=HK2k65Y+aOi2ovq3jAFao6wkWFMMpKYWZfFHEZNpsVhJ+O0jwpU6EmaF3Ctl3RstHa rmYQirPAxdMHONUH+tDXw66VxX8oFHWD8CZ3rkpIYLx/khCzpiFIaliO51fhPpTzY5m6 jah+jCoc4zpTPHWwUOlGyaoQO2HpLUS7Rio89rzqQTNOp/iEfhnbmm5rKP+B0hGwePhd awOAXxgubCcHGxHVbasMfLGCNt2njKmbnjx1VyK9EuFPv52ySpbZNqVKsi1FcQ+iaO89 Z+Vb5Mb81UEvlBPRVUOJJpIh/FdMKGDSBXJsyVbIzwPN/kaSJ/VCvVTvJZu5rVRFdUiw loCw== X-Gm-Message-State: AOAM533P1WqpcpaOecvRGTNSap559AgtEkD2kt+ksYv329FctzS63csl 4G5QUExgbGPe33YDEDhp/P0rQPy0VqdUZk9g7hx2aNbHRL4iqA== X-Google-Smtp-Source: ABdhPJzWaLOsN1IPUwLXHVCcp7mmvqOiHSQKQ2cBiUtnRf6Qy+787bBKwCWUR5ByN3ohMrg0M+I4sRr+GnYQSWZGN44= X-Received: by 2002:a25:cc0b:0:b0:648:4590:6cb6 with SMTP id l11-20020a25cc0b000000b0064845906cb6mr3692673ybf.87.1650807138108; Sun, 24 Apr 2022 06:32:18 -0700 (PDT) MIME-Version: 1.0 References: <20220424105949.50016-1-huangshaobo6@huawei.com> In-Reply-To: <20220424105949.50016-1-huangshaobo6@huawei.com> From: Marco Elver Date: Sun, 24 Apr 2022 15:31:42 +0200 Message-ID: Subject: Re: [PATCH v2] kfence: enable check kfence canary in panic via boot param To: Shaobo Huang Cc: glider@google.com, dvyukov@google.com, akpm@linux-foundation.org, kasan-dev@googlegroups.com, linux-mm@kvack.org, linux-kernel@vger.kernel.org, young.liuyang@huawei.com, zengweilin@huawei.com, chenzefeng2@huawei.com, nixiaoming@huawei.com, wangbing6@huawei.com, wangfangpeng1@huawei.com, zhongjubin@huawei.com Content-Type: text/plain; charset="UTF-8" X-Rspamd-Server: rspam03 X-Rspamd-Queue-Id: E066B1C003C X-Stat-Signature: qckegxz8sty1i3q6d9f6ymbdzbpwycdu Authentication-Results: imf21.hostedemail.com; dkim=pass header.d=google.com header.s=20210112 header.b=qca+pRIJ; dmarc=pass (policy=reject) header.from=google.com; spf=pass (imf21.hostedemail.com: domain of elver@google.com designates 209.85.219.169 as permitted sender) smtp.mailfrom=elver@google.com X-Rspam-User: X-HE-Tag: 1650807136-120481 X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: On Sun, 24 Apr 2022 at 13:00, Shaobo Huang wrote: > > From: huangshaobo > > when writing out of bounds to the red zone, it can only be > detected at kfree. However, the system may have been reset > before freeing the memory, which would result in undetected > oob. Therefore, it is necessary to detect oob behavior in > panic. Since only the allocated mem call stack is available, > it may be difficult to find the oob maker. Therefore, this > feature is disabled by default and can only be enabled via > boot parameter. This description is still not telling the full story or usecase. The story goes something like: """ Out-of-bounds accesses that aren't caught by a guard page will result in corruption of canary memory. In pathological cases, where an object has certain alignment requirements, an out-of-bounds access might never be caught by the guard page. Such corruptions, however, are only detected on kfree() normally. If the bug causes the kernel to panic before kfree(), KFENCE has no opportunity to report the issue. Such corruptions may also indicate failing memory or other faults. To provide some more information in such cases, add the option to check canary bytes on panic. This might help narrow the search for the panic cause; but, due to only having the allocation stack trace, such reports are difficult to use to diagnose an issue alone. In most cases, such reports are inactionable, and is therefore an opt-in feature (disabled by default). """ Please feel free to copy or take pieces above to complete the commit message. > Suggested-by: chenzefeng > Signed-off-by: huangshaobo > --- > v2: > - it is only detected in panic. > - it is disabled by default. > - can only be enabled via boot parameter. > - the code is moved to the specified partition. > Thanks to Marco for the valuable modification suggestion. > --- > mm/kfence/core.c | 33 +++++++++++++++++++++++++++++++++ > 1 file changed, 33 insertions(+) > > diff --git a/mm/kfence/core.c b/mm/kfence/core.c > index 9b2b5f56f4ae..0b2b934a1666 100644 > --- a/mm/kfence/core.c > +++ b/mm/kfence/core.c > @@ -29,6 +29,8 @@ > #include > #include > #include > +#include > +#include Please keep these includes sorted alphabetically. > #include > > @@ -99,6 +101,10 @@ module_param_named(skip_covered_thresh, kfence_skip_covered_thresh, ulong, 0644) > static bool kfence_deferrable __read_mostly = IS_ENABLED(CONFIG_KFENCE_DEFERRABLE); > module_param_named(deferrable, kfence_deferrable, bool, 0444); > > +/* If true, check kfence canary in panic. */ It should be "on panic". E.g. "If true, check all canary bytes on panic." > +static bool kfence_check_on_panic; > +module_param_named(check_on_panic, kfence_check_on_panic, bool, 0444); > + > /* The pool of pages used for guard pages and objects. */ > char *__kfence_pool __read_mostly; > EXPORT_SYMBOL(__kfence_pool); /* Export for test modules. */ > @@ -727,6 +733,30 @@ static int __init kfence_debugfs_init(void) > > late_initcall(kfence_debugfs_init); > > +/* === Panic Notifier ====================================================== */ Blank line between /* === ... */ and function. > +static void kfence_check_all_canary(void) > +{ > + int i; > + > + for (i = 0; i < CONFIG_KFENCE_NUM_OBJECTS; i++) { > + struct kfence_metadata *meta = &kfence_metadata[i]; > + > + if (meta->state == KFENCE_OBJECT_ALLOCATED) > + for_each_canary(meta, check_canary_byte); > + } > +} > + > +static int kfence_check_canary_callback(struct notifier_block *nb, > + unsigned long reason, void *arg) > +{ > + kfence_check_all_canary(); > + return NOTIFY_OK; > +} > + > +static struct notifier_block kfence_check_canary_notifier = { > + .notifier_call = kfence_check_canary_callback, > +}; > + > /* === Allocation Gate Timer ================================================ */ > > static struct delayed_work kfence_timer; > @@ -804,6 +834,9 @@ static void kfence_init_enable(void) > else > INIT_DELAYED_WORK(&kfence_timer, toggle_allocation_gate); > > + if (kfence_check_on_panic) > + atomic_notifier_chain_register(&panic_notifier_list, &kfence_check_canary_notifier); > + > WRITE_ONCE(kfence_enabled, true); > queue_delayed_work(system_unbound_wq, &kfence_timer, 0); > > -- > 2.12.3 >