From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id 4D07EC433EF for ; Mon, 27 Dec 2021 02:43:28 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id 7F2F76B0071; Sun, 26 Dec 2021 21:43:27 -0500 (EST) Received: by kanga.kvack.org (Postfix, from userid 40) id 7A38D6B0072; Sun, 26 Dec 2021 21:43:27 -0500 (EST) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 643D36B0073; Sun, 26 Dec 2021 21:43:27 -0500 (EST) X-Delivered-To: linux-mm@kvack.org Received: from forelay.hostedemail.com (smtprelay0086.hostedemail.com [216.40.44.86]) by kanga.kvack.org (Postfix) with ESMTP id 549976B0071 for ; Sun, 26 Dec 2021 21:43:27 -0500 (EST) Received: from smtpin16.hostedemail.com (10.5.19.251.rfc1918.com [10.5.19.251]) by forelay04.hostedemail.com (Postfix) with ESMTP id 0101688CDC for ; Mon, 27 Dec 2021 02:43:26 +0000 (UTC) X-FDA: 78962028054.16.9178926 Received: from mail-pl1-f170.google.com (mail-pl1-f170.google.com [209.85.214.170]) by imf30.hostedemail.com (Postfix) with ESMTP id 9128F8001D for ; Mon, 27 Dec 2021 02:43:26 +0000 (UTC) Received: by mail-pl1-f170.google.com with SMTP id u16so10486238plg.9 for ; Sun, 26 Dec 2021 18:43:26 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20210112; h=date:from:to:cc:subject:message-id:references:mime-version :content-disposition:in-reply-to; bh=sbWmY9NIBHJbspqdt0/iFybWiUNO01ZpzPEk+bSzcIc=; b=b6Cjg8EDgami9tihXmahcFs5gZMUl0ofSM1Wj+YZ2Q6XRHsDdBRl90zeF1jbOOSz3+ 9SoQiZ4EdbCG+Jmg4MzA5/6shK8RZg8xrV2gqJVuZDyAYqtXwqlmry/aJAkQ4oiG8ngV 7rpAaYsMSPY9gaW/AMeOV2RIDPlYhOIi7V3RAasnd56UnpIcH6qs4tNiIeLbz9RuGyMQ 3rfi/aFyW60zG42gzOC8ll2ZU35Xujv3pg6CUtvkdcaI6VRRKTlNpdBWUeCpGeADhAXG JPgrgb5sX7zdu4h1uMAdv/6rtljcukOvJ4HPQR8PbQw3YwGslBNSSpCAuWszimU1l/o9 DGlw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:date:from:to:cc:subject:message-id:references :mime-version:content-disposition:in-reply-to; bh=sbWmY9NIBHJbspqdt0/iFybWiUNO01ZpzPEk+bSzcIc=; b=IF6a85uEpk+uvLt3Ae/frFk5X0LzrWzvzTlLPwZIMI8fMBaG0O4GN27cD6QGdF3Mo5 CEdYYtfLLa9+fU99wBV8FwtvfMkVOfL5n92juvE3BHH6gVO8+jdRkczOtwLZe5x8y7ja ECpmzB7JyhFy+qcPlm71LSQ+ODBNpgp1IRbGEkx5xJ4MlMxPcgOcMJpKLbYr7Ma9nChd +kzgFI2D3eSEm59Idn0j9ND7V+VGeDSHRNP748Vlpxh59PfTZPjRMY2JY48bcT/n5rJ4 iIG07gI0rdTECkSdwXz1Hg9b0aw3UFBJyEMbJEZOc7vDvCoDi540XkcYE11QIgqrGRQq JKlw== X-Gm-Message-State: AOAM531o95RpadYVg5wCGrw1Z4+enk9yW0OJ7lo9jXkYoGJFEavynlNi vvrRIF3jxfUEl5Qi5NIko2o= X-Google-Smtp-Source: ABdhPJzoUfrOYauzN001IpqeGAYX2bJEv5XyUjW2AwBsjkOMYSZ/zWgoYr+5IYLFDS8h7503Fgg4YQ== X-Received: by 2002:a17:90b:33c6:: with SMTP id lk6mr18709354pjb.70.1640573005467; Sun, 26 Dec 2021 18:43:25 -0800 (PST) Received: from ip-172-31-30-232.ap-northeast-1.compute.internal (ec2-18-181-137-102.ap-northeast-1.compute.amazonaws.com. [18.181.137.102]) by smtp.gmail.com with ESMTPSA id s35sm9767113pfw.193.2021.12.26.18.43.18 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sun, 26 Dec 2021 18:43:25 -0800 (PST) Date: Mon, 27 Dec 2021 02:43:15 +0000 From: Hyeonggon Yoo <42.hyeyoo@gmail.com> To: Matthew Wilcox Cc: Vlastimil Babka , Christoph Lameter , David Rientjes , Joonsoo Kim , Pekka Enberg , linux-mm@kvack.org, Andrew Morton , patches@lists.linux.dev, Alexander Potapenko , Andrey Konovalov , Andrey Ryabinin , Andy Lutomirski , Borislav Petkov , cgroups@vger.kernel.org, Dave Hansen , David Woodhouse , Dmitry Vyukov , "H. Peter Anvin" , Ingo Molnar , iommu@lists.linux-foundation.org, Joerg Roedel , Johannes Weiner , Julia Lawall , kasan-dev@googlegroups.com, Lu Baolu , Luis Chamberlain , Marco Elver , Michal Hocko , Minchan Kim , Nitin Gupta , Peter Zijlstra , Sergey Senozhatsky , Suravee Suthikulpanit , Thomas Gleixner , Vladimir Davydov , Will Deacon , x86@kernel.org, Roman Gushchin Subject: Re: [PATCH v2 00/33] Separate struct slab from struct page Message-ID: References: <20211201181510.18784-1-vbabka@suse.cz> <4c3dfdfa-2e19-a9a7-7945-3d75bc87ca05@suse.cz> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: X-Rspamd-Queue-Id: 9128F8001D X-Stat-Signature: 5m4jnkriqhao43z9f7oka4qz53siqwx4 Authentication-Results: imf30.hostedemail.com; dkim=pass header.d=gmail.com header.s=20210112 header.b=b6Cjg8ED; dmarc=pass (policy=none) header.from=gmail.com; spf=pass (imf30.hostedemail.com: domain of 42.hyeyoo@gmail.com designates 209.85.214.170 as permitted sender) smtp.mailfrom=42.hyeyoo@gmail.com X-Rspamd-Server: rspam02 X-HE-Tag: 1640573006-826507 X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: On Sat, Dec 25, 2021 at 05:53:23PM +0000, Matthew Wilcox wrote: > On Sat, Dec 25, 2021 at 09:16:55AM +0000, Hyeonggon Yoo wrote: > > # mm: Convert struct page to struct slab in functions used by other subsystems > > I'm not familiar with kasan, but to ask: > > Does ____kasan_slab_free detect invalid free if someone frees > > an object that is not allocated from slab? > > > > @@ -341,7 +341,7 @@ static inline bool ____kasan_slab_free(struct kmem_cache *cache, void *object, > > - if (unlikely(nearest_obj(cache, virt_to_head_page(object), object) != > > + if (unlikely(nearest_obj(cache, virt_to_slab(object), object) != > > object)) { > > kasan_report_invalid_free(tagged_object, ip); > > return true; > > > > I'm asking this because virt_to_slab() will return NULL if folio_test_slab() > > returns false. That will cause NULL pointer dereference in nearest_obj. > > I don't think this change is intended. > > You need to track down how this could happen. As far as I can tell, > it's always called when we know the object is part of a slab. That's > where the cachep pointer is deduced from. Thank you Matthew, you are right. I read the code too narrowly. when we call kasan hooks, we know that the object is allocated from the slab cache. (through cache_from_obj) I'll review that patch again in part 3! Thanks, Hyeonggon