[PATCH] mm: kfence: Fix false positives on big endian

[PATCH] mm: kfence: Fix false positives on big endian

[Michael Ellerman]

Since commit 1ba3cbf3ec3b ("mm: kfence: improve the performance of
__kfence_alloc() and __kfence_free()"), kfence reports failures in
random places at boot on big endian machines.

The problem is that the new KFENCE_CANARY_PATTERN_U64 encodes the
address of each byte in its value, so it needs to be byte swapped on big
endian machines.

The compiler is smart enough to do the le64_to_cpu() at compile time, so
there is no runtime overhead.

Fixes: 1ba3cbf3ec3b ("mm: kfence: improve the performance of __kfence_alloc() and __kfence_free()")
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
---
 mm/kfence/kfence.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/mm/kfence/kfence.h b/mm/kfence/kfence.h
index 2aafc46a4aaf..392fb273e7bd 100644
--- a/mm/kfence/kfence.h
+++ b/mm/kfence/kfence.h
@@ -29,7 +29,7 @@
  * canary of every 8 bytes is the same. 64-bit memory can be filled and checked
  * at a time instead of byte by byte to improve performance.
  */
-#define KFENCE_CANARY_PATTERN_U64 ((u64)0xaaaaaaaaaaaaaaaa ^ (u64)(0x0706050403020100))
+#define KFENCE_CANARY_PATTERN_U64 ((u64)0xaaaaaaaaaaaaaaaa ^ (u64)(le64_to_cpu(0x0706050403020100)))
 
 /* Maximum stack depth for reports. */
 #define KFENCE_STACK_DEPTH 64
-- 
2.40.1

Re: [PATCH] mm: kfence: Fix false positives on big endian

[Alexander Potapenko]

[-- Attachment #1: Type: text/plain, Size: 772 bytes --]

On Fri, May 5, 2023 at 5:51 AM Michael Ellerman <mpe@ellerman.id.au> wrote:

> Since commit 1ba3cbf3ec3b ("mm: kfence: improve the performance of
> __kfence_alloc() and __kfence_free()"), kfence reports failures in
> random places at boot on big endian machines.
>
> The problem is that the new KFENCE_CANARY_PATTERN_U64 encodes the
> address of each byte in its value, so it needs to be byte swapped on big
> endian machines.
>
> The compiler is smart enough to do the le64_to_cpu() at compile time, so
> there is no runtime overhead.
>
> Fixes: 1ba3cbf3ec3b ("mm: kfence: improve the performance of
> __kfence_alloc() and __kfence_free()")
> Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
>
Reviewed-by: Alexander Potapenko <glider@google.com>

[-- Attachment #2: Type: text/html, Size: 1232 bytes --]

Re: [PATCH] mm: kfence: Fix false positives on big endian

[Marco Elver]

On Fri, 5 May 2023 at 05:51, Michael Ellerman <mpe@ellerman.id.au> wrote:
>
> Since commit 1ba3cbf3ec3b ("mm: kfence: improve the performance of
> __kfence_alloc() and __kfence_free()"), kfence reports failures in
> random places at boot on big endian machines.
>
> The problem is that the new KFENCE_CANARY_PATTERN_U64 encodes the
> address of each byte in its value, so it needs to be byte swapped on big
> endian machines.
>
> The compiler is smart enough to do the le64_to_cpu() at compile time, so
> there is no runtime overhead.
>
> Fixes: 1ba3cbf3ec3b ("mm: kfence: improve the performance of __kfence_alloc() and __kfence_free()")
> Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>

Reviewed-by: Marco Elver <elver@google.com>

Andrew, is the Fixes enough to make it to stable as well or do we also
need Cc: stable?

Thanks,
-- Marco

> ---
>  mm/kfence/kfence.h | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/mm/kfence/kfence.h b/mm/kfence/kfence.h
> index 2aafc46a4aaf..392fb273e7bd 100644
> --- a/mm/kfence/kfence.h
> +++ b/mm/kfence/kfence.h
> @@ -29,7 +29,7 @@
>   * canary of every 8 bytes is the same. 64-bit memory can be filled and checked
>   * at a time instead of byte by byte to improve performance.
>   */
> -#define KFENCE_CANARY_PATTERN_U64 ((u64)0xaaaaaaaaaaaaaaaa ^ (u64)(0x0706050403020100))
> +#define KFENCE_CANARY_PATTERN_U64 ((u64)0xaaaaaaaaaaaaaaaa ^ (u64)(le64_to_cpu(0x0706050403020100)))
>
>  /* Maximum stack depth for reports. */
>  #define KFENCE_STACK_DEPTH 64
> --
> 2.40.1
>

Re: [PATCH] mm: kfence: Fix false positives on big endian

[Michael Ellerman]

Marco Elver <elver@google.com> writes:
> On Fri, 5 May 2023 at 05:51, Michael Ellerman <mpe@ellerman.id.au> wrote:
>>
>> Since commit 1ba3cbf3ec3b ("mm: kfence: improve the performance of
>> __kfence_alloc() and __kfence_free()"), kfence reports failures in
>> random places at boot on big endian machines.
>>
>> The problem is that the new KFENCE_CANARY_PATTERN_U64 encodes the
>> address of each byte in its value, so it needs to be byte swapped on big
>> endian machines.
>>
>> The compiler is smart enough to do the le64_to_cpu() at compile time, so
>> there is no runtime overhead.
>>
>> Fixes: 1ba3cbf3ec3b ("mm: kfence: improve the performance of __kfence_alloc() and __kfence_free()")
>> Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
>
> Reviewed-by: Marco Elver <elver@google.com>

Thanks.

> Andrew, is the Fixes enough to make it to stable as well or do we also
> need Cc: stable?

That commit is not in any releases yet (or even an rc), so as long as it
gets picked up before v6.4 then it won't need to go to stable.

cheers

RE: [PATCH] mm: kfence: Fix false positives on big endian

[David Laight]

From: Michael Ellerman
> Sent: 05 May 2023 04:51
> 
> Since commit 1ba3cbf3ec3b ("mm: kfence: improve the performance of
> __kfence_alloc() and __kfence_free()"), kfence reports failures in
> random places at boot on big endian machines.
> 
> The problem is that the new KFENCE_CANARY_PATTERN_U64 encodes the
> address of each byte in its value, so it needs to be byte swapped on big
> endian machines.
> 
> The compiler is smart enough to do the le64_to_cpu() at compile time, so
> there is no runtime overhead.
> 
> Fixes: 1ba3cbf3ec3b ("mm: kfence: improve the performance of __kfence_alloc() and __kfence_free()")
> Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
> ---
>  mm/kfence/kfence.h | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/mm/kfence/kfence.h b/mm/kfence/kfence.h
> index 2aafc46a4aaf..392fb273e7bd 100644
> --- a/mm/kfence/kfence.h
> +++ b/mm/kfence/kfence.h
> @@ -29,7 +29,7 @@
>   * canary of every 8 bytes is the same. 64-bit memory can be filled and checked
>   * at a time instead of byte by byte to improve performance.
>   */
> -#define KFENCE_CANARY_PATTERN_U64 ((u64)0xaaaaaaaaaaaaaaaa ^ (u64)(0x0706050403020100))
> +#define KFENCE_CANARY_PATTERN_U64 ((u64)0xaaaaaaaaaaaaaaaa ^ (u64)(le64_to_cpu(0x0706050403020100)))

What at the (u64) casts for?
The constants should probably have a ul (or ull) suffix.

	David

-
Registered Address Lakeside, Bramley Road, Mount Farm, Milton Keynes, MK1 1PT, UK
Registration No: 1397386 (Wales)

Re: [PATCH] mm: kfence: Fix false positives on big endian

[Andrew Morton]

On Fri, 5 May 2023 16:02:17 +0000 David Laight <David.Laight@ACULAB.COM> wrote:

> From: Michael Ellerman
> > Sent: 05 May 2023 04:51
> > 
> > Since commit 1ba3cbf3ec3b ("mm: kfence: improve the performance of
> > __kfence_alloc() and __kfence_free()"), kfence reports failures in
> > random places at boot on big endian machines.
> > 
> > The problem is that the new KFENCE_CANARY_PATTERN_U64 encodes the
> > address of each byte in its value, so it needs to be byte swapped on big
> > endian machines.
> > 
> > The compiler is smart enough to do the le64_to_cpu() at compile time, so
> > there is no runtime overhead.
> > 
> > Fixes: 1ba3cbf3ec3b ("mm: kfence: improve the performance of __kfence_alloc() and __kfence_free()")
> > Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
> > ---
> >  mm/kfence/kfence.h | 2 +-
> >  1 file changed, 1 insertion(+), 1 deletion(-)
> > 
> > diff --git a/mm/kfence/kfence.h b/mm/kfence/kfence.h
> > index 2aafc46a4aaf..392fb273e7bd 100644
> > --- a/mm/kfence/kfence.h
> > +++ b/mm/kfence/kfence.h
> > @@ -29,7 +29,7 @@
> >   * canary of every 8 bytes is the same. 64-bit memory can be filled and checked
> >   * at a time instead of byte by byte to improve performance.
> >   */
> > -#define KFENCE_CANARY_PATTERN_U64 ((u64)0xaaaaaaaaaaaaaaaa ^ (u64)(0x0706050403020100))
> > +#define KFENCE_CANARY_PATTERN_U64 ((u64)0xaaaaaaaaaaaaaaaa ^ (u64)(le64_to_cpu(0x0706050403020100)))
> 
> What at the (u64) casts for?
> The constants should probably have a ul (or ull) suffix.
> 

I tried that, didn't fix the sparse warnings described at
https://lkml.kernel.org/r/202305132244.DwzBUcUd-lkp@intel.com.

Michael, have you looked into this?

I'll merge it upstream - I guess we can live with the warnings for a while.

Re: [PATCH] mm: kfence: Fix false positives on big endian

[Michael Ellerman]

Andrew Morton <akpm@linux-foundation.org> writes:
> On Fri, 5 May 2023 16:02:17 +0000 David Laight <David.Laight@ACULAB.COM> wrote:
>
>> From: Michael Ellerman
>> > Sent: 05 May 2023 04:51
>> > 
>> > Since commit 1ba3cbf3ec3b ("mm: kfence: improve the performance of
>> > __kfence_alloc() and __kfence_free()"), kfence reports failures in
>> > random places at boot on big endian machines.
>> > 
>> > The problem is that the new KFENCE_CANARY_PATTERN_U64 encodes the
>> > address of each byte in its value, so it needs to be byte swapped on big
>> > endian machines.
>> > 
>> > The compiler is smart enough to do the le64_to_cpu() at compile time, so
>> > there is no runtime overhead.
>> > 
>> > Fixes: 1ba3cbf3ec3b ("mm: kfence: improve the performance of __kfence_alloc() and __kfence_free()")
>> > Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
>> > ---
>> >  mm/kfence/kfence.h | 2 +-
>> >  1 file changed, 1 insertion(+), 1 deletion(-)
>> > 
>> > diff --git a/mm/kfence/kfence.h b/mm/kfence/kfence.h
>> > index 2aafc46a4aaf..392fb273e7bd 100644
>> > --- a/mm/kfence/kfence.h
>> > +++ b/mm/kfence/kfence.h
>> > @@ -29,7 +29,7 @@
>> >   * canary of every 8 bytes is the same. 64-bit memory can be filled and checked
>> >   * at a time instead of byte by byte to improve performance.
>> >   */
>> > -#define KFENCE_CANARY_PATTERN_U64 ((u64)0xaaaaaaaaaaaaaaaa ^ (u64)(0x0706050403020100))
>> > +#define KFENCE_CANARY_PATTERN_U64 ((u64)0xaaaaaaaaaaaaaaaa ^ (u64)(le64_to_cpu(0x0706050403020100)))
>> 
>> What at the (u64) casts for?
>> The constants should probably have a ul (or ull) suffix.
>> 
>
> I tried that, didn't fix the sparse warnings described at
> https://lkml.kernel.org/r/202305132244.DwzBUcUd-lkp@intel.com.
>
> Michael, have you looked into this?

I haven't sorry, been chasing other bugs.

> I'll merge it upstream - I guess we can live with the warnings for a while.

Thanks, yeah spurious WARNs are more of a pain than some sparse warnings.

Maybe using le64_to_cpu() is too fancy, could just do it with an ifdef? eg.

diff --git a/mm/kfence/kfence.h b/mm/kfence/kfence.h
index 392fb273e7bd..510355a5382b 100644
--- a/mm/kfence/kfence.h
+++ b/mm/kfence/kfence.h
@@ -29,7 +29,11 @@
  * canary of every 8 bytes is the same. 64-bit memory can be filled and checked
  * at a time instead of byte by byte to improve performance.
  */
-#define KFENCE_CANARY_PATTERN_U64 ((u64)0xaaaaaaaaaaaaaaaa ^ (u64)(le64_to_cpu(0x0706050403020100)))
+#ifdef __LITTLE_ENDIAN__
+#define KFENCE_CANARY_PATTERN_U64 (0xaaaaaaaaaaaaaaaaULL ^ 0x0706050403020100ULL)
+#else
+#define KFENCE_CANARY_PATTERN_U64 (0xaaaaaaaaaaaaaaaaULL ^ 0x0001020304050607ULL)
+#endif
 
 /* Maximum stack depth for reports. */
 #define KFENCE_STACK_DEPTH 64


cheers

Re: [PATCH] mm: kfence: Fix false positives on big endian

[Benjamin Gray]

On Fri, 2023-05-19 at 15:14 +1000, Michael Ellerman wrote:
> Andrew Morton <akpm@linux-foundation.org> writes:
> > On Fri, 5 May 2023 16:02:17 +0000 David Laight
> > <David.Laight@ACULAB.COM> wrote:
> > 
> > > From: Michael Ellerman
> > > > Sent: 05 May 2023 04:51
> > > > 
> > > > Since commit 1ba3cbf3ec3b ("mm: kfence: improve the performance
> > > > of
> > > > __kfence_alloc() and __kfence_free()"), kfence reports failures
> > > > in
> > > > random places at boot on big endian machines.
> > > > 
> > > > The problem is that the new KFENCE_CANARY_PATTERN_U64 encodes
> > > > the
> > > > address of each byte in its value, so it needs to be byte
> > > > swapped on big
> > > > endian machines.
> > > > 
> > > > The compiler is smart enough to do the le64_to_cpu() at compile
> > > > time, so
> > > > there is no runtime overhead.
> > > > 
> > > > Fixes: 1ba3cbf3ec3b ("mm: kfence: improve the performance of
> > > > __kfence_alloc() and __kfence_free()")
> > > > Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
> > > > ---
> > > >  mm/kfence/kfence.h | 2 +-
> > > >  1 file changed, 1 insertion(+), 1 deletion(-)
> > > > 
> > > > diff --git a/mm/kfence/kfence.h b/mm/kfence/kfence.h
> > > > index 2aafc46a4aaf..392fb273e7bd 100644
> > > > --- a/mm/kfence/kfence.h
> > > > +++ b/mm/kfence/kfence.h
> > > > @@ -29,7 +29,7 @@
> > > >   * canary of every 8 bytes is the same. 64-bit memory can be
> > > > filled and checked
> > > >   * at a time instead of byte by byte to improve performance.
> > > >   */
> > > > -#define KFENCE_CANARY_PATTERN_U64 ((u64)0xaaaaaaaaaaaaaaaa ^
> > > > (u64)(0x0706050403020100))
> > > > +#define KFENCE_CANARY_PATTERN_U64 ((u64)0xaaaaaaaaaaaaaaaa ^
> > > > (u64)(le64_to_cpu(0x0706050403020100)))
> > > 
> > > What at the (u64) casts for?
> > > The constants should probably have a ul (or ull) suffix.
> > > 
> > 
> > I tried that, didn't fix the sparse warnings described at
> > https://lkml.kernel.org/r/202305132244.DwzBUcUd-lkp@intel.com.
> > 
> > Michael, have you looked into this?
> 
> I haven't sorry, been chasing other bugs.
> 
> > I'll merge it upstream - I guess we can live with the warnings for
> > a while.
> 
> Thanks, yeah spurious WARNs are more of a pain than some sparse
> warnings.
> 
> Maybe using le64_to_cpu() is too fancy, could just do it with an
> ifdef? eg.
> 
> diff --git a/mm/kfence/kfence.h b/mm/kfence/kfence.h
> index 392fb273e7bd..510355a5382b 100644
> --- a/mm/kfence/kfence.h
> +++ b/mm/kfence/kfence.h
> @@ -29,7 +29,11 @@
>   * canary of every 8 bytes is the same. 64-bit memory can be filled
> and checked
>   * at a time instead of byte by byte to improve performance.
>   */
> -#define KFENCE_CANARY_PATTERN_U64 ((u64)0xaaaaaaaaaaaaaaaa ^
> (u64)(le64_to_cpu(0x0706050403020100)))
> +#ifdef __LITTLE_ENDIAN__
> +#define KFENCE_CANARY_PATTERN_U64 (0xaaaaaaaaaaaaaaaaULL ^
> 0x0706050403020100ULL)
> +#else
> +#define KFENCE_CANARY_PATTERN_U64 (0xaaaaaaaaaaaaaaaaULL ^
> 0x0001020304050607ULL)
> +#endif
>  
>  /* Maximum stack depth for reports. */
>  #define KFENCE_STACK_DEPTH 64
> 
> 
> cheers

(for the sparse errors)

As I understand, we require memory to look like "00 01 02 03 04 05 06
07" such that iterating byte-by-byte gives 00, 01, etc. (with
everything XORed with aaa...)

I think it would be most semantically correct to use cpu_to_le64 on
KFENCE_CANARY_PATTERN_U64 and annotate the values being compared
against it as __le64. This is because we want the integer literal
0x0706050403020100 to be stored as "00 01 02 03 04 05 06 07", which is
the definition of little endian.

Masking this with an #ifdef leaves the type as cpu endian, which could
result in future issues.

(or I've just misunderstood and can disregard this)

Re: [PATCH] mm: kfence: Fix false positives on big endian

[Christophe Leroy]

Le 18/05/2023 à 00:20, Andrew Morton a écrit :
> On Fri, 5 May 2023 16:02:17 +0000 David Laight <David.Laight@ACULAB.COM> wrote:
> 
>> From: Michael Ellerman
>>> Sent: 05 May 2023 04:51
>>>
>>> Since commit 1ba3cbf3ec3b ("mm: kfence: improve the performance of
>>> __kfence_alloc() and __kfence_free()"), kfence reports failures in
>>> random places at boot on big endian machines.
>>>
>>> The problem is that the new KFENCE_CANARY_PATTERN_U64 encodes the
>>> address of each byte in its value, so it needs to be byte swapped on big
>>> endian machines.
>>>
>>> The compiler is smart enough to do the le64_to_cpu() at compile time, so
>>> there is no runtime overhead.
>>>
>>> Fixes: 1ba3cbf3ec3b ("mm: kfence: improve the performance of __kfence_alloc() and __kfence_free()")
>>> Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
>>> ---
>>>   mm/kfence/kfence.h | 2 +-
>>>   1 file changed, 1 insertion(+), 1 deletion(-)
>>>
>>> diff --git a/mm/kfence/kfence.h b/mm/kfence/kfence.h
>>> index 2aafc46a4aaf..392fb273e7bd 100644
>>> --- a/mm/kfence/kfence.h
>>> +++ b/mm/kfence/kfence.h
>>> @@ -29,7 +29,7 @@
>>>    * canary of every 8 bytes is the same. 64-bit memory can be filled and checked
>>>    * at a time instead of byte by byte to improve performance.
>>>    */
>>> -#define KFENCE_CANARY_PATTERN_U64 ((u64)0xaaaaaaaaaaaaaaaa ^ (u64)(0x0706050403020100))
>>> +#define KFENCE_CANARY_PATTERN_U64 ((u64)0xaaaaaaaaaaaaaaaa ^ (u64)(le64_to_cpu(0x0706050403020100)))
>>
>> What at the (u64) casts for?
>> The constants should probably have a ul (or ull) suffix.
>>
> 
> I tried that, didn't fix the sparse warnings described at
> https://lkml.kernel.org/r/202305132244.DwzBUcUd-lkp@intel.com.
> 
> Michael, have you looked into this?
> 
> I'll merge it upstream - I guess we can live with the warnings for a while.
> 

sparse warning goes away with:

#define KFENCE_CANARY_PATTERN_U64 (0xaaaaaaaaaaaaaaaaULL ^ 
le64_to_cpu((__force __le64)0x0706050403020100))

Christophe