linux-kernel - Re: [PATCH v6 1/4] mm/slub: enable debugging memory wasting of kmalloc

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <8f2cc14c-d8b3-728d-7d12-13f2c1b0d8a0@suse.cz>
Date:   Thu, 3 Nov 2022 17:57:52 +0100
From:   Vlastimil Babka <vbabka@...e.cz>
To:     Hyeonggon Yoo <42.hyeyoo@...il.com>,
        Feng Tang <feng.tang@...el.com>
Cc:     John Thomson <lists@...nthomson.fastmail.com.au>,
        Andrew Morton <akpm@...ux-foundation.org>,
        Christoph Lameter <cl@...ux.com>,
        Pekka Enberg <penberg@...nel.org>,
        David Rientjes <rientjes@...gle.com>,
        Joonsoo Kim <iamjoonsoo.kim@....com>,
        Roman Gushchin <roman.gushchin@...ux.dev>,
        Dmitry Vyukov <dvyukov@...gle.com>,
        Jonathan Corbet <corbet@....net>,
        Andrey Konovalov <andreyknvl@...il.com>,
        "Hansen, Dave" <dave.hansen@...el.com>,
        "linux-mm@...ck.org" <linux-mm@...ck.org>,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
        "kasan-dev@...glegroups.com" <kasan-dev@...glegroups.com>,
        Robin Murphy <robin.murphy@....com>,
        John Garry <john.garry@...wei.com>,
        Kefeng Wang <wangkefeng.wang@...wei.com>,
        Thomas Bogendoerfer <tsbogend@...ha.franken.de>,
        "linux-mips@...r.kernel.org" <linux-mips@...r.kernel.org>
Subject: Re: [PATCH v6 1/4] mm/slub: enable debugging memory wasting of
 kmalloc

On 11/3/22 15:36, Hyeonggon Yoo wrote:
> On Thu, Nov 03, 2022 at 10:16:12PM +0800, Feng Tang wrote:
>> On Thu, Nov 03, 2022 at 09:33:28AM +0100, Vlastimil Babka wrote:
>> [...]
>> > >> AFAICS before this patch, we "survive" "kmem_cache *s" being NULL as
>> > >> slab_pre_alloc_hook() will happen to return NULL and we bail out from
>> > >> slab_alloc_node(). But this is a side-effect, not an intended protection.
>> > >> Also the CONFIG_TRACING variant of kmalloc_trace() would have called
>> > >> trace_kmalloc dereferencing s->size anyway even before this patch.
>> > >> 
>> > >> I don't think we should add WARNS in the slab hot paths just to prevent this
>> > >> rare error of using slab too early. At most VM_WARN... would be acceptable
>> > >> but still not necessary as crashing immediately from a NULL pointer is
>> > >> sufficient.
>> > >> 
>> > >> So IMHO mips should fix their soc init, 
>> > > 
>> > > Yes, for the mips fix, John has proposed to defer the calling of prom_soc_init(),
>> > > which looks reasonable.
>> > > 
>> > >> and we should look into the
>> > >> CONFIG_TRACING=n variant of kmalloc_trace(), to pass orig_size properly.
>> > > 
>> > > You mean check if the pointer is NULL and bail out early. 
>> > 
>> > No I mean here:
>> > 
>> > #else /* CONFIG_TRACING */
>> > /* Save a function call when CONFIG_TRACING=n */
>> > static __always_inline __alloc_size(3)                                   
>> > void *kmalloc_trace(struct kmem_cache *s, gfp_t flags, size_t size)
>> > {       
>> >         void *ret = kmem_cache_alloc(s, flags);
>> >                     
>> >         ret = kasan_kmalloc(s, ret, size, flags);
>> >         return ret;
>> > }
>> > 
>> > we call kmem_cache_alloc() and discard the size parameter, so it will assume
>> > s->object_size (and as the side-effect, crash if s is NULL). We shouldn't
>> > add "s is NULL?" checks, but fix passing the size - probably switch to
>> > __kmem_cache_alloc_node()? and in the following kmalloc_node_trace() analogically.
>>  
>> Got it, thanks! I might have missed it during some rebasing for the
>> kmalloc wastage debug patch.
> 
> That was good catch and I missed too!
> But FYI I'm suggesting to drop CONFIG_TRACING=n variant:
> 
> https://lore.kernel.org/linux-mm/20221101222520.never.109-kees@kernel.org/T/#m20ecf14390e406247bde0ea9cce368f469c539ed
> 
> Any thoughts?

I'll get to it, also I think we were pondering that within your series too,
but I wanted to postpone in case somebody objects to the extra function call
it creates.
But that would be for 6.2 anyway while I'll collect the fix here for 6.1.

>> 
>> How about the following fix?
>> 
>> Thanks,
>> Feng
>> 
>> ---
>> From 9f9fa9da8946fd44625f873c0f51167357075be1 Mon Sep 17 00:00:00 2001
>> From: Feng Tang <feng.tang@...el.com>
>> Date: Thu, 3 Nov 2022 21:32:10 +0800
>> Subject: [PATCH] mm/slub: Add missing orig_size parameter for wastage debug
>> 
>> commit 6edf2576a6cc ("mm/slub: enable debugging memory wasting of
>> kmalloc") was introduced for debugging kmalloc memory wastage,
>> and it missed to pass the original request size for kmalloc_trace()
>> and kmalloc_node_trace() in CONFIG_TRACING=n path.
>> 
>> Fix it by using __kmem_cache_alloc_node() with correct original
>> request size.
>> 
>> Fixes: 6edf2576a6cc ("mm/slub: enable debugging memory wasting of kmalloc")
>> Suggested-by: Vlastimil Babka <vbabka@...e.cz>
>> Signed-off-by: Feng Tang <feng.tang@...el.com>
>> ---
>>  include/linux/slab.h | 9 +++++++--
>>  1 file changed, 7 insertions(+), 2 deletions(-)
>> 
>> diff --git a/include/linux/slab.h b/include/linux/slab.h
>> index 90877fcde70b..9691afa569e1 100644
>> --- a/include/linux/slab.h
>> +++ b/include/linux/slab.h
>> @@ -469,6 +469,9 @@ void *__kmalloc_node(size_t size, gfp_t flags, int node) __assume_kmalloc_alignm
>>  							 __alloc_size(1);
>>  void *kmem_cache_alloc_node(struct kmem_cache *s, gfp_t flags, int node) __assume_slab_alignment
>>  									 __malloc;
>> +void *__kmem_cache_alloc_node(struct kmem_cache *s, gfp_t flags, int node,
>> +				size_t orig_size, unsigned long caller) __assume_slab_alignment
>> +									 __malloc;
>>  
>>  #ifdef CONFIG_TRACING
>>  void *kmalloc_trace(struct kmem_cache *s, gfp_t flags, size_t size)
>> @@ -482,7 +485,8 @@ void *kmalloc_node_trace(struct kmem_cache *s, gfp_t gfpflags,
>>  static __always_inline __alloc_size(3)
>>  void *kmalloc_trace(struct kmem_cache *s, gfp_t flags, size_t size)
>>  {
>> -	void *ret = kmem_cache_alloc(s, flags);
>> +	void *ret = __kmem_cache_alloc_node(s, flags, NUMA_NO_NODE,
>> +					    size, _RET_IP_);
>>  
>>  	ret = kasan_kmalloc(s, ret, size, flags);
>>  	return ret;
>> @@ -492,7 +496,8 @@ static __always_inline __alloc_size(4)
>>  void *kmalloc_node_trace(struct kmem_cache *s, gfp_t gfpflags,
>>  			 int node, size_t size)
>>  {
>> -	void *ret = kmem_cache_alloc_node(s, gfpflags, node);
>> +	void *ret = __kmem_cache_alloc_node(s, gfpflags, node,
>> +					    size, _RET_IP_);
>>  
>>  	ret = kasan_kmalloc(s, ret, size, gfpflags);
>>  	return ret;
>> -- 
>> 2.34.1
>> 
>> 
>> 
>