From patchwork Fri Nov 3 21:27:24 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: andrey.konovalov@linux.dev X-Patchwork-Id: 13445149 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id A532AC4332F for ; Fri, 3 Nov 2023 21:27:38 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id 28275440009; Fri, 3 Nov 2023 17:27:38 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id 232488D000C; Fri, 3 Nov 2023 17:27:38 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 0FADC440009; Fri, 3 Nov 2023 17:27:38 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0012.hostedemail.com [216.40.44.12]) by kanga.kvack.org (Postfix) with ESMTP id F11948D000C for ; Fri, 3 Nov 2023 17:27:37 -0400 (EDT) Received: from smtpin30.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay08.hostedemail.com (Postfix) with ESMTP id BD651140985 for ; Fri, 3 Nov 2023 21:27:37 +0000 (UTC) X-FDA: 81417929754.30.E16AB36 Received: from out-187.mta0.migadu.com (out-187.mta0.migadu.com [91.218.175.187]) by imf04.hostedemail.com (Postfix) with ESMTP id 5332C40021 for ; Fri, 3 Nov 2023 21:27:35 +0000 (UTC) Authentication-Results: imf04.hostedemail.com; dkim=pass header.d=linux.dev header.s=key1 header.b=BnwK0S60; spf=pass (imf04.hostedemail.com: domain of andrey.konovalov@linux.dev designates 91.218.175.187 as permitted sender) smtp.mailfrom=andrey.konovalov@linux.dev; dmarc=pass (policy=none) header.from=linux.dev ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1699046855; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-transfer-encoding:content-transfer-encoding: in-reply-to:references:dkim-signature; bh=zpQnTcl7Ae4p19CvIz4jyFHYTSPPJ5pSlBVfY1JSDUg=; b=Xc0Ufn8eBWXJ2jRH2nkQQF3Pk07sxMUEOI/T8A4ytWIJHGB68ed765ybq6Cb5w5PvxQrY4 yOPCOibwrPBGATaXD3km9IsBwAzsZELcZUJVxdDH/eQCY6iJ/SAwm+cQA/x6JQWnutBZLE r3a98uu3DqX629Y2v0drHcKlLK+1KeE= ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1699046855; a=rsa-sha256; cv=none; b=XVskn+XygIzY4AisrPQ2ZOvxPT3dq4WlqV7YKyFSRBM8WJp02app/R0b0/OeYdh3P6+RJt rl4xQMt4ngSNKEJPqqdY39/9AJujulybJ4qBV2OueWAvIknLnURA/HNXMrVkzRwzq0cFyJ MF+vY6iKLFsKOTiBHiM4dAOGsRbrSJc= ARC-Authentication-Results: i=1; imf04.hostedemail.com; dkim=pass header.d=linux.dev header.s=key1 header.b=BnwK0S60; spf=pass (imf04.hostedemail.com: domain of andrey.konovalov@linux.dev designates 91.218.175.187 as permitted sender) smtp.mailfrom=andrey.konovalov@linux.dev; dmarc=pass (policy=none) header.from=linux.dev X-Report-Abuse: Please report any abuse attempt to abuse@migadu.com and include these headers. DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linux.dev; s=key1; t=1699046853; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding; bh=zpQnTcl7Ae4p19CvIz4jyFHYTSPPJ5pSlBVfY1JSDUg=; b=BnwK0S60JRrsVWr+cmIREF7pb4JxrxbsQ+R4787GTvjcIJovfamM82hiVkYf/aGu7kNq5Z Aj4GH4B0DwaQ/o+pZQHhB21xgoGyMW4cHfU/EDVJKkJ2yLXx7/4NOXE+5KCW/hnNzfGNrP Id9WHUChlyFrX/7yZ5HFEmiahbxQjEk= From: andrey.konovalov@linux.dev To: Marco Elver , Alexander Potapenko Cc: Andrey Konovalov , Dmitry Vyukov , Vlastimil Babka , kasan-dev@googlegroups.com, Evgenii Stepanov , Oscar Salvador , Andrew Morton , linux-mm@kvack.org, linux-kernel@vger.kernel.org, Andrey Konovalov Subject: [PATCH RFC] kasan: use stack_depot_put for Generic mode Date: Fri, 3 Nov 2023 22:27:24 +0100 Message-Id: <20231103212724.134597-1-andrey.konovalov@linux.dev> MIME-Version: 1.0 X-Migadu-Flow: FLOW_OUT X-Rspamd-Queue-Id: 5332C40021 X-Rspam-User: X-Rspamd-Server: rspam11 X-Stat-Signature: r5r3m8kdtxc4wepq1r5emfiaozipsak5 X-HE-Tag: 1699046855-428277 X-HE-Meta: U2FsdGVkX19kNy/A0tmDRFLkrJa2w94GR4Bo+Ms83jTzgrWIGVywt5wK/anDiiehwQYDVuVWLNf7vxuhdM3kN6TXB8uHLyAw8BCU5tVI/KSxYtRaOwuNLMn6d59RB+iAhF1hTKKMg2VfB7d1id3y+TsdaeJmT021VqDuKMbcUKOcNOxZxdNMzm88MUbgPj0Vqaf8bzCaKUCklolXE1LcC1NWMNM9BTcXSlN10MpBpsWLJWURL0XtFlnLXFhF9YElQ0fRR9IV5ymr5YI7dCzOMEkj64yfF/8eiVKVooRurNRS8gPYenB9IGtaJ5GNYHmEaESJn4JTVP/93ytOL5MMfdLVi1VeDnV4vAnM8uuiIi8VKmoPfBbjbxqMJVCaOpxe4lF6XeJdh6OctBC4n8drdx3v0eZIPEF9Q380cGYxI8yyg8zeEKWQS7tOo66effQ/a6adkUhRWROFLvojcfnHOfexTJdEBNE3MyvlEesah/P6CCP3xpBD//wCzrExeDaZTfk1D3dohrPKMnDvUXzdlOJt/5TugxfkGBFGoNI3xJshFBQn1VxCBAl9YNFs8LqM9vspITwEIoE+1oGVX3o10a4T2V3DSxRR0o6JvUhJbqiSA7OrzHa8bJkpXZXGmODkAMoRXjnPmQ00VKTkmhOIIIYl32iVZkL6+1B2KWSbnOqGHY+wVXyq8lo7xMR8TYDlokZKvllqZ2GajXbDnelG5goADAqAkDvM37uczlf+eZIfsl4mXzLwfTbn/1xNtcwi2axzKi+lxljwI0dY0Kbp6sCydOznVZ99mHK+PQkKQPWU3DM92lqWoTZBHgXfyGBkWNOtrVoq15D2EBbjhDe9S+6mzqrxrdDJPrBirp2l9uw2O+DypA+d+Dh0d1yjQZRzIfeNRfHZkmmFTjcZLxTZL6nR8LiAxDGp9crIuJCvmN1h+Ad4HDY3Ossy4l+sy/e78zOzUegmFQcDcYdVZFT DZwKAoZK ZysMyKTUCB/pQ+M68lh3A8KIqBAjTTtNTbrDJOKa2M+XkfbqLg+BL4yUq6GiBOyj5odeNLpng9E1YTNr1Sm2B2ZVoX4SzLsyyf8wSGH9ufdAKzU6jGVmQGi9KdKb5K+p9dTj9823FYy25qJY= X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: List-Subscribe: List-Unsubscribe: From: Andrey Konovalov Evict alloc/free stack traces from the stack depot for Generic KASAN once they are evicted from the quaratine. For auxiliary stack traces, evict the oldest stack trace once a new one is saved (KASAN only keeps references to the last two). Also evict all save stack traces on krealloc. To avoid double-evicting and mis-evicting stack traces (in case KASAN's metadata was corrupted), reset KASAN's per-object metadata that stores stack depot handles when the object is initialized and when it's evicted from the quarantine. Note that stack_depot_put is no-op of the handle is 0. Signed-off-by: Andrey Konovalov Reviewed-by: Marco Elver --- This goes on top of the "stackdepot: allow evicting stack traces" series. I'll mail the patches all together after the merge window. --- mm/kasan/common.c | 3 ++- mm/kasan/generic.c | 22 ++++++++++++++++++---- mm/kasan/quarantine.c | 26 ++++++++++++++++++++------ 3 files changed, 40 insertions(+), 11 deletions(-) diff --git a/mm/kasan/common.c b/mm/kasan/common.c index 825a0240ec02..b5d8bd26fced 100644 --- a/mm/kasan/common.c +++ b/mm/kasan/common.c @@ -50,7 +50,8 @@ depot_stack_handle_t kasan_save_stack(gfp_t flags, depot_flags_t depot_flags) void kasan_set_track(struct kasan_track *track, gfp_t flags) { track->pid = current->pid; - track->stack = kasan_save_stack(flags, STACK_DEPOT_FLAG_CAN_ALLOC); + track->stack = kasan_save_stack(flags, + STACK_DEPOT_FLAG_CAN_ALLOC | STACK_DEPOT_FLAG_GET); } #if defined(CONFIG_KASAN_GENERIC) || defined(CONFIG_KASAN_SW_TAGS) diff --git a/mm/kasan/generic.c b/mm/kasan/generic.c index 5d168c9afb32..50cc519e23f4 100644 --- a/mm/kasan/generic.c +++ b/mm/kasan/generic.c @@ -449,10 +449,14 @@ struct kasan_free_meta *kasan_get_free_meta(struct kmem_cache *cache, void kasan_init_object_meta(struct kmem_cache *cache, const void *object) { struct kasan_alloc_meta *alloc_meta; + struct kasan_free_meta *free_meta; alloc_meta = kasan_get_alloc_meta(cache, object); if (alloc_meta) __memset(alloc_meta, 0, sizeof(*alloc_meta)); + free_meta = kasan_get_free_meta(cache, object); + if (free_meta) + __memset(free_meta, 0, sizeof(*free_meta)); } size_t kasan_metadata_size(struct kmem_cache *cache, bool in_object) @@ -489,18 +493,20 @@ static void __kasan_record_aux_stack(void *addr, depot_flags_t depot_flags) if (!alloc_meta) return; + stack_depot_put(alloc_meta->aux_stack[1]); alloc_meta->aux_stack[1] = alloc_meta->aux_stack[0]; alloc_meta->aux_stack[0] = kasan_save_stack(0, depot_flags); } void kasan_record_aux_stack(void *addr) { - return __kasan_record_aux_stack(addr, STACK_DEPOT_FLAG_CAN_ALLOC); + return __kasan_record_aux_stack(addr, + STACK_DEPOT_FLAG_CAN_ALLOC | STACK_DEPOT_FLAG_GET); } void kasan_record_aux_stack_noalloc(void *addr) { - return __kasan_record_aux_stack(addr, 0); + return __kasan_record_aux_stack(addr, STACK_DEPOT_FLAG_GET); } void kasan_save_alloc_info(struct kmem_cache *cache, void *object, gfp_t flags) @@ -508,8 +514,16 @@ void kasan_save_alloc_info(struct kmem_cache *cache, void *object, gfp_t flags) struct kasan_alloc_meta *alloc_meta; alloc_meta = kasan_get_alloc_meta(cache, object); - if (alloc_meta) - kasan_set_track(&alloc_meta->alloc_track, flags); + if (!alloc_meta) + return; + + /* Evict previous stack traces (might exist for krealloc). */ + stack_depot_put(alloc_meta->alloc_track.stack); + stack_depot_put(alloc_meta->aux_stack[0]); + stack_depot_put(alloc_meta->aux_stack[1]); + __memset(alloc_meta, 0, sizeof(*alloc_meta)); + + kasan_set_track(&alloc_meta->alloc_track, flags); } void kasan_save_free_info(struct kmem_cache *cache, void *object) diff --git a/mm/kasan/quarantine.c b/mm/kasan/quarantine.c index 152dca73f398..37fb0e3f5876 100644 --- a/mm/kasan/quarantine.c +++ b/mm/kasan/quarantine.c @@ -141,11 +141,22 @@ static void *qlink_to_object(struct qlist_node *qlink, struct kmem_cache *cache) static void qlink_free(struct qlist_node *qlink, struct kmem_cache *cache) { void *object = qlink_to_object(qlink, cache); - struct kasan_free_meta *meta = kasan_get_free_meta(cache, object); + struct kasan_alloc_meta *alloc_meta = kasan_get_alloc_meta(cache, object); + struct kasan_free_meta *free_meta = kasan_get_free_meta(cache, object); unsigned long flags; - if (IS_ENABLED(CONFIG_SLAB)) - local_irq_save(flags); + if (alloc_meta) { + stack_depot_put(alloc_meta->alloc_track.stack); + stack_depot_put(alloc_meta->aux_stack[0]); + stack_depot_put(alloc_meta->aux_stack[1]); + __memset(alloc_meta, 0, sizeof(*alloc_meta)); + } + + if (free_meta && + *(u8 *)kasan_mem_to_shadow(object) == KASAN_SLAB_FREETRACK) { + stack_depot_put(free_meta->free_track.stack); + free_meta->free_track.stack = 0; + } /* * If init_on_free is enabled and KASAN's free metadata is stored in @@ -155,14 +166,17 @@ static void qlink_free(struct qlist_node *qlink, struct kmem_cache *cache) */ if (slab_want_init_on_free(cache) && cache->kasan_info.free_meta_offset == 0) - memzero_explicit(meta, sizeof(*meta)); + memzero_explicit(free_meta, sizeof(*free_meta)); /* - * As the object now gets freed from the quarantine, assume that its - * free track is no longer valid. + * As the object now gets freed from the quarantine, + * take note that its free track is no longer exists. */ *(u8 *)kasan_mem_to_shadow(object) = KASAN_SLAB_FREE; + if (IS_ENABLED(CONFIG_SLAB)) + local_irq_save(flags); + ___cache_free(cache, object, _THIS_IP_); if (IS_ENABLED(CONFIG_SLAB))