linux-kernel - Re: [patch 1/2] mm, mempool: poison elements backed by slab allocator

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Thu, 12 Mar 2015 13:28:32 -0700
From:	Andrew Morton <akpm@...ux-foundation.org>
To:	David Rientjes <rientjes@...gle.com>
Cc:	Sebastian Ott <sebott@...ux.vnet.ibm.com>,
	Mikulas Patocka <mpatocka@...hat.com>,
	Catalin Marinas <catalin.marinas@....com>,
	linux-kernel@...r.kernel.org, linux-mm@...ck.org
Subject: Re: [patch 1/2] mm, mempool: poison elements backed by slab
 allocator

On Mon, 9 Mar 2015 00:21:56 -0700 (PDT) David Rientjes <rientjes@...gle.com> wrote:

> Mempools keep elements in a reserved pool for contexts in which
> allocation may not be possible.  When an element is allocated from the
> reserved pool, its memory contents is the same as when it was added to
> the reserved pool.
> 
> Because of this, elements lack any free poisoning to detect
> use-after-free errors.
> 
> This patch adds free poisoning for elements backed by the slab allocator.
> This is possible because the mempool layer knows the object size of each
> element.
> 
> When an element is added to the reserved pool, it is poisoned with
> POISON_FREE.  When it is removed from the reserved pool, the contents are
> checked for POISON_FREE.  If there is a mismatch, a warning is emitted to
> the kernel log.
> 
> This is only effective for configs with CONFIG_DEBUG_VM.

At present CONFIG_DEBUG_VM is pretty lightweight (I hope) and using it
for mempool poisoning might be inappropriately costly.  Would it be
better to tie this to something else?  Either standalone or reuse some
slab debug option, perhaps.

Did you measure the overhead btw?  It might be significant with fast
devices.

> --- a/mm/mempool.c
> +++ b/mm/mempool.c
> @@ -16,16 +16,77 @@
>  #include <linux/blkdev.h>
>  #include <linux/writeback.h>
>  
> +#ifdef CONFIG_DEBUG_VM
> +static void poison_error(mempool_t *pool, void *element, size_t size,
> +			 size_t byte)
> +{
> +	const int nr = pool->curr_nr;
> +	const int start = max_t(int, byte - (BITS_PER_LONG / 8), 0);
> +	const int end = min_t(int, byte + (BITS_PER_LONG / 8), size);
> +	int i;
> +
> +	pr_err("BUG: mempool element poison mismatch\n");
> +	pr_err("Mempool %p size %ld\n", pool, size);
> +	pr_err(" nr=%d @ %p: %s0x", nr, element, start > 0 ? "... " : "");
> +	for (i = start; i < end; i++)
> +		pr_cont("%x ", *(u8 *)(element + i));
> +	pr_cont("%s\n", end < size ? "..." : "");
> +	dump_stack();
> +}

"byte" wasn't a very useful identifier, and it's called "i" in
check_slab_element().  Rename it to "offset" in both places?

> +static void check_slab_element(mempool_t *pool, void *element)
> +{
> +	if (pool->free == mempool_free_slab || pool->free == mempool_kfree) {
> +		size_t size = ksize(element);
> +		u8 *obj = element;
> +		size_t i;
> +
> +		for (i = 0; i < size; i++) {
> +			u8 exp = (i < size - 1) ? POISON_FREE : POISON_END;
> +
> +			if (obj[i] != exp) {
> +				poison_error(pool, element, size, i);
> +				return;
> +			}
> +		}
> +		memset(obj, POISON_INUSE, size);
> +	}
> +}

I question the reuse of POISON_FREE/POISON_INUSE.  If this thing
triggers, it may be hard to tell if it was due to a slab thing or to a
mempool thing.  Using a distinct poison pattern for mempool would clear
that up?

> ...
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/