linux-kernel - Re: [PATCH v6 1/4] mm/slub: enable debugging memory wasting of kmalloc

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <9b71ae3e-7f53-4c9e-90c4-79d3d649f94c@app.fastmail.com>
Date:   Tue, 01 Nov 2022 00:18:19 +0000
From:   "John Thomson" <lists@...nthomson.fastmail.com.au>
To:     "Feng Tang" <feng.tang@...el.com>
Cc:     "Vlastimil Babka" <vbabka@...e.cz>,
        "Andrew Morton" <akpm@...ux-foundation.org>,
        "Christoph Lameter" <cl@...ux.com>,
        "Pekka Enberg" <penberg@...nel.org>,
        "David Rientjes" <rientjes@...gle.com>,
        "Joonsoo Kim" <iamjoonsoo.kim@....com>,
        "Roman Gushchin" <roman.gushchin@...ux.dev>,
        "Hyeonggon Yoo" <42.hyeyoo@...il.com>,
        "Dmitry Vyukov" <dvyukov@...gle.com>,
        "Jonathan Corbet" <corbet@....net>,
        "Andrey Konovalov" <andreyknvl@...il.com>,
        "Hansen, Dave" <dave.hansen@...el.com>,
        "linux-mm@...ck.org" <linux-mm@...ck.org>,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
        "kasan-dev@...glegroups.com" <kasan-dev@...glegroups.com>,
        "Robin Murphy" <robin.murphy@....com>,
        "John Garry" <john.garry@...wei.com>,
        "Kefeng Wang" <wangkefeng.wang@...wei.com>
Subject: Re: [PATCH v6 1/4] mm/slub: enable debugging memory wasting of kmalloc

On Mon, 31 Oct 2022, at 11:42, Feng Tang wrote:
> On Mon, Oct 31, 2022 at 10:05:58AM +0000, John Thomson wrote:
>> On Mon, 31 Oct 2022, at 02:36, Feng Tang wrote:
>> >> > 
>> >> > possibly relevant config options:
>> >> > grep -E '(SLUB|SLAB)' .config
>> >> > # SLAB allocator options
>> >> > # CONFIG_SLAB is not set
>> >> > CONFIG_SLUB=y
>> >> > CONFIG_SLAB_MERGE_DEFAULT=y
>> >> > # CONFIG_SLAB_FREELIST_RANDOM is not set
>> >> > # CONFIG_SLAB_FREELIST_HARDENED is not set
>> >> > # CONFIG_SLUB_STATS is not set
>> >> > CONFIG_SLUB_CPU_PARTIAL=y
>> >> > # end of SLAB allocator options
>> >> > # CONFIG_SLUB_DEBUG is not set
>> >> 
>> >> Also not having CONFIG_SLUB_DEBUG enabled means most of the code the 
>> >> patch/commit touches is not even active.
>> >> Could this be some miscompile or code layout change exposing some 
>> >> different bug, hmm.
>> 
>> Yes, it could be.
>> 
>> >> Is it any different if you do enable CONFIG_SLUB_DEBUG ?
>> 
>> No change
>> 
>> >> Or change to CONFIG_SLAB? (that would be really weird if not)
>> 
>> This boots fine
>> 
>> > I haven't found any clue from the code either, and I compiled
>> > kernel with the config above and tested booting on an Alder-lake
>> > desktop and a QEMU, which boot fine.
>> >
>> > Could you provide the full kernel config and demsg (in compressed
>> > format if you think it's too big), so we can check more?
>> 
>> Attached
>> 
>> > Thanks,
>> > Feng
>> 
>> vmlinux is bigger, and entry point is larger (0x8074081c vs 0x807407dc revert vs 0x8073fcbc),
>> so that may be it? Or not?
>> revert + SLUB_DEBUG + SLUB_DEBUG_ON is bigger still, but does successfully boot.
>> vmlinux entry point is 0x8074705c
>
> Thanks for prompt info!
>
> As I can't reproduce it locally yet, could you help try 3 tests separately:
> * change the O2/O3 compile option to O1
> * try the attached 0001 patch (which cut part of commit)
> * try attached 0001+0002 patch

None of these changed my outcome.

I also tried compiling the same linux tree & config with the Bootlin toolchain
(mipsel-buildroot-linux-gnu-gcc.br_real (Buildroot 2021.11-4428-g6b6741b) 12.2.0)
with the same results.
I will look into finding or building a mips clang toolchain.

No JTAG capability to debug, sorry.

I get the same outcome with either the ZBOOT vmlinuz, or vmlinux

Same happening with 6.1-rc3


After some blind poking around changing (how much of the commit affected) mm/slub.c,
I may have got lucky. it appears as though this is all I need to boot:
(against 6.1-rc3), and with the Bootlin toolchain. Will test my other build system as well.

--- a/mm/slub.c
+++ b/mm/slub.c
@@ -3276,7 +3276,7 @@ static void *__slab_alloc(struct kmem_cache *s, gfp_t gfpflags, int node,
        c = slub_get_cpu_ptr(s->cpu_slab);
 #endif
 
-       p = ___slab_alloc(s, gfpflags, node, addr, c, orig_size);
+       p = ___slab_alloc(s, gfpflags, node, addr, c, 0);
 #ifdef CONFIG_PREEMPT_COUNT
        slub_put_cpu_ptr(s->cpu_slab);
 #endif


Would like to hear your thoughts, but I will keep digging.

>
> Thanks!
>
>
> - Feng
>
>
>
>
> Attachments:
> * 0001-reduced-slub-patch.patch
> * 0002-reorder-the-partial_context-initialization.patch

-- 
  John Thomson