[08/62] mm: Convert check_heap_object() to use struct slab

Message ID	20211004134650.4031813-9-willy@infradead.org (mailing list archive)
State	New
Headers	show Return-Path: <SRS0=Fowb=OY=kvack.org=owner-linux-mm@kernel.org> DMARC-Filter: OpenDMARC Filter v1.4.1 mail.kernel.org A7B036108F From: "Matthew Wilcox (Oracle)" <willy@infradead.org> To: linux-mm@kvack.org Cc: "Matthew Wilcox (Oracle)" <willy@infradead.org> Subject: [PATCH 08/62] mm: Convert check_heap_object() to use struct slab Date: Mon, 4 Oct 2021 14:45:56 +0100 Message-Id: <20211004134650.4031813-9-willy@infradead.org> In-Reply-To: <20211004134650.4031813-1-willy@infradead.org> References: <20211004134650.4031813-1-willy@infradead.org> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Sender: owner-linux-mm@kvack.org Precedence: bulk
Series	Separate struct slab from struct page \| expand [00/62] Separate struct slab from struct page [01/62] mm: Convert page_to_section() to pgflags_section() [02/62] mm: Add pgflags_nid() [03/62] mm: Split slab into its own type [04/62] mm: Add account_slab() and unaccount_slab() [05/62] mm: Convert virt_to_cache() to use struct slab [06/62] mm: Convert __ksize() to struct slab [07/62] mm: Use struct slab in kmem_obj_info() [08/62] mm: Convert check_heap_object() to use struct slab [09/62] mm/slub: Convert process_slab() to take a struct slab [10/62] mm/slub: Convert detached_freelist to use a struct slab [11/62] mm/slub: Convert kfree() to use a struct slab [12/62] mm/slub: Convert __slab_free() to take a struct slab [13/62] mm/slub: Convert new_slab() to return a struct slab [14/62] mm/slub: Convert early_kmem_cache_node_alloc() to use struct slab [15/62] mm/slub: Convert kmem_cache_cpu to struct slab [16/62] mm/slub: Convert show_slab_objects() to struct slab [17/62] mm/slub: Convert validate_slab() to take a struct slab [18/62] mm/slub: Convert count_partial() to struct slab [19/62] mm/slub: Convert bootstrap() to struct slab [20/62] mm/slub: Convert __kmem_cache_do_shrink() to struct slab [21/62] mm/slub: Convert free_partial() to use struct slab [22/62] mm/slub: Convert list_slab_objects() to take a struct slab [23/62] mm/slub: Convert slab_alloc_node() to use a struct slab [24/62] mm/slub: Convert get_freelist() to take a struct slab [25/62] mm/slub: Convert node_match() to take a struct slab [26/62] mm/slub: Convert slab flushing to struct slab [27/62] mm/slub: Convert __unfreeze_partials to take a struct slab [28/62] mm/slub: Convert deactivate_slab() to take a struct slab [29/62] mm/slub: Convert acquire_slab() to take a struct page [30/62] mm/slub: Convert partial slab management to struct slab [31/62] mm/slub: Convert slab freeing to struct slab [32/62] mm/slub: Convert shuffle_freelist to struct slab [33/62] mm/slub: Remove struct page argument to next_freelist_entry() [34/62] mm/slub: Remove struct page argument from setup_object() [35/62] mm/slub: Convert freelist_corrupted() to struct slab [36/62] mm/slub: Convert full slab management to struct slab [37/62] mm/slub: Convert free_consistency_checks() to take a struct slab [38/62] mm/slub: Convert alloc_debug_processing() to struct slab [39/62] mm/slub: Convert check_object() to struct slab [40/62] mm/slub: Convert on_freelist() to struct slab [41/62] mm/slub: Convert check_slab() to struct slab [42/62] mm/slub: Convert check_valid_pointer() to struct slab [43/62] mm/slub: Convert object_err() to take a struct slab [44/62] mm/slub: Convert print_trailer() to struct slab [45/62] mm/slub: Convert slab_err() to take a struct slab [46/62] mm/slub: Convert print_page_info() to print_slab_info() [47/62] mm/slub: Convert trace() to take a struct slab [48/62] mm/slub: Convert cmpxchg_double_slab to struct slab [49/62] mm/slub: Convert get_map() and __fill_map() to struct slab [50/62] mm/slub: Convert slab_lock() and slab_unlock() to struct slab [51/62] mm/slub: Convert setup_page_debug() to setup_slab_debug() [52/62] mm/slub: Convert pfmemalloc_match() to take a struct slab [53/62] mm/slub: Remove pfmemalloc_match_unsafe() [54/62] mm: Convert slab to use struct slab [55/62] mm: Convert slob to use struct slab [56/62] mm: Convert slub to use struct slab [57/62] memcg: Convert object cgroups from struct page to struct slab [58/62] mm/kasan: Convert to struct slab [59/62] zsmalloc: Stop using slab fields in struct page [60/62] bootmem: Use page->index instead of page->freelist [61/62] iommu: Use put_pages_list [62/62] mm: Remove slab from struct page

Message ID

20211004134650.4031813-9-willy@infradead.org (mailing list archive)

State

New

Headers

DMARC-Filter: OpenDMARC Filter v1.4.1 mail.kernel.org A7B036108F
From: "Matthew Wilcox (Oracle)" <willy@infradead.org>
To: linux-mm@kvack.org
Cc: "Matthew Wilcox (Oracle)" <willy@infradead.org>
Subject: [PATCH 08/62] mm: Convert check_heap_object() to use struct slab
Date: Mon,  4 Oct 2021 14:45:56 +0100
Message-Id: <20211004134650.4031813-9-willy@infradead.org>
In-Reply-To: <20211004134650.4031813-1-willy@infradead.org>
References: <20211004134650.4031813-1-willy@infradead.org>
MIME-Version: 1.0
Content-Transfer-Encoding: quoted-printable
Sender: owner-linux-mm@kvack.org
Precedence: bulk

Series

Separate struct slab from struct page | expand

Commit Message

Matthew Wilcox (Oracle) Oct. 4, 2021, 1:45 p.m. UTC

Ensure that we're not seeing a tail page inside __check_heap_object()
by converting to a slab instead of a page.  Take the opportunity to
mark the slab as const since we're not modifying it.  Also move the
declaration of __check_heap_object() to mm/slab.h so it's not
available to the wider kernel.

Signed-off-by: Matthew Wilcox (Oracle) <willy@infradead.org>
---
 include/linux/slab.h |  8 --------
 mm/slab.c            | 14 +++++++-------
 mm/slab.h            |  9 +++++++++
 mm/slub.c            | 10 +++++-----
 mm/usercopy.c        | 13 +++++++------
 5 files changed, 28 insertions(+), 26 deletions(-)

diff --git a/include/linux/slab.h b/include/linux/slab.h
index 083f3ce550bc..830051d4af58 100644
--- a/include/linux/slab.h
+++ b/include/linux/slab.h
@@ -191,14 +191,6 @@  bool kmem_valid_obj(void *object);
 void kmem_dump_obj(void *object);
 #endif
 
-#ifdef CONFIG_HAVE_HARDENED_USERCOPY_ALLOCATOR
-void __check_heap_object(const void *ptr, unsigned long n, struct page *page,
-			bool to_user);
-#else
-static inline void __check_heap_object(const void *ptr, unsigned long n,
-				       struct page *page, bool to_user) { }
-#endif
-
 /*
  * Some archs want to perform DMA into kmalloc caches and need a guaranteed
  * alignment larger than the alignment of a 64-bit integer.
diff --git a/mm/slab.c b/mm/slab.c
index 4a6bdbdcf0db..0d515fd697a0 100644
--- a/mm/slab.c
+++ b/mm/slab.c
@@ -372,8 +372,8 @@  static void **dbg_userword(struct kmem_cache *cachep, void *objp)
 static int slab_max_order = SLAB_MAX_ORDER_LO;
 static bool slab_max_order_set __initdata;
 
-static inline void *index_to_obj(struct kmem_cache *cache, struct page *page,
-				 unsigned int idx)
+static inline void *index_to_obj(struct kmem_cache *cache,
+				 const struct page *page, unsigned int idx)
 {
 	return page->s_mem + cache->size * idx;
 }
@@ -4181,8 +4181,8 @@  ssize_t slabinfo_write(struct file *file, const char __user *buffer,
  * Returns NULL if check passes, otherwise const char * to name of cache
  * to indicate an error.
  */
-void __check_heap_object(const void *ptr, unsigned long n, struct page *page,
-			 bool to_user)
+void __check_heap_object(const void *ptr, unsigned long n,
+			 const struct slab *slab, bool to_user)
 {
 	struct kmem_cache *cachep;
 	unsigned int objnr;
@@ -4191,15 +4191,15 @@  void __check_heap_object(const void *ptr, unsigned long n, struct page *page,
 	ptr = kasan_reset_tag(ptr);
 
 	/* Find and validate object. */
-	cachep = page->slab_cache;
-	objnr = obj_to_index(cachep, page, (void *)ptr);
+	cachep = slab->slab_cache;
+	objnr = obj_to_index(cachep, slab_page(slab), (void *)ptr);
 	BUG_ON(objnr >= cachep->num);
 
 	/* Find offset within object. */
 	if (is_kfence_address(ptr))
 		offset = ptr - kfence_object_start(ptr);
 	else
-		offset = ptr - index_to_obj(cachep, page, objnr) - obj_offset(cachep);
+		offset = ptr - index_to_obj(cachep, slab_page(slab), objnr) - obj_offset(cachep);
 
 	/* Allow address range falling entirely within usercopy region. */
 	if (offset >= cachep->useroffset &&
diff --git a/mm/slab.h b/mm/slab.h
index 29a0bf827a82..53fe3a746973 100644
--- a/mm/slab.h
+++ b/mm/slab.h
@@ -731,4 +731,13 @@  struct kmem_obj_info {
 void kmem_obj_info(struct kmem_obj_info *kpp, void *object, struct slab *slab);
 #endif
 
+#ifdef CONFIG_HAVE_HARDENED_USERCOPY_ALLOCATOR
+void __check_heap_object(const void *ptr, unsigned long n,
+			 const struct slab *slab, bool to_user);
+#else
+static inline
+void __check_heap_object(const void *ptr, unsigned long n,
+			 const struct slab *slab, bool to_user) { }
+#endif
+
 #endif /* MM_SLAB_H */
diff --git a/mm/slub.c b/mm/slub.c
index 517450561840..b34ca1ff3e1c 100644
--- a/mm/slub.c
+++ b/mm/slub.c
@@ -4452,8 +4452,8 @@  EXPORT_SYMBOL(__kmalloc_node);
  * Returns NULL if check passes, otherwise const char * to name of cache
  * to indicate an error.
  */
-void __check_heap_object(const void *ptr, unsigned long n, struct page *page,
-			 bool to_user)
+void __check_heap_object(const void *ptr, unsigned long n,
+			 const struct slab *slab, bool to_user)
 {
 	struct kmem_cache *s;
 	unsigned int offset;
@@ -4463,10 +4463,10 @@  void __check_heap_object(const void *ptr, unsigned long n, struct page *page,
 	ptr = kasan_reset_tag(ptr);
 
 	/* Find object and usable object size. */
-	s = page->slab_cache;
+	s = slab->slab_cache;
 
 	/* Reject impossible pointers. */
-	if (ptr < page_address(page))
+	if (ptr < slab_address(slab))
 		usercopy_abort("SLUB object not in SLUB page?!", NULL,
 			       to_user, 0, n);
 
@@ -4474,7 +4474,7 @@  void __check_heap_object(const void *ptr, unsigned long n, struct page *page,
 	if (is_kfence)
 		offset = ptr - kfence_object_start(ptr);
 	else
-		offset = (ptr - page_address(page)) % s->size;
+		offset = (ptr - slab_address(slab)) % s->size;
 
 	/* Adjust for redzone and reject if within the redzone. */
 	if (!is_kfence && kmem_cache_debug_flags(s, SLAB_RED_ZONE)) {
diff --git a/mm/usercopy.c b/mm/usercopy.c
index b3de3c4eefba..07e86a360d49 100644
--- a/mm/usercopy.c
+++ b/mm/usercopy.c
@@ -20,6 +20,7 @@ 
 #include <linux/atomic.h>
 #include <linux/jump_label.h>
 #include <asm/sections.h>
+#include "slab.h"
 
 /*
  * Checks if a given pointer and length is contained by the current
@@ -223,7 +224,7 @@  static inline void check_page_span(const void *ptr, unsigned long n,
 static inline void check_heap_object(const void *ptr, unsigned long n,
 				     bool to_user)
 {
-	struct page *page;
+	struct slab *slab;
 
 	if (!virt_addr_valid(ptr))
 		return;
@@ -231,16 +232,16 @@  static inline void check_heap_object(const void *ptr, unsigned long n,
 	/*
 	 * When CONFIG_HIGHMEM=y, kmap_to_page() will give either the
 	 * highmem page or fallback to virt_to_page(). The following
-	 * is effectively a highmem-aware virt_to_head_page().
+	 * is effectively a highmem-aware virt_to_slab().
 	 */
-	page = compound_head(kmap_to_page((void *)ptr));
+	slab = page_slab(kmap_to_page((void *)ptr));
 
-	if (PageSlab(page)) {
+	if (slab_test_cache(slab)) {
 		/* Check slab allocator for flags and size. */
-		__check_heap_object(ptr, n, page, to_user);
+		__check_heap_object(ptr, n, slab, to_user);
 	} else {
 		/* Verify object does not incorrectly span multiple pages. */
-		check_page_span(ptr, n, page, to_user);
+		check_page_span(ptr, n, slab_page(slab), to_user);
 	}
 }

[08/62] mm: Convert check_heap_object() to use struct slab

Commit Message

Patch