linux-kernel - Re: [PATCH] slub/slab: fix kmemleak didn't work on some case

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Tue, 9 Jun 2015 16:03:03 +0100
From:	Catalin Marinas <catalin.marinas@....com>
To:	"Zhang, Yanmin" <yanmin_zhang@...ux.intel.com>
Cc:	Christoph Lameter <cl@...ux.com>,
	"Liu, XinwuX" <xinwux.liu@...el.com>,
	"penberg@...nel.org" <penberg@...nel.org>,
	"mpm@...enic.com" <mpm@...enic.com>,
	"linux-mm@...ck.org" <linux-mm@...ck.org>,
	"linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
	"He, Bo" <bo.he@...el.com>, "Chen, Lin Z" <lin.z.chen@...el.com>
Subject: Re: [PATCH] slub/slab: fix kmemleak didn't work on some case

On Tue, Jun 09, 2015 at 09:10:45AM +0100, Zhang, Yanmin wrote:
> On 2015/6/8 18:13, Catalin Marinas wrote:
> > As I replied already, I don't think this is that bad, or at least not
> > worse than what kmemleak already does (looking at all data whether it's
> > pointer or not).
> 
> It depends. As for memleak, developers prefers there are false alarms instead
> of missing some leaked memory.

Lots of false positives aren't that nice, you spend a lot of time
debugging them (I've been there in the early kmemleak days). Anyway,
your use case is not about false positives vs. negatives but just false
negatives.

My point is that there is a lot of random, pointer-like data read by
kmemleak even without this memset (e.g. thread stacks, non-pointer data
in kmalloc'ed structures, data/bss sections). Just doing this memset may
reduce the chance of false negatives a bit but I don't think it would be
noticeable.

If there is some serious memory leak (lots of objects), they would
likely show up at some point. Even if it's a one-off leak, it's possible
that it shows up after some time (e.g. the object pointing to this
memory block is freed).

> >  It also doesn't solve the kmem_cache_alloc() case where
> > the original object size is no longer available.
> 
> Such issue around kmem_cache_alloc() case happens only when the
> caller doesn't initialize or use the full object, so the object keeps
> old dirty data.

The kmem_cache blocks size would be aligned to a cache line, so you
still have some extra bytes never touched by the caller.

> This patch is to resolve the redundant unused space (more than object size)
> although the full object is used by kernel.

So this solves only the cases where the original object size is still
known (e.g. kmalloc). It could also be solved by telling kmemleak the
actual object size.

-- 
Catalin
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/