netdev - Re: [TEST] TCP MD5 vs kmemleak

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <ZnG-OII33VP7bPJp@pc636>
Date: Tue, 18 Jun 2024 19:04:56 +0200
From: Uladzislau Rezki <urezki@...il.com>
To: Jakub Kicinski <kuba@...nel.org>
Cc: "Paul E. McKenney" <paulmck@...nel.org>,
	Paolo Abeni <pabeni@...hat.com>,
	Dmitry Safonov <0x7f454c46@...il.com>,
	"netdev@...r.kernel.org" <netdev@...r.kernel.org>,
	rcu@...r.kernel.org
Subject: Re: [TEST] TCP MD5 vs kmemleak

On Tue, Jun 18, 2024 at 10:02:10AM -0700, Jakub Kicinski wrote:
> On Tue, 18 Jun 2024 09:42:35 -0700 Paul E. McKenney wrote:
> > > FTR, with mptcp self-tests we hit a few kmemleak false positive on RCU
> > > freed pointers, that where addressed by to this patch:
> > > 
> > > commit 5f98fd034ca6fd1ab8c91a3488968a0e9caaabf6
> > > Author: Catalin Marinas <catalin.marinas@....com>
> > > Date:   Sat Sep 30 17:46:56 2023 +0000
> > > 
> > >     rcu: kmemleak: Ignore kmemleak false positives when RCU-freeing objects
> > > 
> > > I'm wondering if this is hitting something similar? Possibly due to
> > > lazy RCU callbacks invoked after MSECS_MIN_AGE???  
> 
> Dmitry mentioned this commit, too, but we use the same config for MPTCP
> tests, and while we repro TCP AO failures quite frequently, mptcp
> doesn't seem to have failed once.
> 
> > Fun!  ;-)
> > 
> > This commit handles memory passed to kfree_rcu() and friends, but
> > not memory passed to call_rcu() and friends.  Of course, call_rcu()
> > does not necessarily know the full extent of the memory passed to it,
> > for example, if passed a linked list, call_rcu() will know only about
> > the head of that list.
> > 
> > There are similar challenges with synchronize_rcu() and friends.
> 
> To be clear I think Dmitry was suspecting kfree_rcu(), he mentioned
> call_rcu() as something he was expecting to have a similar issue but 
> it in fact appeared immune.
> 
In the kfree_rcu() there is "an ignore" injection:

<snip>
	/*
	 * The kvfree_rcu() caller considers the pointer freed at this point
	 * and likely removes any references to it. Since the actual slab
	 * freeing (and kmemleak_free()) is deferred, tell kmemleak to ignore
	 * this object (no scanning or false positives reporting).
	 */
	kmemleak_ignore(ptr);

	// Set timer to drain after KFREE_DRAIN_JIFFIES.
	if (rcu_scheduler_active == RCU_SCHEDULER_RUNNING)
		schedule_delayed_monitor_work(krcp);
<snip>

--
Uladzislau Rezki