Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 20E72C433FE for ; Mon, 20 Dec 2021 21:56:07 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S231704AbhLTV4G (ORCPT ); Mon, 20 Dec 2021 16:56:06 -0500 Received: from out0.migadu.com ([94.23.1.103]:44517 "EHLO out0.migadu.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S230393AbhLTV4E (ORCPT ); Mon, 20 Dec 2021 16:56:04 -0500 X-Report-Abuse: Please report any abuse attempt to abuse@migadu.com and include these headers. DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linux.dev; s=key1; t=1640037363; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding; bh=1NLhsQtLh77LdZHgbT2kusq/cP+dmXSyIjhww1oL3wE=; b=e8P88o5MaHdVGc8OQf5JJgbMpgqrXP0Jdfxzk4WRTxfgaVMN2N9g1YArJiz9VGb7vPNrHS /GUrUoMY0f/quKjwGChhnxmE176tJ1z/9JOogvVTHYMrmO07LxHbzHbqMw0f9FMo4E24gc Fzn/GtT75f/xyCV+woSTP8Jy3e3Vj8g= From: andrey.konovalov@linux.dev To: Alexander Potapenko , Marco Elver , Andrew Morton Cc: Andrey Konovalov , Dmitry Vyukov , Andrey Ryabinin , kasan-dev@googlegroups.com, linux-mm@kvack.org, linux-kernel@vger.kernel.org, Andrey Konovalov Subject: [PATCH v2] kasan: fix quarantine conflicting with init_on_free Date: Mon, 20 Dec 2021 22:55:59 +0100 Message-Id: <2805da5df4b57138fdacd671f5d227d58950ba54.1640037083.git.andreyknvl@google.com> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Migadu-Flow: FLOW_OUT X-Migadu-Auth-User: linux.dev Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Andrey Konovalov KASAN's quarantine might save its metadata inside freed objects. As this happens after the memory is zeroed by the slab allocator when init_on_free is enabled, the memory coming out of quarantine is not properly zeroed. This causes lib/test_meminit.c tests to fail with Generic KASAN. Zero the metadata when the object is removed from quarantine. Fixes: 6471384af2a6 ("mm: security: introduce init_on_alloc=1 and init_on_free=1 boot options") Signed-off-by: Andrey Konovalov --- Changes v1->v2: - Use memzero_explicit() instead of memset(). --- mm/kasan/quarantine.c | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/mm/kasan/quarantine.c b/mm/kasan/quarantine.c index 587da8995f2d..08291ed33e93 100644 --- a/mm/kasan/quarantine.c +++ b/mm/kasan/quarantine.c @@ -132,11 +132,22 @@ static void *qlink_to_object(struct qlist_node *qlink, struct kmem_cache *cache) static void qlink_free(struct qlist_node *qlink, struct kmem_cache *cache) { void *object = qlink_to_object(qlink, cache); + struct kasan_free_meta *meta = kasan_get_free_meta(cache, object); unsigned long flags; if (IS_ENABLED(CONFIG_SLAB)) local_irq_save(flags); + /* + * If init_on_free is enabled and KASAN's free metadata is stored in + * the object, zero the metadata. Otherwise, the object's memory will + * not be properly zeroed, as KASAN saves the metadata after the slab + * allocator zeroes the object. + */ + if (slab_want_init_on_free(cache) && + cache->kasan_info.free_meta_offset == 0) + memzero_explicit(meta, sizeof(*meta)); + /* * As the object now gets freed from the quarantine, assume that its * free track is no longer valid. -- 2.25.1