| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Date: Thu, 1 Jun 2017 19:45:48 +0200
From: Dmitry Vyukov <dvyukov@...gle.com>
To: Andrey Ryabinin <aryabinin@...tuozzo.com>
Cc: Andrew Morton <akpm@...ux-foundation.org>,
Alexander Potapenko <glider@...gle.com>,
kasan-dev <kasan-dev@...glegroups.com>,
"linux-mm@...ck.org" <linux-mm@...ck.org>,
LKML <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH 1/4] mm/kasan: get rid of speculative shadow checks
On Thu, Jun 1, 2017 at 6:23 PM, Andrey Ryabinin <aryabinin@...tuozzo.com> wrote:
> For some unaligned memory accesses we have to check additional
> byte of the shadow memory. Currently we load that byte speculatively
> to have only single load + branch on the optimistic fast path.
>
> However, this approach have some downsides:
> - It's unaligned access, so this prevents porting KASAN on architectures
> which doesn't support unaligned accesses.
> - We have to map additional shadow page to prevent crash if
> speculative load happens near the end of the mapped memory.
> This would significantly complicate upcoming memory hotplug support.
>
> I wasn't able to notice any performance degradation with this patch.
> So these speculative loads is just a pain with no gain, let's remove
> them.
>
> Signed-off-by: Andrey Ryabinin <aryabinin@...tuozzo.com>
Acked-by: Dmitry Vyukov <dvyukov@...gle.com>
> ---
> mm/kasan/kasan.c | 98 +++++++++-----------------------------------------------
> 1 file changed, 16 insertions(+), 82 deletions(-)
>
> diff --git a/mm/kasan/kasan.c b/mm/kasan/kasan.c
> index 85ee45b07615..e6fe07a98677 100644
> --- a/mm/kasan/kasan.c
> +++ b/mm/kasan/kasan.c
> @@ -134,94 +134,30 @@ static __always_inline bool memory_is_poisoned_1(unsigned long addr)
> return false;
> }
>
> -static __always_inline bool memory_is_poisoned_2(unsigned long addr)
> +static __always_inline bool memory_is_poisoned_2_4_8(unsigned long addr,
> + unsigned long size)
> {
> - u16 *shadow_addr = (u16 *)kasan_mem_to_shadow((void *)addr);
> -
> - if (unlikely(*shadow_addr)) {
> - if (memory_is_poisoned_1(addr + 1))
> - return true;
> -
> - /*
> - * If single shadow byte covers 2-byte access, we don't
> - * need to do anything more. Otherwise, test the first
> - * shadow byte.
> - */
> - if (likely(((addr + 1) & KASAN_SHADOW_MASK) != 0))
> - return false;
> -
> - return unlikely(*(u8 *)shadow_addr);
> - }
> + u8 *shadow_addr = (u8 *)kasan_mem_to_shadow((void *)addr);
>
> - return false;
> -}
> -
> -static __always_inline bool memory_is_poisoned_4(unsigned long addr)
> -{
> - u16 *shadow_addr = (u16 *)kasan_mem_to_shadow((void *)addr);
> -
> - if (unlikely(*shadow_addr)) {
> - if (memory_is_poisoned_1(addr + 3))
> - return true;
> -
> - /*
> - * If single shadow byte covers 4-byte access, we don't
> - * need to do anything more. Otherwise, test the first
> - * shadow byte.
> - */
> - if (likely(((addr + 3) & KASAN_SHADOW_MASK) >= 3))
> - return false;
> -
> - return unlikely(*(u8 *)shadow_addr);
> - }
> -
> - return false;
> -}
> -
> -static __always_inline bool memory_is_poisoned_8(unsigned long addr)
> -{
> - u16 *shadow_addr = (u16 *)kasan_mem_to_shadow((void *)addr);
> -
> - if (unlikely(*shadow_addr)) {
> - if (memory_is_poisoned_1(addr + 7))
> - return true;
> -
> - /*
> - * If single shadow byte covers 8-byte access, we don't
> - * need to do anything more. Otherwise, test the first
> - * shadow byte.
> - */
> - if (likely(IS_ALIGNED(addr, KASAN_SHADOW_SCALE_SIZE)))
> - return false;
> -
> - return unlikely(*(u8 *)shadow_addr);
> - }
> + /*
> + * Access crosses 8(shadow size)-byte boundary. Such access maps
> + * into 2 shadow bytes, so we need to check them both.
> + */
> + if (unlikely(((addr + size - 1) & KASAN_SHADOW_MASK) < size - 1))
> + return *shadow_addr || memory_is_poisoned_1(addr + size - 1);
>
> - return false;
> + return memory_is_poisoned_1(addr + size - 1);
> }
>
> static __always_inline bool memory_is_poisoned_16(unsigned long addr)
> {
> - u32 *shadow_addr = (u32 *)kasan_mem_to_shadow((void *)addr);
> -
> - if (unlikely(*shadow_addr)) {
> - u16 shadow_first_bytes = *(u16 *)shadow_addr;
> -
> - if (unlikely(shadow_first_bytes))
> - return true;
> -
> - /*
> - * If two shadow bytes covers 16-byte access, we don't
> - * need to do anything more. Otherwise, test the last
> - * shadow byte.
> - */
> - if (likely(IS_ALIGNED(addr, KASAN_SHADOW_SCALE_SIZE)))
> - return false;
> + u16 *shadow_addr = (u16 *)kasan_mem_to_shadow((void *)addr);
>
> - return memory_is_poisoned_1(addr + 15);
> - }
> + /* Unaligned 16-bytes access maps into 3 shadow bytes. */
> + if (unlikely(!IS_ALIGNED(addr, KASAN_SHADOW_SCALE_SIZE)))
> + return *shadow_addr || memory_is_poisoned_1(addr + 15);
>
> - return false;
> + return *shadow_addr;
> }
>
> static __always_inline unsigned long bytes_is_nonzero(const u8 *start,
> @@ -292,11 +228,9 @@ static __always_inline bool memory_is_poisoned(unsigned long addr, size_t size)
> case 1:
> return memory_is_poisoned_1(addr);
> case 2:
> - return memory_is_poisoned_2(addr);
> case 4:
> - return memory_is_poisoned_4(addr);
> case 8:
> - return memory_is_poisoned_8(addr);
> + return memory_is_poisoned_2_4_8(addr, size);
> case 16:
> return memory_is_poisoned_16(addr);
> default:
> --
> 2.13.0
>
Powered by blists - more mailing lists