lkml.org 
[lkml]   [2021]   [Jun]   [21]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.4 78/90] mm/slub: clarify verification reporting
    Date
    From: Kees Cook <keescook@chromium.org>

    commit 8669dbab2ae56085c128894b181c2aa50f97e368 upstream.

    Patch series "Actually fix freelist pointer vs redzoning", v4.

    This fixes redzoning vs the freelist pointer (both for middle-position
    and very small caches). Both are "theoretical" fixes, in that I see no
    evidence of such small-sized caches actually be used in the kernel, but
    that's no reason to let the bugs continue to exist, especially since
    people doing local development keep tripping over it. :)

    This patch (of 3):

    Instead of repeating "Redzone" and "Poison", clarify which sides of
    those zones got tripped. Additionally fix column alignment in the
    trailer.

    Before:

    BUG test (Tainted: G B ): Redzone overwritten
    ...
    Redzone (____ptrval____): bb bb bb bb bb bb bb bb ........
    Object (____ptrval____): f6 f4 a5 40 1d e8 ...@..
    Redzone (____ptrval____): 1a aa ..
    Padding (____ptrval____): 00 00 00 00 00 00 00 00 ........

    After:

    BUG test (Tainted: G B ): Right Redzone overwritten
    ...
    Redzone (____ptrval____): bb bb bb bb bb bb bb bb ........
    Object (____ptrval____): f6 f4 a5 40 1d e8 ...@..
    Redzone (____ptrval____): 1a aa ..
    Padding (____ptrval____): 00 00 00 00 00 00 00 00 ........

    The earlier commits that slowly resulted in the "Before" reporting were:

    d86bd1bece6f ("mm/slub: support left redzone")
    ffc79d288000 ("slub: use print_hex_dump")
    2492268472e7 ("SLUB: change error reporting format to follow lockdep loosely")

    Link: https://lkml.kernel.org/r/20210608183955.280836-1-keescook@chromium.org
    Link: https://lkml.kernel.org/r/20210608183955.280836-2-keescook@chromium.org
    Link: https://lore.kernel.org/lkml/cfdb11d7-fb8e-e578-c939-f7f5fb69a6bd@suse.cz/
    Signed-off-by: Kees Cook <keescook@chromium.org>
    Acked-by: Vlastimil Babka <vbabka@suse.cz>
    Cc: Marco Elver <elver@google.com>
    Cc: "Lin, Zhenpeng" <zplin@psu.edu>
    Cc: Christoph Lameter <cl@linux.com>
    Cc: Pekka Enberg <penberg@kernel.org>
    Cc: David Rientjes <rientjes@google.com>
    Cc: Joonsoo Kim <iamjoonsoo.kim@lge.com>
    Cc: Roman Gushchin <guro@fb.com>
    Cc: <stable@vger.kernel.org>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    ---
    Documentation/vm/slub.rst | 10 +++++-----
    mm/slub.c | 14 +++++++-------
    2 files changed, 12 insertions(+), 12 deletions(-)

    --- a/Documentation/vm/slub.rst
    +++ b/Documentation/vm/slub.rst
    @@ -160,7 +160,7 @@ SLUB Debug output
    Here is a sample of slub debug output::

    ====================================================================
    - BUG kmalloc-8: Redzone overwritten
    + BUG kmalloc-8: Right Redzone overwritten
    --------------------------------------------------------------------

    INFO: 0xc90f6d28-0xc90f6d2b. First byte 0x00 instead of 0xcc
    @@ -168,10 +168,10 @@ Here is a sample of slub debug output::
    INFO: Object 0xc90f6d20 @offset=3360 fp=0xc90f6d58
    INFO: Allocated in get_modalias+0x61/0xf5 age=53 cpu=1 pid=554

    - Bytes b4 0xc90f6d10: 00 00 00 00 00 00 00 00 5a 5a 5a 5a 5a 5a 5a 5a ........ZZZZZZZZ
    - Object 0xc90f6d20: 31 30 31 39 2e 30 30 35 1019.005
    - Redzone 0xc90f6d28: 00 cc cc cc .
    - Padding 0xc90f6d50: 5a 5a 5a 5a 5a 5a 5a 5a ZZZZZZZZ
    + Bytes b4 (0xc90f6d10): 00 00 00 00 00 00 00 00 5a 5a 5a 5a 5a 5a 5a 5a ........ZZZZZZZZ
    + Object (0xc90f6d20): 31 30 31 39 2e 30 30 35 1019.005
    + Redzone (0xc90f6d28): 00 cc cc cc .
    + Padding (0xc90f6d50): 5a 5a 5a 5a 5a 5a 5a 5a ZZZZZZZZ

    [<c010523d>] dump_trace+0x63/0x1eb
    [<c01053df>] show_trace_log_lvl+0x1a/0x2f
    --- a/mm/slub.c
    +++ b/mm/slub.c
    @@ -688,15 +688,15 @@ static void print_trailer(struct kmem_ca
    p, p - addr, get_freepointer(s, p));

    if (s->flags & SLAB_RED_ZONE)
    - print_section(KERN_ERR, "Redzone ", p - s->red_left_pad,
    + print_section(KERN_ERR, "Redzone ", p - s->red_left_pad,
    s->red_left_pad);
    else if (p > addr + 16)
    print_section(KERN_ERR, "Bytes b4 ", p - 16, 16);

    - print_section(KERN_ERR, "Object ", p,
    + print_section(KERN_ERR, "Object ", p,
    min_t(unsigned int, s->object_size, PAGE_SIZE));
    if (s->flags & SLAB_RED_ZONE)
    - print_section(KERN_ERR, "Redzone ", p + s->object_size,
    + print_section(KERN_ERR, "Redzone ", p + s->object_size,
    s->inuse - s->object_size);

    off = get_info_end(s);
    @@ -708,7 +708,7 @@ static void print_trailer(struct kmem_ca

    if (off != size_from_object(s))
    /* Beginning of the filler is the free pointer */
    - print_section(KERN_ERR, "Padding ", p + off,
    + print_section(KERN_ERR, "Padding ", p + off,
    size_from_object(s) - off);

    dump_stack();
    @@ -882,11 +882,11 @@ static int check_object(struct kmem_cach
    u8 *endobject = object + s->object_size;

    if (s->flags & SLAB_RED_ZONE) {
    - if (!check_bytes_and_report(s, page, object, "Redzone",
    + if (!check_bytes_and_report(s, page, object, "Left Redzone",
    object - s->red_left_pad, val, s->red_left_pad))
    return 0;

    - if (!check_bytes_and_report(s, page, object, "Redzone",
    + if (!check_bytes_and_report(s, page, object, "Right Redzone",
    endobject, val, s->inuse - s->object_size))
    return 0;
    } else {
    @@ -901,7 +901,7 @@ static int check_object(struct kmem_cach
    if (val != SLUB_RED_ACTIVE && (s->flags & __OBJECT_POISON) &&
    (!check_bytes_and_report(s, page, p, "Poison", p,
    POISON_FREE, s->object_size - 1) ||
    - !check_bytes_and_report(s, page, p, "Poison",
    + !check_bytes_and_report(s, page, p, "End Poison",
    p + s->object_size - 1, POISON_END, 1)))
    return 0;
    /*

    \
     
     \ /
      Last update: 2021-06-21 18:23    [W:4.159 / U:0.136 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site