[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <cd4c22c3-2901-4dee-b6b4-e6981848cb70@suse.cz>
Date: Tue, 2 Jan 2024 17:10:53 +0100
From: Vlastimil Babka <vbabka@...e.cz>
To: Ilya Leoshkevich <iii@...ux.ibm.com>,
Alexander Gordeev <agordeev@...ux.ibm.com>,
Alexander Potapenko <glider@...gle.com>,
Andrew Morton <akpm@...ux-foundation.org>, Christoph Lameter <cl@...ux.com>,
David Rientjes <rientjes@...gle.com>, Heiko Carstens <hca@...ux.ibm.com>,
Joonsoo Kim <iamjoonsoo.kim@....com>, Marco Elver <elver@...gle.com>,
Masami Hiramatsu <mhiramat@...nel.org>, Pekka Enberg <penberg@...nel.org>,
Steven Rostedt <rostedt@...dmis.org>, Vasily Gorbik <gor@...ux.ibm.com>
Cc: Christian Borntraeger <borntraeger@...ux.ibm.com>,
Dmitry Vyukov <dvyukov@...gle.com>, Hyeonggon Yoo <42.hyeyoo@...il.com>,
kasan-dev@...glegroups.com, linux-kernel@...r.kernel.org,
linux-mm@...ck.org, linux-s390@...r.kernel.org,
linux-trace-kernel@...r.kernel.org, Mark Rutland <mark.rutland@....com>,
Roman Gushchin <roman.gushchin@...ux.dev>,
Sven Schnelle <svens@...ux.ibm.com>
Subject: Re: [PATCH v3 15/34] mm: slub: Unpoison the memchr_inv() return value
On 12/14/23 00:24, Ilya Leoshkevich wrote:
> Even though the KMSAN warnings generated by memchr_inv() are suppressed
> by metadata_access_enable(), its return value may still be poisoned.
>
> The reason is that the last iteration of memchr_inv() returns
> `*start != value ? start : NULL`, where *start is poisoned. Because of
> this, somewhat counterintuitively, the shadow value computed by
> visitSelectInst() is equal to `(uintptr_t)start`.
>
> The intention behind guarding memchr_inv() behind
> metadata_access_enable() is to touch poisoned metadata without
> triggering KMSAN, so unpoison its return value.
>
> Signed-off-by: Ilya Leoshkevich <iii@...ux.ibm.com>
Acked-by: Vlastimil Babka <vbabka@...e.cz>
> ---
> mm/slub.c | 2 ++
> 1 file changed, 2 insertions(+)
>
> diff --git a/mm/slub.c b/mm/slub.c
> index 2d29d368894c..802702748925 100644
> --- a/mm/slub.c
> +++ b/mm/slub.c
> @@ -1076,6 +1076,7 @@ static int check_bytes_and_report(struct kmem_cache *s, struct slab *slab,
> metadata_access_enable();
> fault = memchr_inv(kasan_reset_tag(start), value, bytes);
> metadata_access_disable();
> + kmsan_unpoison_memory(&fault, sizeof(fault));
> if (!fault)
> return 1;
>
> @@ -1182,6 +1183,7 @@ static void slab_pad_check(struct kmem_cache *s, struct slab *slab)
> metadata_access_enable();
> fault = memchr_inv(kasan_reset_tag(pad), POISON_INUSE, remainder);
> metadata_access_disable();
> + kmsan_unpoison_memory(&fault, sizeof(fault));
> if (!fault)
> return;
> while (end > fault && end[-1] == POISON_INUSE)
Powered by blists - more mailing lists