linux-kernel - Re: [PATCH] mm, mempool: kasan: poison mempool elements

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <20150403150719.b2197f71260fee25434e49fc@linux-foundation.org>
Date:	Fri, 3 Apr 2015 15:07:19 -0700
From:	Andrew Morton <akpm@...ux-foundation.org>
To:	Andrey Ryabinin <a.ryabinin@...sung.com>
Cc:	David Rientjes <rientjes@...gle.com>,
	Dave Kleikamp <shaggy@...nel.org>,
	Christoph Hellwig <hch@....de>,
	Sebastian Ott <sebott@...ux.vnet.ibm.com>,
	Mikulas Patocka <mpatocka@...hat.com>,
	Catalin Marinas <catalin.marinas@....com>,
	LKML <linux-kernel@...r.kernel.org>, linux-mm@...ck.org,
	jfs-discussion@...ts.sourceforge.net,
	Dmitry Chernenkov <drcheren@...il.com>,
	Dmitry Vyukov <dvyukov@...gle.com>,
	Alexander Potapenko <glider@...gle.com>
Subject: Re: [PATCH] mm, mempool: kasan: poison mempool elements

On Fri, 03 Apr 2015 17:47:47 +0300 Andrey Ryabinin <a.ryabinin@...sung.com> wrote:

> Mempools keep allocated objects in reserved for situations
> when ordinary allocation may not be possible to satisfy.
> These objects shouldn't be accessed before they leave
> the pool.
> This patch poison elements when get into the pool
> and unpoison when they leave it. This will let KASan
> to detect use-after-free of mempool's elements.
> 
> ...
>
> +static void kasan_poison_element(mempool_t *pool, void *element)
> +{
> +	if (pool->alloc == mempool_alloc_slab)
> +		kasan_slab_free(pool->pool_data, element);
> +	if (pool->alloc == mempool_kmalloc)
> +		kasan_kfree(element);
> +	if (pool->alloc == mempool_alloc_pages)
> +		kasan_free_pages(element, (unsigned long)pool->pool_data);
> +}

We recently discovered that mempool pages (from alloc_pages, not slab)
can be in highmem.  But kasan apepars to handle highmem pages (by
baling out) so we should be OK with that.

Can kasan be taught to use kmap_atomic() or is it more complicated than
that?  It probably isn't worthwhile - highmem pages don'[t get used by the
kernel much and most bugs will be found using 64-bit testing anyway.
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/