From patchwork Tue Nov 29 06:33:57 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Feng Tang X-Patchwork-Id: 13058582 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id 6F860C46467 for ; Tue, 29 Nov 2022 13:46:59 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id CA7646B007D; Tue, 29 Nov 2022 08:46:58 -0500 (EST) Received: by kanga.kvack.org (Postfix, from userid 40) id C30406B007E; Tue, 29 Nov 2022 08:46:58 -0500 (EST) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id AA97A6B0080; Tue, 29 Nov 2022 08:46:58 -0500 (EST) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0013.hostedemail.com [216.40.44.13]) by kanga.kvack.org (Postfix) with ESMTP id 7C0E26B007E for ; Tue, 29 Nov 2022 08:46:58 -0500 (EST) Received: from smtpin13.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay04.hostedemail.com (Postfix) with ESMTP id 2176D1A09E6 for ; Tue, 29 Nov 2022 06:36:59 +0000 (UTC) X-FDA: 80185522158.13.1DDEC20 Received: from mga06.intel.com (mga06b.intel.com [134.134.136.31]) by imf26.hostedemail.com (Postfix) with ESMTP id 1C608140005 for ; Tue, 29 Nov 2022 06:36:57 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=intel.com; i=@intel.com; q=dns/txt; s=Intel; t=1669703818; x=1701239818; h=from:to:cc:subject:date:message-id:mime-version: content-transfer-encoding; bh=sS0dUVwwbqCbyVXenUC31s2Bure2EG6lW7uFTvRVHFs=; b=gCHy2an7xBujwVplQ/9nU5wggo54uzsU6+Q7irJeOXyuTISPDKoQkeYf xxfyY8aJh7Ryi8R3wTiwkM4j+y5cUEx/yrNENGp/LsKnrtyfdG+n+8oxA notLGpPzLkcVvH+IZJoygaJ4NH3GufSiXhuuqLsz8SzhU5kJgXD21ASg6 FCU/r6AKj2peuKh0dfyTOZSz+gDF99pLvDzJ8AhySUPWwxnlfmeRtzJ/N QB5VF9CQL2/baGGpkwI9nOeoOBu2xrM1L/adelMGXZM2tvwGceYqr/i9J 64C6k6iijUjNrqMr/A1ksX5W5vwq5nr1EHipURdIH69qQxjmQRviifqN4 w==; X-IronPort-AV: E=McAfee;i="6500,9779,10545"; a="377178775" X-IronPort-AV: E=Sophos;i="5.96,202,1665471600"; d="scan'208";a="377178775" Received: from fmsmga007.fm.intel.com ([10.253.24.52]) by orsmga104.jf.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 28 Nov 2022 22:36:56 -0800 X-ExtLoop1: 1 X-IronPort-AV: E=McAfee;i="6500,9779,10545"; a="645784210" X-IronPort-AV: E=Sophos;i="5.96,202,1665471600"; d="scan'208";a="645784210" Received: from feng-clx.sh.intel.com ([10.238.200.228]) by fmsmga007.fm.intel.com with ESMTP; 28 Nov 2022 22:36:53 -0800 From: Feng Tang To: Vlastimil Babka , Andrew Morton , Oliver Glitta , Christoph Lameter , Pekka Enberg , David Rientjes , Joonsoo Kim , Roman Gushchin , Hyeonggon Yoo <42.hyeyoo@gmail.com>, Marco Elver Cc: linux-mm@kvack.org, linux-kernel@vger.kernel.org, Feng Tang Subject: [PATCH v2 1/2] mm/slub, kunit: add SLAB_SKIP_KFENCE flag for cache creation Date: Tue, 29 Nov 2022 14:33:57 +0800 Message-Id: <20221129063358.3012362-1-feng.tang@intel.com> X-Mailer: git-send-email 2.34.1 MIME-Version: 1.0 ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1669703818; a=rsa-sha256; cv=none; b=WWO/oR2JzXM1A1SMs1haw1Fo20H8YS1ySI8UH0j3wuaFAQ7pvSBA7OFHAWkbFH+vVYhtmy Prh9hLo2bCMqYdt4dRyozo6vps6lFpLQAf4t80ZTxhkSTwo3gXbK+pF1gXXjv+MlAQasu1 tb+MVNFUN4HimBoEV5bIFBpmizNgX3g= ARC-Authentication-Results: i=1; imf26.hostedemail.com; dkim=none ("invalid DKIM record") header.d=intel.com header.s=Intel header.b=gCHy2an7; dmarc=pass (policy=none) header.from=intel.com; spf=pass (imf26.hostedemail.com: domain of feng.tang@intel.com designates 134.134.136.31 as permitted sender) smtp.mailfrom=feng.tang@intel.com ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1669703818; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-transfer-encoding:content-transfer-encoding: in-reply-to:references:dkim-signature; bh=SWOG0vh35TiQqgnUOMXmkjN68hZgLZhawGJcTvL9WC4=; b=6FEBX34Zp6ee0kbpcuuWEQp50AtiI0ezl65ERNmMQDANaatKGuuyXJPx7VVTUBgds+3cYw Y3TvoaEivKDvFuy4gQiH0lqgGNGkkdRXPwTnvNN8Ip4OP7wmOImwaFw5di2+T0wI9O1RkH iUG7CV22uU5HFNC4aexSsrNtTHrrMyo= X-Rspamd-Queue-Id: 1C608140005 Authentication-Results: imf26.hostedemail.com; dkim=none ("invalid DKIM record") header.d=intel.com header.s=Intel header.b=gCHy2an7; dmarc=pass (policy=none) header.from=intel.com; spf=pass (imf26.hostedemail.com: domain of feng.tang@intel.com designates 134.134.136.31 as permitted sender) smtp.mailfrom=feng.tang@intel.com X-Rspamd-Server: rspam12 X-Rspam-User: X-Stat-Signature: mib5i9r1hx8f5y6bteth5w1kukqdh9ho X-HE-Tag: 1669703817-711118 X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: When kfence is enabled, the buffer allocated from the test case could be from a kfence pool, and the operation could be also caught and reported by kfence first, causing the case to fail. With default kfence setting, this is very difficult to be triggered. By changing CONFIG_KFENCE_NUM_OBJECTS from 255 to 16383, and CONFIG_KFENCE_SAMPLE_INTERVAL from 100 to 5, the allocation from kfence did hit 7 times in different slub_kunit cases out of 900 times of boot test. To avoid this, initially we tried is_kfence_address() to check this and repeated allocation till finding a non-kfence address. Vlastimil Babka suggested SLAB_SKIP_KFENCE flag could be used to achieve this more simply. Signed-off-by: Feng Tang --- lib/slub_kunit.c | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-) diff --git a/lib/slub_kunit.c b/lib/slub_kunit.c index 7a0564d7cb7a..a303adf8f11c 100644 --- a/lib/slub_kunit.c +++ b/lib/slub_kunit.c @@ -6,13 +6,15 @@ #include #include "../mm/slab.h" +#define DEFAULT_FLAGS (SLAB_SKIP_KFENCE | SLAB_NO_USER_FLAGS) + static struct kunit_resource resource; static int slab_errors; static void test_clobber_zone(struct kunit *test) { struct kmem_cache *s = kmem_cache_create("TestSlub_RZ_alloc", 64, 0, - SLAB_RED_ZONE|SLAB_NO_USER_FLAGS, NULL); + SLAB_RED_ZONE|DEFAULT_FLAGS, NULL); u8 *p = kmem_cache_alloc(s, GFP_KERNEL); kasan_disable_current(); @@ -30,7 +32,7 @@ static void test_clobber_zone(struct kunit *test) static void test_next_pointer(struct kunit *test) { struct kmem_cache *s = kmem_cache_create("TestSlub_next_ptr_free", 64, 0, - SLAB_POISON|SLAB_NO_USER_FLAGS, NULL); + SLAB_POISON|DEFAULT_FLAGS, NULL); u8 *p = kmem_cache_alloc(s, GFP_KERNEL); unsigned long tmp; unsigned long *ptr_addr; @@ -75,7 +77,7 @@ static void test_next_pointer(struct kunit *test) static void test_first_word(struct kunit *test) { struct kmem_cache *s = kmem_cache_create("TestSlub_1th_word_free", 64, 0, - SLAB_POISON|SLAB_NO_USER_FLAGS, NULL); + SLAB_POISON|DEFAULT_FLAGS, NULL); u8 *p = kmem_cache_alloc(s, GFP_KERNEL); kmem_cache_free(s, p); @@ -90,7 +92,7 @@ static void test_first_word(struct kunit *test) static void test_clobber_50th_byte(struct kunit *test) { struct kmem_cache *s = kmem_cache_create("TestSlub_50th_word_free", 64, 0, - SLAB_POISON|SLAB_NO_USER_FLAGS, NULL); + SLAB_POISON|DEFAULT_FLAGS, NULL); u8 *p = kmem_cache_alloc(s, GFP_KERNEL); kmem_cache_free(s, p); @@ -106,7 +108,7 @@ static void test_clobber_50th_byte(struct kunit *test) static void test_clobber_redzone_free(struct kunit *test) { struct kmem_cache *s = kmem_cache_create("TestSlub_RZ_free", 64, 0, - SLAB_RED_ZONE|SLAB_NO_USER_FLAGS, NULL); + SLAB_RED_ZONE|DEFAULT_FLAGS, NULL); u8 *p = kmem_cache_alloc(s, GFP_KERNEL); kasan_disable_current(); From patchwork Tue Nov 29 06:33:58 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Feng Tang X-Patchwork-Id: 13058581 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id 62C87C4167B for ; Tue, 29 Nov 2022 13:46:46 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id DB8826B0072; Tue, 29 Nov 2022 08:46:45 -0500 (EST) Received: by kanga.kvack.org (Postfix, from userid 40) id D685B6B0078; Tue, 29 Nov 2022 08:46:45 -0500 (EST) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id C30C96B007D; Tue, 29 Nov 2022 08:46:45 -0500 (EST) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0012.hostedemail.com [216.40.44.12]) by kanga.kvack.org (Postfix) with ESMTP id B61E36B0072 for ; Tue, 29 Nov 2022 08:46:45 -0500 (EST) Received: from smtpin06.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay10.hostedemail.com (Postfix) with ESMTP id 9ADA4C0967 for ; Tue, 29 Nov 2022 06:37:00 +0000 (UTC) X-FDA: 80185522200.06.E541103 Received: from mga06.intel.com (mga06b.intel.com [134.134.136.31]) by imf26.hostedemail.com (Postfix) with ESMTP id C763C14000C for ; Tue, 29 Nov 2022 06:36:59 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=intel.com; i=@intel.com; q=dns/txt; s=Intel; t=1669703819; x=1701239819; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version:content-transfer-encoding; bh=7mjnKay8jU2S2Yvtj+sHUiviWAPaCCXEzlMpUe4IYiY=; b=BRDcQ8RLxKBNxjXIazw+5ZxE+WszOzpwPaxafZGe2sINwuB+3u31Df6s brgZRFeFUtwdwbdg8hTT/f8JqfmEVoP+wVPuO1EiLBsvK5KeRHhIHKXG9 JTKXJGVJEku3+x7D9OfscT6KxzwqYl2R3DT9LxLWLTAV0wvnfQ8/02pqX d77NyZrdOYkwEziAzoHFHKWki+mxwedUQqQlU7bxa8Zt44wM4K0njqSnB MAIVSwhhcWIMmF4IfQmofC1t1Y9+eQJ5rr5A45opjPDJKxTCohGL92hsW 3nKDAeKXl9xbe3yqTbsraDa3uCAT+VkDZiPlxrm0F5/8qnXqogfZMy2jt w==; X-IronPort-AV: E=McAfee;i="6500,9779,10545"; a="377178795" X-IronPort-AV: E=Sophos;i="5.96,202,1665471600"; d="scan'208";a="377178795" Received: from fmsmga007.fm.intel.com ([10.253.24.52]) by orsmga104.jf.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 28 Nov 2022 22:36:59 -0800 X-ExtLoop1: 1 X-IronPort-AV: E=McAfee;i="6500,9779,10545"; a="645784217" X-IronPort-AV: E=Sophos;i="5.96,202,1665471600"; d="scan'208";a="645784217" Received: from feng-clx.sh.intel.com ([10.238.200.228]) by fmsmga007.fm.intel.com with ESMTP; 28 Nov 2022 22:36:56 -0800 From: Feng Tang To: Vlastimil Babka , Andrew Morton , Oliver Glitta , Christoph Lameter , Pekka Enberg , David Rientjes , Joonsoo Kim , Roman Gushchin , Hyeonggon Yoo <42.hyeyoo@gmail.com>, Marco Elver Cc: linux-mm@kvack.org, linux-kernel@vger.kernel.org, Feng Tang Subject: [PATCH v2 2/2] mm/slub, kunit: Add a test case for kmalloc redzone check Date: Tue, 29 Nov 2022 14:33:58 +0800 Message-Id: <20221129063358.3012362-2-feng.tang@intel.com> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20221129063358.3012362-1-feng.tang@intel.com> References: <20221129063358.3012362-1-feng.tang@intel.com> MIME-Version: 1.0 ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1669703820; a=rsa-sha256; cv=none; b=Udl4DE2GfpQO678ZHbpHj5kjamuBatfgAqU5SHF+pSPTF0hR2iX/oXaWwELXji5leYteD0 9S4hWnymHASMFg2FlxShJjQD8yTi1U7a8ZNpl52M4wh0SsXj80Z88Am4qHH3me7KoPHY4/ jGRj2cRCskTX+77H8laqH3WOT6khwk8= ARC-Authentication-Results: i=1; imf26.hostedemail.com; dkim=none ("invalid DKIM record") header.d=intel.com header.s=Intel header.b=BRDcQ8RL; dmarc=pass (policy=none) header.from=intel.com; spf=pass (imf26.hostedemail.com: domain of feng.tang@intel.com designates 134.134.136.31 as permitted sender) smtp.mailfrom=feng.tang@intel.com ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1669703820; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references:dkim-signature; bh=WzqLxEdATxQHMbHwQsbYhd6+oS/4toKX8Bpapr/RrMk=; b=Vb/Ur6rxWkZzjZdXMtbmfvwa4fWszC6695leNUvjj47uWYUZxhhSOqqv2TBC5St2AOXA4h 4qAaYr2MggsIhFkv9vr0RP/9xL1hcpCDkSpf/qBL8ZywNLub4FyVNX77N2NWjeQ/MzaPhT BdC9CNIt50gxl5HTlz0ZPGOu61mZ5Uo= X-Rspamd-Queue-Id: C763C14000C Authentication-Results: imf26.hostedemail.com; dkim=none ("invalid DKIM record") header.d=intel.com header.s=Intel header.b=BRDcQ8RL; dmarc=pass (policy=none) header.from=intel.com; spf=pass (imf26.hostedemail.com: domain of feng.tang@intel.com designates 134.134.136.31 as permitted sender) smtp.mailfrom=feng.tang@intel.com X-Rspamd-Server: rspam12 X-Rspam-User: X-Stat-Signature: irxdcsycsd491ory5893r9g67dyydc65 X-HE-Tag: 1669703819-743534 X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: kmalloc redzone check for slub has been merged, and it's better to add a kunit case for it, which is inspired by a real-world case as described in commit 120ee599b5bf ("staging: octeon-usb: prevent memory corruption"): " octeon-hcd will crash the kernel when SLOB is used. This usually happens after the 18-byte control transfer when a device descriptor is read. The DMA engine is always transferring full 32-bit words and if the transfer is shorter, some random garbage appears after the buffer. The problem is not visible with SLUB since it rounds up the allocations to word boundary, and the extra bytes will go undetected. " To avoid interrupting the normal functioning of kmalloc caches, a kmem_cache mimicing kmalloc cache is created with similar and all necessary flags to have kmalloc-redzone enabled, and kmalloc_trace() is used to really test the orig_size and redzone setup. Suggested-by: Vlastimil Babka Signed-off-by: Feng Tang --- Changelog: since v1: * create a new cache mimicing kmalloc cache, reduce dependency over global slub_debug setting (Vlastimil Babka) lib/slub_kunit.c | 23 +++++++++++++++++++++++ mm/slab.h | 3 ++- 2 files changed, 25 insertions(+), 1 deletion(-) diff --git a/lib/slub_kunit.c b/lib/slub_kunit.c index a303adf8f11c..dbdd656624d0 100644 --- a/lib/slub_kunit.c +++ b/lib/slub_kunit.c @@ -122,6 +122,28 @@ static void test_clobber_redzone_free(struct kunit *test) kmem_cache_destroy(s); } +static void test_kmalloc_redzone_access(struct kunit *test) +{ + struct kmem_cache *s = kmem_cache_create("TestSlub_RZ_kmalloc", 32, 0, + SLAB_KMALLOC|SLAB_STORE_USER|SLAB_RED_ZONE|DEFAULT_FLAGS, + NULL); + u8 *p = kmalloc_trace(s, GFP_KERNEL, 18); + + kasan_disable_current(); + + /* Suppress the -Warray-bounds warning */ + OPTIMIZER_HIDE_VAR(p); + p[18] = 0xab; + p[19] = 0xab; + + kmem_cache_free(s, p); + validate_slab_cache(s); + KUNIT_EXPECT_EQ(test, 2, slab_errors); + + kasan_enable_current(); + kmem_cache_destroy(s); +} + static int test_init(struct kunit *test) { slab_errors = 0; @@ -141,6 +163,7 @@ static struct kunit_case test_cases[] = { #endif KUNIT_CASE(test_clobber_redzone_free), + KUNIT_CASE(test_kmalloc_redzone_access), {} }; diff --git a/mm/slab.h b/mm/slab.h index c71590f3a22b..b6cd98b16ba7 100644 --- a/mm/slab.h +++ b/mm/slab.h @@ -327,7 +327,8 @@ static inline slab_flags_t kmem_cache_flags(unsigned int object_size, /* Legal flag mask for kmem_cache_create(), for various configurations */ #define SLAB_CORE_FLAGS (SLAB_HWCACHE_ALIGN | SLAB_CACHE_DMA | \ SLAB_CACHE_DMA32 | SLAB_PANIC | \ - SLAB_TYPESAFE_BY_RCU | SLAB_DEBUG_OBJECTS ) + SLAB_KMALLOC | SLAB_SKIP_KFENCE | \ + SLAB_TYPESAFE_BY_RCU | SLAB_DEBUG_OBJECTS) #if defined(CONFIG_DEBUG_SLAB) #define SLAB_DEBUG_FLAGS (SLAB_RED_ZONE | SLAB_POISON | SLAB_STORE_USER)