From patchwork Tue Jul 11 13:46:24 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Vlastimil Babka X-Patchwork-Id: 13308762 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id 672EBEB64DC for ; Tue, 11 Jul 2023 13:46:40 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id DC5806B0071; Tue, 11 Jul 2023 09:46:39 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id D4EA36B0074; Tue, 11 Jul 2023 09:46:39 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id BEEFD6B0075; Tue, 11 Jul 2023 09:46:39 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0014.hostedemail.com [216.40.44.14]) by kanga.kvack.org (Postfix) with ESMTP id AA65C6B0071 for ; Tue, 11 Jul 2023 09:46:39 -0400 (EDT) Received: from smtpin01.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay06.hostedemail.com (Postfix) with ESMTP id 52C9DB000D for ; Tue, 11 Jul 2023 13:46:39 +0000 (UTC) X-FDA: 80999456118.01.1438F9C Received: from smtp-out2.suse.de (smtp-out2.suse.de [195.135.220.29]) by imf21.hostedemail.com (Postfix) with ESMTP id DF3351C0020 for ; Tue, 11 Jul 2023 13:46:36 +0000 (UTC) Authentication-Results: imf21.hostedemail.com; dkim=pass header.d=suse.cz header.s=susede2_rsa header.b=DVO93ktx; dkim=pass header.d=suse.cz header.s=susede2_ed25519 header.b=EJTlIqxl; spf=pass (imf21.hostedemail.com: domain of vbabka@suse.cz designates 195.135.220.29 as permitted sender) smtp.mailfrom=vbabka@suse.cz; dmarc=none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1689083197; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-transfer-encoding:content-transfer-encoding: in-reply-to:references:dkim-signature; bh=RXHIYdVmdQJX5tnkNjy37yeBssRnaU5MoOmNGkfF484=; b=0XEYvDtAhpxNHH+UER9pohfR9KWZQT1PglHF52ru8MytvCfy1OilEPoh2kqJNzO2ZW74re hD//B/WqYnomQ6VZD9xYjUxzoKkvf+paV4UAr3ugfUF3xYFCCD00kdeTbwmoZZLR5GxZqv SMNMFGLzah/KEYU2/yK/LoXbyGxsP4k= ARC-Authentication-Results: i=1; imf21.hostedemail.com; dkim=pass header.d=suse.cz header.s=susede2_rsa header.b=DVO93ktx; dkim=pass header.d=suse.cz header.s=susede2_ed25519 header.b=EJTlIqxl; spf=pass (imf21.hostedemail.com: domain of vbabka@suse.cz designates 195.135.220.29 as permitted sender) smtp.mailfrom=vbabka@suse.cz; dmarc=none ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1689083197; a=rsa-sha256; cv=none; b=trW9ZpSCWvZbOL9kEXDg2lY25H/PPg+fflqd4MXWZVcOBHBmXaPCmuhnbOH1Bv+VwNm4fG tM20nnv3DCaOzY77l4VQy0U2teQSJQQtQIJUBesjEoPCGbO3wyPCFY6KB1MU8X6ksOLJOL YtOBr+f25iadKF6fuS66NienKRCMlfE= Received: from imap2.suse-dmz.suse.de (imap2.suse-dmz.suse.de [192.168.254.74]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-521) server-digest SHA512) (No client certificate requested) by smtp-out2.suse.de (Postfix) with ESMTPS id 0FF911FDA0; Tue, 11 Jul 2023 13:46:35 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=suse.cz; s=susede2_rsa; t=1689083195; h=from:from:reply-to:date:date:message-id:message-id:to:to:cc:cc: mime-version:mime-version: content-transfer-encoding:content-transfer-encoding; bh=RXHIYdVmdQJX5tnkNjy37yeBssRnaU5MoOmNGkfF484=; b=DVO93ktxjFk3VzkffNtwh1rU0QfweANLsy9oVYvFPGIeNVcpRdrrIpFNYcej2rYKY7sNDM bKjN4dQau8CtiYI7D6FON8xDb/M5h8wTke2ei4xM5jMAt+o+bwDX12JNsoetppguRUTmiI 3TOWlE4qXwwHHyr5h/3JYzS4DmEamL4= DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/relaxed; d=suse.cz; s=susede2_ed25519; t=1689083195; h=from:from:reply-to:date:date:message-id:message-id:to:to:cc:cc: mime-version:mime-version: content-transfer-encoding:content-transfer-encoding; bh=RXHIYdVmdQJX5tnkNjy37yeBssRnaU5MoOmNGkfF484=; b=EJTlIqxlmAlFa+9Nk7qpsjsA6kWKHmE0gNx/pb6blh/Evb+jPLWa82Nz2lgRY5oF1+D5vB AEpWeIfOau7q79BA== Received: from imap2.suse-dmz.suse.de (imap2.suse-dmz.suse.de [192.168.254.74]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-521) server-digest SHA512) (No client certificate requested) by imap2.suse-dmz.suse.de (Postfix) with ESMTPS id C1D2D1390F; Tue, 11 Jul 2023 13:46:34 +0000 (UTC) Received: from dovecot-director2.suse.de ([192.168.254.65]) by imap2.suse-dmz.suse.de with ESMTPSA id NXqMLjpdrWTSYwAAMHmgww (envelope-from ); Tue, 11 Jul 2023 13:46:34 +0000 From: Vlastimil Babka To: Christoph Lameter , David Rientjes , Pekka Enberg , Joonsoo Kim Cc: Hyeonggon Yoo <42.hyeyoo@gmail.com>, Roman Gushchin , linux-mm@kvack.org, patches@lists.linux.dev, linux-kernel@vger.kernel.org, Matteo Rizzo , Jann Horn , Andrey Konovalov , Marco Elver , Alexander Potapenko , kasan-dev@googlegroups.com, Kees Cook , linux-hardening@vger.kernel.org, Vlastimil Babka Subject: [PATCH 1/2] mm/slub: remove redundant kasan_reset_tag() from freelist_ptr calculations Date: Tue, 11 Jul 2023 15:46:24 +0200 Message-ID: <20230711134623.12695-3-vbabka@suse.cz> X-Mailer: git-send-email 2.41.0 MIME-Version: 1.0 X-Rspamd-Queue-Id: DF3351C0020 X-Rspam-User: X-Stat-Signature: pw6rzxwgbymxxz6c53wcspr9dsz4xexw X-Rspamd-Server: rspam01 X-HE-Tag: 1689083196-285353 X-HE-Meta: U2FsdGVkX1/cJ9ysx5HvYsPPA4zZriFwIMQQzQ8lVYPR0EcGSVe7JOCGRgDSS4XSyMSinYRYe3ruTmpSYXrvHDSURiqbASb4IubYGpN4BCq0zXl8uovtkjYbljAJtBfgHHyh+J6shEbqKK+UI3EG6FpBcUMNU2kTHTTA9Jivk1/IARQN3GdItnP9S8cea48j5jMfpc+WM0JjNB2AgDkQjnyWdlPG2pwS5Ks0e5csaNZy0PSk2AXGuonpejbUfzEazzg0SDxnZVaQG4j9x69nClMiDfilPrEFqsSqT0U9eeC2Rnl+m3ZpjU5rl9mxz9pIVIJb5Z5IzLAAlWHEZixJ19vziPMKKaPXAy1GOuJU9VD4mmsi9yPjZM1jJPNrjNK8q1tXF36eWud7dDa5XoGviTFkVrggvDKCi+KgXfTM+P1ctef7R+30GzpeclC3eiEttzCeSgzNkQ5SPv6sMexTs4EW7LN6LLjwtzzyxEaAhzZA37pg0qTvwY4ae42TTPCKmOtOVuoc5t175Cty9txXqihgijLrat0EKsuVyjq1wl5pDosj2dUuBScfwVU1jAxHlE2Nj4a9NE7Ck5TzblnyEu4BW4vpsqAdPk6fwZZbRd3+jOYy9NyQoO+ODX/D5e97oXdKL5upUUvK6gi/fRkPImwCWuppt+sta11kgErjrRIRLmKUoCvfwEn8mSv7OyyfUXydh3I7oy5yQ5kRtIuJq9KS0kWLKCyktgnJiQqP+AgBSWcS8pgN/QG29P17ncl1TFzudzsiNvVheKUb6QIgTHNzjtUWiBdi5LdYL9RhPLW2GbypH0jDAPvG+81wB3oDFqBuOoXPn3g5bOZgnP/NPxrrV9eICvSfArD4p/IjzmlCGn9/byOO2gIKZa5eeBz0Kbk9jB/KwKgECUcoEYjoKNCUvGwG+jcH0Rcc8/nPbDh+x+2+8ndTvp1OLnhiZZCvLErAiA/s2decA6Cneu0 9ilZC5dm obQsQGOfQkFplQc5U1MeT6YrbhfKzXg/Cwebz7HwihHih9AD69w5yYDHoi5KatnJNw8G2zPaYwL7QYNCQZPsjaYqsAkCV6E/NTPuanRxMIG2b5f2bBVWdGW3mXEwKeP3w25qh1AqQqmLD+uff5pbVhcCXttZyqHz1UgrtjMVXSMWMmkT1TqB7dhtr8WKpUCehUCD1HGSaxANTQPxW5bwmPxl5TaAZQm6R15q0RsdfjiFFwS9e30hG/7lNtlxlAl+KztqJ/F95LJdXWBJCULr6UWZNljh0wEz2zSkjr9Aq5LiHP+Op6Vn7+hJTgwhH95OU9D9Dspex0Iz2J2YpPMKvltAZEgCdPCDXtrOXvdBs3TsLzhUrZVgtAOvflKDa+PT7ixwP65dkhDAGL/U= X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: Commit d36a63a943e3 ("kasan, slub: fix more conflicts with CONFIG_SLAB_FREELIST_HARDENED") has introduced kasan_reset_tags() to freelist_ptr() encoding/decoding when CONFIG_SLAB_FREELIST_HARDENED is enabled to resolve issues when passing tagged or untagged pointers inconsistently would lead to incorrect calculations. Later, commit aa1ef4d7b3f6 ("kasan, mm: reset tags when accessing metadata") made sure all pointers have tags reset regardless of CONFIG_SLAB_FREELIST_HARDENED, because there was no other way to access the freepointer metadata safely with hw tag-based KASAN. Therefore the kasan_reset_tag() usage in freelist_ptr_encode()/decode() is now redundant, as all callers use kasan_reset_tag() unconditionally when constructing ptr_addr. Remove the redundant calls and simplify the code and remove obsolete comments. Also in freelist_ptr_encode() introduce an 'encoded' variable to make the lines shorter and make it similar to the _decode() one. Signed-off-by: Vlastimil Babka Acked-by: Kees Cook Reviewed-by: Andrey Konovalov --- These 2 patches build on top of: https://lore.kernel.org/all/20230704135834.3884421-1-matteorizzo@google.com/ mm/slub.c | 22 ++++++---------------- 1 file changed, 6 insertions(+), 16 deletions(-) diff --git a/mm/slub.c b/mm/slub.c index f8cc47eff742..07edad305512 100644 --- a/mm/slub.c +++ b/mm/slub.c @@ -374,22 +374,14 @@ typedef struct { unsigned long v; } freeptr_t; static inline freeptr_t freelist_ptr_encode(const struct kmem_cache *s, void *ptr, unsigned long ptr_addr) { + unsigned long encoded; + #ifdef CONFIG_SLAB_FREELIST_HARDENED - /* - * When CONFIG_KASAN_SW/HW_TAGS is enabled, ptr_addr might be tagged. - * Normally, this doesn't cause any issues, as both set_freepointer() - * and get_freepointer() are called with a pointer with the same tag. - * However, there are some issues with CONFIG_SLUB_DEBUG code. For - * example, when __free_slub() iterates over objects in a cache, it - * passes untagged pointers to check_object(). check_object() in turns - * calls get_freepointer() with an untagged pointer, which causes the - * freepointer to be restored incorrectly. - */ - return (freeptr_t){.v = (unsigned long)ptr ^ s->random ^ - swab((unsigned long)kasan_reset_tag((void *)ptr_addr))}; + encoded = (unsigned long)ptr ^ s->random ^ swab(ptr_addr); #else - return (freeptr_t){.v = (unsigned long)ptr}; + encoded = (unsigned long)ptr; #endif + return (freeptr_t){.v = encoded}; } static inline void *freelist_ptr_decode(const struct kmem_cache *s, @@ -398,9 +390,7 @@ static inline void *freelist_ptr_decode(const struct kmem_cache *s, void *decoded; #ifdef CONFIG_SLAB_FREELIST_HARDENED - /* See the comment in freelist_ptr_encode */ - decoded = (void *)(ptr.v ^ s->random ^ - swab((unsigned long)kasan_reset_tag((void *)ptr_addr))); + decoded = (void *)(ptr.v ^ s->random ^ swab(ptr_addr)); #else decoded = (void *)ptr.v; #endif