linux-kernel - Re: [PATCH 1/1] mm: slub: fix corrupted freechain in deactivate

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <343df8bf-9a30-fd33-ef0b-c2ac3cc3baa5@oracle.com>
Date:   Sun, 12 Apr 2020 15:20:46 -0700
From:   Dongli Zhang <dongli.zhang@...cle.com>
To:     linux-mm@...ck.org
Cc:     cl@...ux.com, penberg@...nel.org, rientjes@...gle.com,
        iamjoonsoo.kim@....com, akpm@...ux-foundation.org,
        linux-kernel@...r.kernel.org, joe.jin@...cle.com
Subject: Re: [PATCH 1/1] mm: slub: fix corrupted freechain in
 deactivate_slab()

Hi,

May I get the feedback for this patch?

This reduces the chance of page fault when freepointer is corrupted while
"slub_debug=F" is set.

Thank you very much!

Dongli Zhang

On 3/30/20 8:14 PM, Dongli Zhang wrote:
> The slub_debug is able to fix the corrupted slab freelist/page. However,
> alloc_debug_processing() only checks the validity of current and next
> freepointer during allocation path. As a result, once some objects have
> their freepointers corrupted, deactivate_slab() may lead to page fault.
> 
> Below is from a test kernel module when
> 'slub_debug=PUF,kmalloc-128 slub_nomerge'. The test kernel corrupts the
> freepointer of one free object on purpose. Unfortunately, deactivate_slab()
> does not detect it when iterating the freechain.
> 
> [ 92.665260] BUG: unable to handle page fault for address: 00000000123456f8
> [ 92.671597] #PF: supervisor read access in kernel mode
> [ 92.676159] #PF: error_code(0x0000) - not-present page
> [ 92.681666] PGD 0 P4D 0
> [ 92.684923] Oops: 0000 [#1] SMP PTI
> ... ...
> [ 92.706684] RIP: 0010:deactivate_slab.isra.92+0xed/0x490
> ... ...
> [ 92.819781] Call Trace:
> [ 92.823129]  ? ext4_htree_store_dirent+0x30/0xf0
> [ 92.829488]  ? ext4_htree_store_dirent+0x30/0xf0
> [ 92.834852]  ? stack_trace_save+0x46/0x70
> [ 92.839342]  ? init_object+0x66/0x80
> [ 92.843729]  ? ___slab_alloc+0x536/0x570
> [ 92.847664]  ___slab_alloc+0x536/0x570
> [ 92.851696]  ? __find_get_block+0x23d/0x2c0
> [ 92.856763]  ? ext4_htree_store_dirent+0x30/0xf0
> [ 92.862258]  ? _cond_resched+0x10/0x40
> [ 92.866925]  ? __getblk_gfp+0x27/0x2a0
> [ 92.872136]  ? ext4_htree_store_dirent+0x30/0xf0
> [ 92.878394]  ? __slab_alloc+0x17/0x30
> [ 92.883222]  __slab_alloc+0x17/0x30
> [ 92.887210]  __kmalloc+0x1d9/0x200
> [ 92.891448]  ext4_htree_store_dirent+0x30/0xf0
> [ 92.896748]  htree_dirblock_to_tree+0xcb/0x1c0
> [ 92.902398]  ext4_htree_fill_tree+0x1bc/0x2d0
> [ 92.907749]  ext4_readdir+0x54f/0x920
> [ 92.912725]  iterate_dir+0x88/0x190
> [ 92.917072]  __x64_sys_getdents+0xa6/0x140
> [ 92.922760]  ? fillonedir+0xb0/0xb0
> [ 92.927020]  ? do_syscall_64+0x49/0x170
> [ 92.931603]  ? __ia32_sys_getdents+0x130/0x130
> [ 92.937012]  do_syscall_64+0x49/0x170
> [ 92.940754]  entry_SYSCALL_64_after_hwframe+0x44/0xa9
> 
> Therefore, this patch adds extra consistency check in deactivate_slab().
> Once an object's freepointer is corrupted, all following objects starting
> at this object are isolated.
> 
> Signed-off-by: Dongli Zhang <dongli.zhang@...cle.com>
> ---
>  mm/slub.c | 14 ++++++++++++++
>  1 file changed, 14 insertions(+)
> 
> diff --git a/mm/slub.c b/mm/slub.c
> index 6589b41d5a60..c27e2d993535 100644
> --- a/mm/slub.c
> +++ b/mm/slub.c
> @@ -2082,6 +2082,20 @@ static void deactivate_slab(struct kmem_cache *s, struct page *page,
>  		void *prior;
>  		unsigned long counters;
>  
> +		if ((s->flags & SLAB_CONSISTENCY_CHECKS) &&
> +		    !check_valid_pointer(s, page, nextfree)) {
> +			/*
> +			 * If 'nextfree' is invalid, it is possible that
> +			 * the object at 'freelist' is already corrupted.
> +			 * Therefore, all objects starting at 'freelist'
> +			 * are isolated.
> +			 */
> +			object_err(s, page, freelist, "Freechain corrupt");
> +			freelist = NULL;
> +			slab_fix(s, "Isolate corrupted freechain");
> +			break;
> +		}
> +
>  		do {
>  			prior = page->freelist;
>  			counters = page->counters;
>