From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id B5507C433F5 for ; Tue, 21 Dec 2021 07:00:56 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id E44106B0074; Tue, 21 Dec 2021 02:00:55 -0500 (EST) Received: by kanga.kvack.org (Postfix, from userid 40) id DF4966B0075; Tue, 21 Dec 2021 02:00:55 -0500 (EST) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id CE2A36B0078; Tue, 21 Dec 2021 02:00:55 -0500 (EST) X-Delivered-To: linux-mm@kvack.org Received: from forelay.hostedemail.com (smtprelay0193.hostedemail.com [216.40.44.193]) by kanga.kvack.org (Postfix) with ESMTP id BE2176B0074 for ; Tue, 21 Dec 2021 02:00:55 -0500 (EST) Received: from smtpin18.hostedemail.com (10.5.19.251.rfc1918.com [10.5.19.251]) by forelay03.hostedemail.com (Postfix) with ESMTP id 78F958249980 for ; Tue, 21 Dec 2021 07:00:55 +0000 (UTC) X-FDA: 78940904070.18.C9311A1 Received: from mail-ot1-f50.google.com (mail-ot1-f50.google.com [209.85.210.50]) by imf02.hostedemail.com (Postfix) with ESMTP id BB9C780023 for ; Tue, 21 Dec 2021 07:00:51 +0000 (UTC) Received: by mail-ot1-f50.google.com with SMTP id 35-20020a9d08a6000000b00579cd5e605eso15627728otf.0 for ; Mon, 20 Dec 2021 23:00:54 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20210112; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=+5ef5JzSGQ5fXSk8VRtgDlO2+PhbXiBhrkEtspsXmP8=; b=K1y9AZVS+k8Chh/ds2P0r+AcB6QNzw7kvYr9qSeZIxLJTlIAo6wJGJrbsbSv0oY6TZ bzTuo9ZjsxpghoBXlRcBz+o/A5YLo5Y0FLf6Wked8WGqIJXebssvvwXkvW2INVUB4y9D cQB8+g5IZetmJfK1FZTipomWBSnLjQi7UI8qWNH2tDTgImtUiehGddZ3w70vmbgn1yBJ O/1zH1nPsEfUeBrAIPTbOWO17pNJY0AT7VxkpMmipRFUKxxUl7svo7VI3tGW4aXxaGCU XFpkV2IYqXTS1EhenMT9g+pjHDpCdRmHn0caECGNK+9EJujTN168Un7bzb+l5c4LGoEb 75Kg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=+5ef5JzSGQ5fXSk8VRtgDlO2+PhbXiBhrkEtspsXmP8=; b=YJ0JU1K34qrhdWzMW/U7+Qa66VbNAHZxQNkWGahX7qUjD49YhuZQoJ4UR2MMoop+8r Q+VYsMJcpHPRqF4mTohewiENeA7d/V86xFZP2BNhlSzE0n45CNSMaJ3SMJqjCqdTHHgh zqxupEsD3heUjqGFT172hMGrAjeO09GnFDhdXwd8RR6335/ikeo0b5zLNLbiilDncHxu POtkk1yaW6hYGbzn+DxreU985orMjsffojfNlyRVceY9EoDjLK4N1w9DgZgWKfDXuXfX WzJUwNEAEnTCzHgA3qEIla7PNgaxUWfcJFOsX8AlS70x7BxHoNWkov3hIhpHi1nVGgNU EkWA== X-Gm-Message-State: AOAM531LH6I/2T9xQheD94C4bbSMaxxO0A5W7aIIaoTwlxgzH7JEY6Q5 FEwbV/85fmSA35XEyUxabCrlk059c1AelGKCGNKJDg== X-Google-Smtp-Source: ABdhPJyOUkGGFxtTg3D3jNKcPQsV7mcwjLkhKTtrIneuJrvWU64vMnWKBvMiqgDd2epsSBBofVkzEW05qC0DD2s8SsA= X-Received: by 2002:a9d:77d1:: with SMTP id w17mr1233943otl.329.1640070054151; Mon, 20 Dec 2021 23:00:54 -0800 (PST) MIME-Version: 1.0 References: <2805da5df4b57138fdacd671f5d227d58950ba54.1640037083.git.andreyknvl@google.com> In-Reply-To: <2805da5df4b57138fdacd671f5d227d58950ba54.1640037083.git.andreyknvl@google.com> From: Marco Elver Date: Tue, 21 Dec 2021 08:00:00 +0100 Message-ID: Subject: Re: [PATCH v2] kasan: fix quarantine conflicting with init_on_free To: andrey.konovalov@linux.dev Cc: Alexander Potapenko , Andrew Morton , Andrey Konovalov , Dmitry Vyukov , Andrey Ryabinin , kasan-dev@googlegroups.com, linux-mm@kvack.org, linux-kernel@vger.kernel.org, Andrey Konovalov Content-Type: text/plain; charset="UTF-8" X-Rspamd-Server: rspam08 X-Rspamd-Queue-Id: BB9C780023 X-Stat-Signature: pgicjet4hnyj6zfxsjmguc75j8ui7z98 Authentication-Results: imf02.hostedemail.com; dkim=pass header.d=google.com header.s=20210112 header.b=K1y9AZVS; spf=pass (imf02.hostedemail.com: domain of elver@google.com designates 209.85.210.50 as permitted sender) smtp.mailfrom=elver@google.com; dmarc=pass (policy=reject) header.from=google.com X-HE-Tag: 1640070051-477879 X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: On Mon, 20 Dec 2021 at 22:56, wrote: > > From: Andrey Konovalov > > KASAN's quarantine might save its metadata inside freed objects. As > this happens after the memory is zeroed by the slab allocator when > init_on_free is enabled, the memory coming out of quarantine is not > properly zeroed. > > This causes lib/test_meminit.c tests to fail with Generic KASAN. > > Zero the metadata when the object is removed from quarantine. > > Fixes: 6471384af2a6 ("mm: security: introduce init_on_alloc=1 and init_on_free=1 boot options") > Signed-off-by: Andrey Konovalov Reviewed-by: Marco Elver Thank you. > --- > > Changes v1->v2: > - Use memzero_explicit() instead of memset(). > --- > mm/kasan/quarantine.c | 11 +++++++++++ > 1 file changed, 11 insertions(+) > > diff --git a/mm/kasan/quarantine.c b/mm/kasan/quarantine.c > index 587da8995f2d..08291ed33e93 100644 > --- a/mm/kasan/quarantine.c > +++ b/mm/kasan/quarantine.c > @@ -132,11 +132,22 @@ static void *qlink_to_object(struct qlist_node *qlink, struct kmem_cache *cache) > static void qlink_free(struct qlist_node *qlink, struct kmem_cache *cache) > { > void *object = qlink_to_object(qlink, cache); > + struct kasan_free_meta *meta = kasan_get_free_meta(cache, object); > unsigned long flags; > > if (IS_ENABLED(CONFIG_SLAB)) > local_irq_save(flags); > > + /* > + * If init_on_free is enabled and KASAN's free metadata is stored in > + * the object, zero the metadata. Otherwise, the object's memory will > + * not be properly zeroed, as KASAN saves the metadata after the slab > + * allocator zeroes the object. > + */ > + if (slab_want_init_on_free(cache) && > + cache->kasan_info.free_meta_offset == 0) > + memzero_explicit(meta, sizeof(*meta)); > + > /* > * As the object now gets freed from the quarantine, assume that its > * free track is no longer valid. > -- > 2.25.1 >