From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id 39C63C10F16 for ; Tue, 30 Apr 2024 12:24:38 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id A81BD6B0085; Tue, 30 Apr 2024 08:24:37 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id A317C6B0087; Tue, 30 Apr 2024 08:24:37 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 9201D6B0088; Tue, 30 Apr 2024 08:24:37 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0010.hostedemail.com [216.40.44.10]) by kanga.kvack.org (Postfix) with ESMTP id 751816B0085 for ; Tue, 30 Apr 2024 08:24:37 -0400 (EDT) Received: from smtpin07.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay01.hostedemail.com (Postfix) with ESMTP id 237181C0CA1 for ; Tue, 30 Apr 2024 12:24:37 +0000 (UTC) X-FDA: 82066116594.07.6FC45DC Received: from out-173.mta0.migadu.com (out-173.mta0.migadu.com [91.218.175.173]) by imf28.hostedemail.com (Postfix) with ESMTP id 53E51C0028 for ; Tue, 30 Apr 2024 12:24:34 +0000 (UTC) Authentication-Results: imf28.hostedemail.com; dkim=pass header.d=linux.dev header.s=key1 header.b=MAQ9GBoy; dmarc=pass (policy=none) header.from=linux.dev; spf=pass (imf28.hostedemail.com: domain of chengming.zhou@linux.dev designates 91.218.175.173 as permitted sender) smtp.mailfrom=chengming.zhou@linux.dev ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1714479874; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references:dkim-signature; bh=G1ytzCh4DK871MzJc5SzNhcnB9s/CPyVS2qgE0inj/o=; b=sHdsOLDrsHUZNz/nZQK5ztFCT/5V+Yrn8T1v1of3TCyzZFcSOTcX7oCfJIZwh0IDdhNALs 33WyU9uWkhvx8ouZsxjgTjIURiXy8ju2gEsCp0sNl5tTV01rdBlEwZqqytDkwdb4wtz59D KK5FRPbvgj4FW4VY83oS0y0OXSfzsWo= ARC-Authentication-Results: i=1; imf28.hostedemail.com; dkim=pass header.d=linux.dev header.s=key1 header.b=MAQ9GBoy; dmarc=pass (policy=none) header.from=linux.dev; spf=pass (imf28.hostedemail.com: domain of chengming.zhou@linux.dev designates 91.218.175.173 as permitted sender) smtp.mailfrom=chengming.zhou@linux.dev ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1714479874; a=rsa-sha256; cv=none; b=Nnudygp0HSy2GZkRu9DB3lZpEjur9JPiDoVZCdYslbdjRb6IQJHYaPuUbmEZnfZ1u17bO1 3aWcEFQfdJO44RbEBxYqdyzzXwJrp6kTGr05rMteqy3LCz7sEVr5zZ6XL/kGzgmPaLAQRa NvWfXuDfG3g9FuOqp1T8zNxBvv3ijx4= Message-ID: DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linux.dev; s=key1; t=1714479871; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=G1ytzCh4DK871MzJc5SzNhcnB9s/CPyVS2qgE0inj/o=; b=MAQ9GBoy69q68FHEh+wSZq+JT7JQs/4lSj7VNLfvQuaZmJIp1s5NaWHotn4kf7cHLhqfW5 8twUjpDPSa9J5WCERMB77nomDcVelzyE5lVNR+YPy1FCLmXpqlQCs9F4tjqhGexiw9gtS/ DCBgtaHbK/jesohHwiHXPaTpkA1bZaY= Date: Tue, 30 Apr 2024 20:24:01 +0800 MIME-Version: 1.0 Subject: Re: [PATCH v3] slub: Fixes freepointer encoding for single free Content-Language: en-US To: Vlastimil Babka , Nicolas Bouchinet , linux-mm@kvack.org, linux-kernel@vger.kernel.org Cc: Christoph Lameter , Pekka Enberg , David Rientjes , Joonsoo Kim , Andrew Morton , Roman Gushchin , Hyeonggon Yoo <42.hyeyoo@gmail.com> References: <1a2e8da7-6969-43ac-9e65-2361c93d107f@suse.cz> X-Report-Abuse: Please report any abuse attempt to abuse@migadu.com and include these headers. From: Chengming Zhou In-Reply-To: <1a2e8da7-6969-43ac-9e65-2361c93d107f@suse.cz> Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit X-Migadu-Flow: FLOW_OUT X-Stat-Signature: nuxhdwq9pj7ofnwe4x7z8pq8onfozure X-Rspamd-Queue-Id: 53E51C0028 X-Rspam-User: X-Rspamd-Server: rspam12 X-HE-Tag: 1714479874-524450 X-HE-Meta: U2FsdGVkX18xQmYNg1MAcX6fAyF2skC9x6a2oxsXslr+3CA9+y9ogKb4HoZf87LM1PtJFehabWSrU+uONlR78k/qbTG0Z2MbJQtN/WqBGHDZBjNTq/GngbD43CyJ+4h5Hu3XbYf7aFa2tiXkJn2NDNctO0VK05geUOtnL1dhAbpnXMqwuivtJ9c3vaKMDjem+rl9iwA2xkhk4bkFMbL/m/9/u1FT1GN5/p3y0BxPHqLQMU3XSjnxzl8ifILPZjeD2h6u+7Fl6RWc4hQjY/b19DPY2r7mnDNf6Fec2S8kYXxW40/YUQKDFNv4/UJHnwuZucQBquw3O91uDQwJ/sGnPxMlgrlZyW4WMhZGiGGhH4pbrdk9WJ3HErUkI8BTBK7Xf6zddPcMkkN+v234RFhEqQyiNvJ7o7hax0q5y6x6xDp3TFgHbjRY/jeLJj4iR4btN+hbDpNkLQrXxc8Don35X7UmQXKP4HeuBfQ46EUh9ZD8Xz3F/kSXBUF5RNoyl8XTAFm8XNJgPry5iRn9ylIKzer1Wo/Xyhe7ViV9ze+myvfMe0o3aJA2B3w5Hi5mwf6QguN8T+/sp8cL6dl6X9cHNU768mm+HpQEL/UMV4wBEgy6LbRaGMVMX0cvovi8QjVv/59XDBgbTz2S824XCkOwlTNrzCWzBJW6vsabj2tthg5M8tFlF8xnR/W8f2z80xfGrss5tskKZ1BxYbXWrmS2nik+vZaOOPVcdoV8jwzQ1lJYI8VK5ACohpnu+aENar61bMxDstqve4abIFlX+SeAisZpb6eB8dF/nUgSdujhfcN5wAaGkWkSzTJ93cbTHPO1kooJ2W2X8jFpqxHpCjErchpzJ6eX/bPGn9sUfXGd+wxbEGrzKfZOh8gQbm4ZDxtYCXb+bkBBVKpai/6F5AT62bttjQgs453Qmv1INGXM6tJZ/Pyn8QSnBmaQnPmXcywozkgrE5QTWw7APtA5Dli Pd/7p9nE N5ngZOUyKUNZ/aj8Sw7INDwPl1shGPIKimOU/LLazTFGV3urUVJ28IjC1cByNZHmNE/bL8yNWS3xRYVTHf1tHNrZDVbNirMKaP3YUIjKktfb9m69we87vuWs0Uace9rNvHV/sve22f1KaoX6+s5Mi8VdC7DRoQHa7IhkD X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: List-Subscribe: List-Unsubscribe: On 2024/4/30 19:58, Vlastimil Babka wrote: > On 4/30/24 1:34 PM, Nicolas Bouchinet wrote: >> From: Nicolas Bouchinet >> >> Commit 284f17ac13fe ("mm/slub: handle bulk and single object freeing >> separately") splits single and bulk object freeing in two functions >> slab_free() and slab_free_bulk() which leads slab_free() to call >> slab_free_hook() directly instead of slab_free_freelist_hook(). >> >> If `init_on_free` is set, slab_free_hook() zeroes the object. >> Afterward, if `slub_debug=F` and `CONFIG_SLAB_FREELIST_HARDENED` are >> set, the do_slab_free() slowpath executes freelist consistency >> checks and try to decode a zeroed freepointer which leads to a >> "Freepointer corrupt" detection in check_object(). >> >> During bulk free, slab_free_freelist_hook() isn't affected as it always >> sets it objects freepointer using set_freepointer() to maintain its >> reconstructed freelist after `init_on_free`. >> >> For single free, object's freepointer thus needs to be avoided when >> stored outside the object if `init_on_free` is set. The freepointer left >> as is, check_object() may later detect an invalid pointer value due to >> objects overflow. >> >> To reproduce, set `slub_debug=FU init_on_free=1 log_level=7` on the >> command line of a kernel build with `CONFIG_SLAB_FREELIST_HARDENED=y`. >> >> dmesg sample log: >> [ 10.708715] ============================================================================= >> [ 10.710323] BUG kmalloc-rnd-05-32 (Tainted: G B T ): Freepointer corrupt >> [ 10.712695] ----------------------------------------------------------------------------- >> [ 10.712695] >> [ 10.712695] Slab 0xffffd8bdc400d580 objects=32 used=4 fp=0xffff9d9a80356f80 flags=0x200000000000a00(workingset|slab|node=0|zone=2) >> [ 10.716698] Object 0xffff9d9a80356600 @offset=1536 fp=0x7ee4f480ce0ecd7c >> [ 10.716698] >> [ 10.716698] Bytes b4 ffff9d9a803565f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ >> [ 10.720703] Object ffff9d9a80356600: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ >> [ 10.720703] Object ffff9d9a80356610: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ >> [ 10.724696] Padding ffff9d9a8035666c: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ >> [ 10.724696] Padding ffff9d9a8035667c: 00 00 00 00 .... >> [ 10.724696] FIX kmalloc-rnd-05-32: Object at 0xffff9d9a80356600 not freed >> >> Co-developed-by: Chengming Zhou > > Chengming Zhou, could you provide your s-o-b please? Of course. Signed-off-by: Chengming Zhou > >> Signed-off-by: Nicolas Bouchinet > > Added to slab/for-6.9-rc7/fixes, thanks! Thanks!