From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id DA342C433EF for ; Fri, 4 Mar 2022 16:42:50 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id 0C7328D0002; Fri, 4 Mar 2022 11:42:50 -0500 (EST) Received: by kanga.kvack.org (Postfix, from userid 40) id 0764F8D0001; Fri, 4 Mar 2022 11:42:50 -0500 (EST) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id E80A68D0002; Fri, 4 Mar 2022 11:42:49 -0500 (EST) X-Delivered-To: linux-mm@kvack.org Received: from forelay.hostedemail.com (smtprelay0226.hostedemail.com [216.40.44.226]) by kanga.kvack.org (Postfix) with ESMTP id DA7208D0001 for ; Fri, 4 Mar 2022 11:42:49 -0500 (EST) Received: from smtpin27.hostedemail.com (10.5.19.251.rfc1918.com [10.5.19.251]) by forelay05.hostedemail.com (Postfix) with ESMTP id 96015181C49D4 for ; Fri, 4 Mar 2022 16:42:49 +0000 (UTC) X-FDA: 79207272858.27.5848083 Received: from smtp-out2.suse.de (smtp-out2.suse.de [195.135.220.29]) by imf01.hostedemail.com (Postfix) with ESMTP id E16654001B for ; Fri, 4 Mar 2022 16:42:48 +0000 (UTC) Received: from imap2.suse-dmz.suse.de (imap2.suse-dmz.suse.de [192.168.254.74]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-521) server-digest SHA512) (No client certificate requested) by smtp-out2.suse.de (Postfix) with ESMTPS id C720C1F38A; Fri, 4 Mar 2022 16:42:47 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=suse.cz; s=susede2_rsa; t=1646412167; h=from:from:reply-to:date:date:message-id:message-id:to:to:cc:cc: mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=h+2Itu7S1crpuZV7anehYym0zMXdq6gIiMgw+mWxVb4=; b=aKUeVXsAibm8DTcJS4p3Odp8T2pRYvkHDAatPXKAO4xM83rIJhLiCnbFNqOozShOI9w2dy 9/xHRBjevpgP3lT1A3TLp0I7srrfJuGil31hUkVvS4dW7WtHSfFOIMHpcLOtICIMb4zMfE In2ePdyWDb4C1Rsm5j/aI+8skosaPWY= DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/relaxed; d=suse.cz; s=susede2_ed25519; t=1646412167; h=from:from:reply-to:date:date:message-id:message-id:to:to:cc:cc: mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=h+2Itu7S1crpuZV7anehYym0zMXdq6gIiMgw+mWxVb4=; b=HdfV+Xl8PhkuhtYO3gxqiy4fR7yefPCrGWo/VKV5Wo4R1iooE+5j5g/z7CWSNK29C1IaaR 1ZH9rGQE/j1ptMCA== Received: from imap2.suse-dmz.suse.de (imap2.suse-dmz.suse.de [192.168.254.74]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-521) server-digest SHA512) (No client certificate requested) by imap2.suse-dmz.suse.de (Postfix) with ESMTPS id 9DF0813CE6; Fri, 4 Mar 2022 16:42:47 +0000 (UTC) Received: from dovecot-director2.suse.de ([192.168.254.65]) by imap2.suse-dmz.suse.de with ESMTPSA id bLbFJYdBImIpUwAAMHmgww (envelope-from ); Fri, 04 Mar 2022 16:42:47 +0000 Message-ID: Date: Fri, 4 Mar 2022 17:42:47 +0100 MIME-Version: 1.0 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:91.0) Gecko/20100101 Thunderbird/91.6.1 Content-Language: en-US To: Marco Elver , Hyeonggon Yoo <42.hyeyoo@gmail.com> Cc: linux-mm@kvack.org, Christoph Lameter , Pekka Enberg , David Rientjes , Joonsoo Kim , Andrew Morton , Matthew WilCox , Roman Gushchin , linux-kernel@vger.kernel.org References: <20220304063427.372145-1-42.hyeyoo@gmail.com> From: Vlastimil Babka Subject: Re: [PATCH v2 0/5] slab cleanups In-Reply-To: Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit X-Rspamd-Server: rspam06 X-Rspamd-Queue-Id: E16654001B X-Stat-Signature: mahcwsf6bzm16h8cataqcrtnp19kqep1 Authentication-Results: imf01.hostedemail.com; dkim=pass header.d=suse.cz header.s=susede2_rsa header.b=aKUeVXsA; dkim=pass header.d=suse.cz header.s=susede2_ed25519 header.b=HdfV+Xl8; spf=pass (imf01.hostedemail.com: domain of vbabka@suse.cz designates 195.135.220.29 as permitted sender) smtp.mailfrom=vbabka@suse.cz; dmarc=none X-Rspam-User: X-HE-Tag: 1646412168-804699 X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: On 3/4/22 14:11, Marco Elver wrote: > On Fri, 4 Mar 2022 at 13:02, Hyeonggon Yoo <42.hyeyoo@gmail.com> wrote: >> >> On Fri, Mar 04, 2022 at 12:50:21PM +0100, Marco Elver wrote: >> > On Fri, 4 Mar 2022 at 07:34, Hyeonggon Yoo <42.hyeyoo@gmail.com> wrote: >> > > >> > > Changes from v1: >> > > Now SLAB passes requests larger than order-1 page >> > > to page allocator. >> > > >> > > Adjusted comments from Matthew, Vlastimil, Rientjes. >> > > Thank you for feedback! >> > > >> > > BTW, I have no idea what __ksize() should return when an object that >> > > is not allocated from slab is passed. both 0 and folio_size() >> > > seems wrong to me. >> > >> > Didn't we say 0 would be the safer of the two options? >> > https://lkml.kernel.org/r/0e02416f-ef43-dc8a-9e8e-50ff63dd3c61@suse.cz >> > >> >> Oh sorry, I didn't understand why 0 was safer when I was reading it. >> >> Reading again, 0 is safer because kasan does not unpoison for >> wrongly passed object, right? > > Not quite. KASAN can tell if something is wrong, i.e. invalid object. > Similarly, if you are able to tell if the passed pointer is not a > valid object some other way, you can do something better - namely, > return 0. Hmm, but how paranoid do we have to be? Patch 1 converts SLAB to use kmalloc_large(). So it's now legitimate to have objects allocated by SLAB's kmalloc() that don't have a slab folio flag set, and their size is folio_size(). It would be more common than getting a bogus pointer, so should we return 0 just because a bogus pointer is possible? If we do that, then KASAN will fail to unpoison legitimate kmalloc_large() objects, no? What I suggested earlier is we could make the checks more precise - if folio_size() is smaller or equal order-1 page, then it's bogus because we only do kmalloc_large() for >order-1. If the object pointer is not to the beginning of the folio, then it's bogus, because kmalloc_large() returns the beginning of the folio. Then in these case we return 0, but otherwise we should return folio_size()? > The intuition here is that the caller has a pointer to an > invalid object, and wants to use ksize() to determine its size, and > most likely access all those bytes. Arguably, at that point the kernel > is already in a degrading state. But we can try to not let things get > worse by having ksize() return 0, in the hopes that it will stop > corrupting more memory. It won't work in all cases, but should avoid > things like "s = ksize(obj); touch_all_bytes(obj, s)" where the size > bounds the memory accessed corrupting random memory. > > The other reason is that a caller could actually check the size, and > if 0, do something else. Few callers will do so, because nobody > expects that their code has a bug. :-)