linux-kernel - Re: [PATCH] mm, slub, kasan: enable user tracking by default with KASAN=y

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:	Wed, 21 Oct 2015 13:37:28 -0700 (PDT)
From:	David Rientjes <rientjes@...gle.com>
To:	Andrey Ryabinin <aryabinin@...tuozzo.com>
cc:	Andrew Morton <akpm@...ux-foundation.org>,
	Christoph Lameter <cl@...ux.com>,
	Pekka Enberg <penberg@...nel.org>,
	Joonsoo Kim <iamjoonsoo.kim@....com>, linux-mm@...ck.org,
	linux-kernel@...r.kernel.org,
	Alexander Potapenko <glider@...gle.com>,
	Dmitriy Vyukov <dvyukov@...gle.com>
Subject: Re: [PATCH] mm, slub, kasan: enable user tracking by default with
 KASAN=y

On Wed, 21 Oct 2015, Andrey Ryabinin wrote:

> It's recommended to have slub's user tracking enabled with CONFIG_KASAN,
> because:
> a) User tracking disables slab merging which improves
>     detecting out-of-bounds accesses.
> b) User tracking metadata acts as redzone which also improves
>     detecting out-of-bounds accesses.
> c) User tracking provides additional information about object.
>     This information helps to understand bugs.
> 
> Currently it is not enabled by default. Besides recompiling the kernel
> with KASAN and reinstalling it, user also have to change the boot cmdline,
> which is not very handy.
> 
> Enable slub user tracking by default with KASAN=y, since there is no
> good reason to not do this.
> 
> Signed-off-by: Andrey Ryabinin <aryabinin@...tuozzo.com>

Makes sense.  I don't imagine users of CONFIG_KASAN would be concerned 
about additional performance degradation for better diagnostics.

> ---
>  Documentation/kasan.txt | 3 +--
>  lib/Kconfig.kasan       | 3 +--
>  mm/slub.c               | 2 ++
>  3 files changed, 4 insertions(+), 4 deletions(-)
> 
> diff --git a/Documentation/kasan.txt b/Documentation/kasan.txt
> index 94c88157..3107467 100644
> --- a/Documentation/kasan.txt
> +++ b/Documentation/kasan.txt
> @@ -28,8 +28,7 @@ the latter is 1.1 - 2 times faster. Inline instrumentation requires a GCC
>  version 5.0 or later.
>  
>  Currently KASAN works only with the SLUB memory allocator.
> -For better bug detection and nicer report, enable CONFIG_STACKTRACE and put
> -at least 'slub_debug=U' in the boot cmdline.
> +For better bug detection and nicer report and enable CONFIG_STACKTRACE.
>  
>  To disable instrumentation for specific files or directories, add a line
>  similar to the following to the respective kernel Makefile:

One too many "and"s in that sentence.

> diff --git a/lib/Kconfig.kasan b/lib/Kconfig.kasan
> index 39f24d6..0fee5ac 100644
> --- a/lib/Kconfig.kasan
> +++ b/lib/Kconfig.kasan
> @@ -15,8 +15,7 @@ config KASAN
>  	  global variables requires gcc 5.0 or later.
>  	  This feature consumes about 1/8 of available memory and brings about
>  	  ~x3 performance slowdown.
> -	  For better error detection enable CONFIG_STACKTRACE,
> -	  and add slub_debug=U to boot cmdline.
> +	  For better error detection enable CONFIG_STACKTRACE.
>  
>  choice
>  	prompt "Instrumentation type"
> diff --git a/mm/slub.c b/mm/slub.c
> index ae28dff..f208835 100644
> --- a/mm/slub.c
> +++ b/mm/slub.c
> @@ -463,6 +463,8 @@ static void get_map(struct kmem_cache *s, struct page *page, unsigned long *map)
>   */
>  #ifdef CONFIG_SLUB_DEBUG_ON
>  static int slub_debug = DEBUG_DEFAULT_FLAGS;
> +#elif defined(CONFIG_KASAN)
> +static int slub_debug = SLAB_STORE_USER;
>  #else
>  static int slub_debug;
>  #endif

Typically you would convert the #ifdef to 
#if defined(CONFIG_SLUB_DEBUG_ON) as well.
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/