From patchwork Mon Dec 20 16:37:04 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: andrey.konovalov@linux.dev X-Patchwork-Id: 12688223 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id A6BD0C433EF for ; Mon, 20 Dec 2021 16:37:17 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id 9AA7C6B0071; Mon, 20 Dec 2021 11:37:16 -0500 (EST) Received: by kanga.kvack.org (Postfix, from userid 40) id 95A5F6B0073; Mon, 20 Dec 2021 11:37:16 -0500 (EST) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 822926B0074; Mon, 20 Dec 2021 11:37:16 -0500 (EST) X-Delivered-To: linux-mm@kvack.org Received: from forelay.hostedemail.com (smtprelay0162.hostedemail.com [216.40.44.162]) by kanga.kvack.org (Postfix) with ESMTP id 6BFB06B0071 for ; Mon, 20 Dec 2021 11:37:16 -0500 (EST) Received: from smtpin12.hostedemail.com (10.5.19.251.rfc1918.com [10.5.19.251]) by forelay03.hostedemail.com (Postfix) with ESMTP id 1885D82499B9 for ; Mon, 20 Dec 2021 16:37:16 +0000 (UTC) X-FDA: 78938727672.12.0E6336D Received: from out2.migadu.com (out2.migadu.com [188.165.223.204]) by imf20.hostedemail.com (Postfix) with ESMTP id 99F4C1C0047 for ; Mon, 20 Dec 2021 16:37:11 +0000 (UTC) X-Report-Abuse: Please report any abuse attempt to abuse@migadu.com and include these headers. DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linux.dev; s=key1; t=1640018233; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding; bh=beAzXMbqzjPx2jOpUAjr1xMuur29YHypIVsXOOXBjkk=; b=b5kkaieyVQ5TPtoVFBS7gaf3YjXAZsIURV0xUF+e9uTbzgNsCCXpVZCsZONkhUB6/dvGx/ Cxbpto3E7TREyWrZx51BSZCFvKALU11+TzdrHNSZ8oU5SfyFgKy1ZnZEfWLMO/88NaZGtS j04GcEdHWFjl53xpsoR0yktLo95LJxw= From: andrey.konovalov@linux.dev To: Marco Elver , Alexander Potapenko , Andrew Morton Cc: Andrey Konovalov , Dmitry Vyukov , Andrey Ryabinin , kasan-dev@googlegroups.com, linux-mm@kvack.org, linux-kernel@vger.kernel.org, Andrey Konovalov Subject: [PATCH] kasan: fix quarantine conflicting with init_on_free Date: Mon, 20 Dec 2021 17:37:04 +0100 Message-Id: MIME-Version: 1.0 X-Migadu-Flow: FLOW_OUT X-Migadu-Auth-User: linux.dev X-Rspamd-Queue-Id: 99F4C1C0047 X-Stat-Signature: t6n7ykqdcx8iwh7ytpknf4jy49e789ou Authentication-Results: imf20.hostedemail.com; dkim=pass header.d=linux.dev header.s=key1 header.b=b5kkaiey; dmarc=pass (policy=none) header.from=linux.dev; spf=pass (imf20.hostedemail.com: domain of andrey.konovalov@linux.dev designates 188.165.223.204 as permitted sender) smtp.mailfrom=andrey.konovalov@linux.dev X-Rspamd-Server: rspam11 X-HE-Tag: 1640018231-254252 X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: From: Andrey Konovalov KASAN's quarantine might save its metadata inside freed objects. As this happens after the memory is zeroed by the slab allocator when init_on_free is enabled, the memory coming out of quarantine is not properly zeroed. This causes lib/test_meminit.c tests to fail with Generic KASAN. Zero the metadata when the object is removed from quarantine. Fixes: 6471384af2a6 ("mm: security: introduce init_on_alloc=1 and init_on_free=1 boot options") Signed-off-by: Andrey Konovalov --- mm/kasan/quarantine.c | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/mm/kasan/quarantine.c b/mm/kasan/quarantine.c index 587da8995f2d..2e50869fd8e2 100644 --- a/mm/kasan/quarantine.c +++ b/mm/kasan/quarantine.c @@ -132,11 +132,22 @@ static void *qlink_to_object(struct qlist_node *qlink, struct kmem_cache *cache) static void qlink_free(struct qlist_node *qlink, struct kmem_cache *cache) { void *object = qlink_to_object(qlink, cache); + struct kasan_free_meta *meta = kasan_get_free_meta(cache, object); unsigned long flags; if (IS_ENABLED(CONFIG_SLAB)) local_irq_save(flags); + /* + * If init_on_free is enabled and KASAN's free metadata is stored in + * the object, zero the metadata. Otherwise, the object's memory will + * not be properly zeroed, as KASAN saves the metadata after the slab + * allocator zeroes the object. + */ + if (slab_want_init_on_free(cache) && + cache->kasan_info.free_meta_offset == 0) + memset(meta, 0, sizeof(*meta)); + /* * As the object now gets freed from the quarantine, assume that its * free track is no longer valid.