From patchwork Mon Dec 20 21:55:59 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: andrey.konovalov@linux.dev X-Patchwork-Id: 12688683 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id 096C9C433EF for ; Mon, 20 Dec 2021 21:56:06 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id 7A9406B0071; Mon, 20 Dec 2021 16:56:06 -0500 (EST) Received: by kanga.kvack.org (Postfix, from userid 40) id 756FF6B0073; Mon, 20 Dec 2021 16:56:06 -0500 (EST) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 645856B0074; Mon, 20 Dec 2021 16:56:06 -0500 (EST) X-Delivered-To: linux-mm@kvack.org Received: from forelay.hostedemail.com (smtprelay0001.hostedemail.com [216.40.44.1]) by kanga.kvack.org (Postfix) with ESMTP id 54B3C6B0071 for ; Mon, 20 Dec 2021 16:56:06 -0500 (EST) Received: from smtpin07.hostedemail.com (10.5.19.251.rfc1918.com [10.5.19.251]) by forelay01.hostedemail.com (Postfix) with ESMTP id 14E4918027F8D for ; Mon, 20 Dec 2021 21:56:06 +0000 (UTC) X-FDA: 78939531132.07.65CE3DE Received: from out0.migadu.com (out0.migadu.com [94.23.1.103]) by imf20.hostedemail.com (Postfix) with ESMTP id 70B821C0027 for ; Mon, 20 Dec 2021 21:56:01 +0000 (UTC) X-Report-Abuse: Please report any abuse attempt to abuse@migadu.com and include these headers. DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linux.dev; s=key1; t=1640037363; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding; bh=1NLhsQtLh77LdZHgbT2kusq/cP+dmXSyIjhww1oL3wE=; b=e8P88o5MaHdVGc8OQf5JJgbMpgqrXP0Jdfxzk4WRTxfgaVMN2N9g1YArJiz9VGb7vPNrHS /GUrUoMY0f/quKjwGChhnxmE176tJ1z/9JOogvVTHYMrmO07LxHbzHbqMw0f9FMo4E24gc Fzn/GtT75f/xyCV+woSTP8Jy3e3Vj8g= From: andrey.konovalov@linux.dev To: Alexander Potapenko , Marco Elver , Andrew Morton Cc: Andrey Konovalov , Dmitry Vyukov , Andrey Ryabinin , kasan-dev@googlegroups.com, linux-mm@kvack.org, linux-kernel@vger.kernel.org, Andrey Konovalov Subject: [PATCH v2] kasan: fix quarantine conflicting with init_on_free Date: Mon, 20 Dec 2021 22:55:59 +0100 Message-Id: <2805da5df4b57138fdacd671f5d227d58950ba54.1640037083.git.andreyknvl@google.com> MIME-Version: 1.0 X-Migadu-Flow: FLOW_OUT X-Migadu-Auth-User: linux.dev X-Rspamd-Server: rspam03 X-Rspamd-Queue-Id: 70B821C0027 X-Stat-Signature: tetbztpy6rqmjfzeej4qey5woyukhbho Authentication-Results: imf20.hostedemail.com; dkim=pass header.d=linux.dev header.s=key1 header.b=e8P88o5M; dmarc=pass (policy=none) header.from=linux.dev; spf=pass (imf20.hostedemail.com: domain of andrey.konovalov@linux.dev designates 94.23.1.103 as permitted sender) smtp.mailfrom=andrey.konovalov@linux.dev X-HE-Tag: 1640037361-40810 X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: From: Andrey Konovalov KASAN's quarantine might save its metadata inside freed objects. As this happens after the memory is zeroed by the slab allocator when init_on_free is enabled, the memory coming out of quarantine is not properly zeroed. This causes lib/test_meminit.c tests to fail with Generic KASAN. Zero the metadata when the object is removed from quarantine. Fixes: 6471384af2a6 ("mm: security: introduce init_on_alloc=1 and init_on_free=1 boot options") Signed-off-by: Andrey Konovalov Reviewed-by: Marco Elver --- Changes v1->v2: - Use memzero_explicit() instead of memset(). --- mm/kasan/quarantine.c | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/mm/kasan/quarantine.c b/mm/kasan/quarantine.c index 587da8995f2d..08291ed33e93 100644 --- a/mm/kasan/quarantine.c +++ b/mm/kasan/quarantine.c @@ -132,11 +132,22 @@ static void *qlink_to_object(struct qlist_node *qlink, struct kmem_cache *cache) static void qlink_free(struct qlist_node *qlink, struct kmem_cache *cache) { void *object = qlink_to_object(qlink, cache); + struct kasan_free_meta *meta = kasan_get_free_meta(cache, object); unsigned long flags; if (IS_ENABLED(CONFIG_SLAB)) local_irq_save(flags); + /* + * If init_on_free is enabled and KASAN's free metadata is stored in + * the object, zero the metadata. Otherwise, the object's memory will + * not be properly zeroed, as KASAN saves the metadata after the slab + * allocator zeroes the object. + */ + if (slab_want_init_on_free(cache) && + cache->kasan_info.free_meta_offset == 0) + memzero_explicit(meta, sizeof(*meta)); + /* * As the object now gets freed from the quarantine, assume that its * free track is no longer valid.