From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-13.0 required=3.0 tests=BAYES_00, HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_PATCH,MAILING_LIST_MULTI,NICE_REPLY_A, SIGNED_OFF_BY,SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_AGENT_SANE_1 autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 947AEC433E0 for ; Tue, 4 Aug 2020 17:18:53 +0000 (UTC) Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by mail.kernel.org (Postfix) with ESMTP id 6C0C3207FC for ; Tue, 4 Aug 2020 17:18:53 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org 6C0C3207FC Authentication-Results: mail.kernel.org; dmarc=none (p=none dis=none) header.from=suse.cz Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=owner-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix) id E386D8D017E; Tue, 4 Aug 2020 13:18:52 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id DC0808D0081; Tue, 4 Aug 2020 13:18:52 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id C886A8D017E; Tue, 4 Aug 2020 13:18:52 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from forelay.hostedemail.com (smtprelay0194.hostedemail.com [216.40.44.194]) by kanga.kvack.org (Postfix) with ESMTP id AEA788D0081 for ; Tue, 4 Aug 2020 13:18:52 -0400 (EDT) Received: from smtpin11.hostedemail.com (10.5.19.251.rfc1918.com [10.5.19.251]) by forelay05.hostedemail.com (Postfix) with ESMTP id 4C097181AC212 for ; Tue, 4 Aug 2020 17:18:52 +0000 (UTC) X-FDA: 77113546104.11.hole74_3d162ad26fa8 Received: from filter.hostedemail.com (10.5.16.251.rfc1918.com [10.5.16.251]) by smtpin11.hostedemail.com (Postfix) with ESMTP id 0765F180F8B82 for ; Tue, 4 Aug 2020 17:18:51 +0000 (UTC) X-HE-Tag: hole74_3d162ad26fa8 X-Filterd-Recvd-Size: 3591 Received: from mx2.suse.de (mx2.suse.de [195.135.220.15]) by imf18.hostedemail.com (Postfix) with ESMTP for ; Tue, 4 Aug 2020 17:18:51 +0000 (UTC) X-Virus-Scanned: by amavisd-new at test-mx.suse.de Received: from relay2.suse.de (unknown [195.135.221.27]) by mx2.suse.de (Postfix) with ESMTP id 6B5F6AE3A; Tue, 4 Aug 2020 17:19:06 +0000 (UTC) Subject: Re: [PATCH v2 2/2] slab: Add naive detection of double free To: Kees Cook , akpm@linux-foundation.org Cc: Roman Gushchin , Christoph Lameter , Alexander Popov , Pekka Enberg , David Rientjes , Joonsoo Kim , vinmenon@codeaurora.org, Matthew Garrett , Jann Horn , Vijayanand Jitta , linux-mm@kvack.org, linux-kernel@vger.kernel.org References: <20200625215548.389774-1-keescook@chromium.org> <20200625215548.389774-3-keescook@chromium.org> From: Vlastimil Babka Message-ID: Date: Tue, 4 Aug 2020 19:18:50 +0200 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Thunderbird/68.10.0 MIME-Version: 1.0 In-Reply-To: <20200625215548.389774-3-keescook@chromium.org> Content-Type: text/plain; charset=utf-8 Content-Language: en-US Content-Transfer-Encoding: 7bit X-Rspamd-Queue-Id: 0765F180F8B82 X-Spamd-Result: default: False [0.00 / 100.00] X-Rspamd-Server: rspam03 X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: On 6/25/20 11:55 PM, Kees Cook wrote: > Similar to commit ce6fa91b9363 ("mm/slub.c: add a naive detection > of double free or corruption"), add a very cheap double-free check > for SLAB under CONFIG_SLAB_FREELIST_HARDENED. With this added, the > "SLAB_FREE_DOUBLE" LKDTM test passes under SLAB: > > lkdtm: Performing direct entry SLAB_FREE_DOUBLE > lkdtm: Attempting double slab free ... > ------------[ cut here ]------------ > WARNING: CPU: 2 PID: 2193 at mm/slab.c:757 ___cache _free+0x325/0x390 > > Signed-off-by: Kees Cook No idea how much it helps in practice wrt security, but implementation-wise it seems fine, so: Acked-by: Vlastimil Babka Maybe you don't want to warn just once, though? We had similar discussion on cache_to_obj(). > --- > mm/slab.c | 14 ++++++++++++-- > 1 file changed, 12 insertions(+), 2 deletions(-) > > diff --git a/mm/slab.c b/mm/slab.c > index ebac5e400ad0..bbff6705ab2b 100644 > --- a/mm/slab.c > +++ b/mm/slab.c > @@ -749,6 +749,16 @@ static void drain_alien_cache(struct kmem_cache *cachep, > } > } > > +/* &alien->lock must be held by alien callers. */ > +static __always_inline void __free_one(struct array_cache *ac, void *objp) > +{ > + /* Avoid trivial double-free. */ > + if (IS_ENABLED(CONFIG_SLAB_FREELIST_HARDENED) && > + WARN_ON_ONCE(ac->avail > 0 && ac->entry[ac->avail - 1] == objp)) > + return; > + ac->entry[ac->avail++] = objp; > +} > + > static int __cache_free_alien(struct kmem_cache *cachep, void *objp, > int node, int page_node) > { > @@ -767,7 +777,7 @@ static int __cache_free_alien(struct kmem_cache *cachep, void *objp, > STATS_INC_ACOVERFLOW(cachep); > __drain_alien_cache(cachep, ac, page_node, &list); > } > - ac->entry[ac->avail++] = objp; > + __free_one(ac, objp); > spin_unlock(&alien->lock); > slabs_destroy(cachep, &list); > } else { > @@ -3457,7 +3467,7 @@ void ___cache_free(struct kmem_cache *cachep, void *objp, > } > } > > - ac->entry[ac->avail++] = objp; > + __free_one(ac, objp); > } > > /** >