From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id 2C25BC4321E for ; Wed, 30 Nov 2022 23:05:46 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id 8765C6B0071; Wed, 30 Nov 2022 18:05:45 -0500 (EST) Received: by kanga.kvack.org (Postfix, from userid 40) id 825F56B007D; Wed, 30 Nov 2022 18:05:45 -0500 (EST) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 6EDE16B007E; Wed, 30 Nov 2022 18:05:45 -0500 (EST) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0013.hostedemail.com [216.40.44.13]) by kanga.kvack.org (Postfix) with ESMTP id 5F8166B0071 for ; Wed, 30 Nov 2022 18:05:45 -0500 (EST) Received: from smtpin13.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay10.hostedemail.com (Postfix) with ESMTP id 27F88C0622 for ; Wed, 30 Nov 2022 23:05:45 +0000 (UTC) X-FDA: 80191642650.13.CCD418D Received: from smtp-out2.suse.de (smtp-out2.suse.de [195.135.220.29]) by imf19.hostedemail.com (Postfix) with ESMTP id 595F71A000B for ; Wed, 30 Nov 2022 23:05:43 +0000 (UTC) Received: from imap2.suse-dmz.suse.de (imap2.suse-dmz.suse.de [192.168.254.74]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-521) server-digest SHA512) (No client certificate requested) by smtp-out2.suse.de (Postfix) with ESMTPS id AB1A41F45B; Wed, 30 Nov 2022 23:05:41 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=suse.cz; s=susede2_rsa; t=1669849541; h=from:from:reply-to:date:date:message-id:message-id:to:to:cc:cc: mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=x6t/1gH9rWwLg3waldr2UlOAUoUcBLbX/7yAdRnju3k=; b=S4dvT7AAegiHK2rewnwfpJ3fDHpmbEElZFQH7qyk2FtAJdF1owpiBfegGuTLj/mfFcWuSi VSkS4yqWIZCg6WWH+gmBLmGq0RztvMRnCdcxkAdy5JKnqxOwuRHXhXE3Nd2k2SiL3ZqC1i llQVfqJn2CyM2tm4OoHD1F1Z+Bcswcc= DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/relaxed; d=suse.cz; s=susede2_ed25519; t=1669849541; h=from:from:reply-to:date:date:message-id:message-id:to:to:cc:cc: mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=x6t/1gH9rWwLg3waldr2UlOAUoUcBLbX/7yAdRnju3k=; b=vQ+jVArFkV0qwv4Kn+exiXdJbzxi+pgL6c3v1SpZkTHCcz06jrKMH957eMeSdjipdHPkLg C+pETNm6uGiP87CQ== Received: from imap2.suse-dmz.suse.de (imap2.suse-dmz.suse.de [192.168.254.74]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-521) server-digest SHA512) (No client certificate requested) by imap2.suse-dmz.suse.de (Postfix) with ESMTPS id 7274513A70; Wed, 30 Nov 2022 23:05:41 +0000 (UTC) Received: from dovecot-director2.suse.de ([192.168.254.65]) by imap2.suse-dmz.suse.de with ESMTPSA id lSwGG8Xhh2MhbgAAMHmgww (envelope-from ); Wed, 30 Nov 2022 23:05:41 +0000 Message-ID: Date: Thu, 1 Dec 2022 00:05:41 +0100 MIME-Version: 1.0 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:102.0) Gecko/20100101 Thunderbird/102.5.0 Subject: Re: [PATCH v3 2/2] mm/slub, kunit: Add a test case for kmalloc redzone check To: Feng Tang , Marco Elver , Andrew Morton , Oliver Glitta , Christoph Lameter , Pekka Enberg , David Rientjes , Joonsoo Kim , Roman Gushchin , Hyeonggon Yoo <42.hyeyoo@gmail.com> Cc: linux-mm@kvack.org, linux-kernel@vger.kernel.org References: <20221130085451.3390992-1-feng.tang@intel.com> <20221130085451.3390992-2-feng.tang@intel.com> Content-Language: en-US From: Vlastimil Babka In-Reply-To: <20221130085451.3390992-2-feng.tang@intel.com> Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1669849543; a=rsa-sha256; cv=none; b=4dxS8BTbREIKd09QkYfoQ7wbysZu4SsrQOMtBtO9ekFep6f+SI95OjH68m9cP4DZH93zlt v4RshA9SSezV/V7DYSU3/Z4V+4eVUAARGwqcF7N78zAgAQ4VruNXzD6dxgsqm1p3w2NSKJ f3CThP1lqo5Wi5A9s1Q6/7m79/ZcHbg= ARC-Authentication-Results: i=1; imf19.hostedemail.com; dkim=pass header.d=suse.cz header.s=susede2_rsa header.b=S4dvT7AA; dkim=pass header.d=suse.cz header.s=susede2_ed25519 header.b=vQ+jVArF; dmarc=none; spf=pass (imf19.hostedemail.com: domain of vbabka@suse.cz designates 195.135.220.29 as permitted sender) smtp.mailfrom=vbabka@suse.cz ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1669849543; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references:dkim-signature; bh=x6t/1gH9rWwLg3waldr2UlOAUoUcBLbX/7yAdRnju3k=; b=JK+yEceaVMzR0AXbIBUySXoXtrb38yC8kReYahgtdW1aLBUfEqmwEBMSh3r9cRAUnCAzod cGWq52BkKPXBczj5+6flcQva+YPw//FR3eZaa06thUVV5DLCxfuB4fqai3RdV+j22Uf6sc pbtXzoFuEzBOULWlLkHCrO2GMWhQKck= X-Rspamd-Queue-Id: 595F71A000B Authentication-Results: imf19.hostedemail.com; dkim=pass header.d=suse.cz header.s=susede2_rsa header.b=S4dvT7AA; dkim=pass header.d=suse.cz header.s=susede2_ed25519 header.b=vQ+jVArF; dmarc=none; spf=pass (imf19.hostedemail.com: domain of vbabka@suse.cz designates 195.135.220.29 as permitted sender) smtp.mailfrom=vbabka@suse.cz X-Rspamd-Server: rspam12 X-Rspam-User: X-Stat-Signature: ktooipcs7z7mdepxoq68k6j4yeanyy5h X-HE-Tag: 1669849543-179653 X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: On 11/30/22 09:54, Feng Tang wrote: > kmalloc redzone check for slub has been merged, and it's better to add > a kunit case for it, which is inspired by a real-world case as described > in commit 120ee599b5bf ("staging: octeon-usb: prevent memory corruption"): > > " > octeon-hcd will crash the kernel when SLOB is used. This usually happens > after the 18-byte control transfer when a device descriptor is read. > The DMA engine is always transferring full 32-bit words and if the > transfer is shorter, some random garbage appears after the buffer. > The problem is not visible with SLUB since it rounds up the allocations > to word boundary, and the extra bytes will go undetected. > " > > To avoid interrupting the normal functioning of kmalloc caches, a > kmem_cache mimicing kmalloc cache is created with similar flags, and > kmalloc_trace() is used to really test the orig_size and redzone setup. > > Suggested-by: Vlastimil Babka > Signed-off-by: Feng Tang > --- > Changelog: > > since v2: > * only add SLAB_KMALLOC to SLAB_CACHE_FLAGS and SLAB_FLAGS_PERMITTEDa, > and use new wrapper of cache creation(Vlastimil Babka) > > since v1: > * create a new cache mimicing kmalloc cache, reduce dependency > over global slub_debug setting (Vlastimil Babka) > > lib/slub_kunit.c | 22 ++++++++++++++++++++++ > mm/slab.h | 4 +++- > 2 files changed, 25 insertions(+), 1 deletion(-) > > diff --git a/lib/slub_kunit.c b/lib/slub_kunit.c > index 5b0c8e7eb6dc..ff24879e3afe 100644 > --- a/lib/slub_kunit.c > +++ b/lib/slub_kunit.c > @@ -135,6 +135,27 @@ static void test_clobber_redzone_free(struct kunit *test) > kmem_cache_destroy(s); > } > > +static void test_kmalloc_redzone_access(struct kunit *test) > +{ > + struct kmem_cache *s = test_kmem_cache_create("TestSlub_RZ_kmalloc", 32, > + SLAB_KMALLOC|SLAB_STORE_USER|SLAB_RED_ZONE); > + u8 *p = kmalloc_trace(s, GFP_KERNEL, 18); > + > + kasan_disable_current(); > + > + /* Suppress the -Warray-bounds warning */ > + OPTIMIZER_HIDE_VAR(p); > + p[18] = 0xab; > + p[19] = 0xab; > + > + kmem_cache_free(s, p); > + validate_slab_cache(s); > + KUNIT_EXPECT_EQ(test, 2, slab_errors); With this ordering the expectation was failing as slab_Errors was 0, had to fix it up to look more like TestSlub_RZ_alloc: > + kasan_enable_current(); > + kmem_cache_destroy(s); > +} > + --- a/lib/slub_kunit.c +++ b/lib/slub_kunit.c @@ -148,11 +148,11 @@ static void test_kmalloc_redzone_access(struct kunit *test) p[18] = 0xab; p[19] = 0xab; - kmem_cache_free(s, p); validate_slab_cache(s); KUNIT_EXPECT_EQ(test, 2, slab_errors); kasan_enable_current(); + kmem_cache_free(s, p); kmem_cache_destroy(s); } With that, added both to slab.git branch slab/for-6.2/kmalloc_redzone Thanks!