Received: by 2002:a05:6358:d09b:b0:dc:cd0c:909e with SMTP id jc27csp2106840rwb; Wed, 30 Nov 2022 02:23:02 -0800 (PST) X-Google-Smtp-Source: AA0mqf7kj2svf/lily+LwuPO5lU3DZ0giqX0QvaR6qJcRt+txs/Pxuqdc6UpEO6PauY+5X4kmRhg X-Received: by 2002:a05:6402:2946:b0:468:febe:ebab with SMTP id ed6-20020a056402294600b00468febeebabmr7767963edb.337.1669803781828; Wed, 30 Nov 2022 02:23:01 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1669803781; cv=none; d=google.com; s=arc-20160816; b=eLCdhsBvFBByBUsVW8eN1ZgQaX9mBF1WV2lqIoTrfvDpE3aFII6tcehPrnYtY9RXiE t6cUA8go3/CYOdKYzeR4UQcAcW2YphA4Df5mpYBxH7Tgvp0XntZ2cGXC5yCk7PJqJPQ9 cayjaQLjCfT+gprCvTno6LSgn4nI4Hy4jj/EQFB7m3dsgQiYhBod9DmI3d0brbMQyxKY GroBFYuuhRXWDzpY3+ZCv87VbdYYznpufbfjX7ZEGQT9Btbhl9EIrUDHoG6rEww/IiRi k3EDR8uWHFWAhoTT81VCgzSScpd9Lj9uMnGWdibDfm/FzxpnnNangvvsb/OwYVkdDuN7 KL8g== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :references:in-reply-to:message-id:date:subject:cc:to:from :dkim-signature; bh=HoRYI/mRl2a8hByRgyN9XAWD5nRydxhExVY5fJ/6gMk=; b=gzhgmHL8zaarfEYlG4fe7bBz7f4HN6OvY6ulsPl8/npMcae4HazhqKNgetFcJntm9A ONWXNzDwmhtPDMHeiqVDjkTPOQ6BDCGH8n/YX5B51prEcg1NTM7Pmz2LhqRRQYi6eZYE 2U8z38qiObUH15avR7QlmGNcGHG2pq24VM3vhQg7euslJd2DkLFwaeEbqvyhe3fMPEw7 ZL7NloTkpvTq1c2ZYS4mhaSjvMDd4wgH4bYqQpzlKtZJ0yoneFATZDbqvsdQPPDQq9Mo Aqr04+H89TO7PEMO0K4LhKs4N+gC5chWRSc4sZhu7HHIU+kKdD42PxMndG3DQyVtBVfv wwsQ== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@intel.com header.s=Intel header.b=L22zVcbU; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=intel.com Return-Path: Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20]) by mx.google.com with ESMTP id jg39-20020a170907972700b007c09fda33c7si884960ejc.824.2022.11.30.02.22.41; Wed, 30 Nov 2022 02:23:01 -0800 (PST) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Authentication-Results: mx.google.com; dkim=pass header.i=@intel.com header.s=Intel header.b=L22zVcbU; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=intel.com Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S235364AbiK3I54 (ORCPT + 84 others); Wed, 30 Nov 2022 03:57:56 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:60116 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S234252AbiK3I5y (ORCPT ); Wed, 30 Nov 2022 03:57:54 -0500 Received: from mga12.intel.com (mga12.intel.com [192.55.52.136]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 0E8572CE0A for ; Wed, 30 Nov 2022 00:57:52 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=intel.com; i=@intel.com; q=dns/txt; s=Intel; t=1669798672; x=1701334672; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version:content-transfer-encoding; bh=wUhL46G8FczpkZOn55ukJFkU1wtUnvW4RJiQUOueOmw=; b=L22zVcbUXLw3oi0isFiokU7qnNAdeTwelHanWr9oeyDeqC0BzO9mfPNJ ZcrcE7kr2Iy4Tcsei8Lopvd+mfejACYO1D/22gLR5f4115eguWtYeL374 aQaKZrnMSyUxOdIWtJT2vTJl/b9KFwnsgbElyTA9QIcxBP5c6PJEKGNm4 P70BAsyKrxUR5pySNdMUZf9p1rO9SMoswWug67ZEBU4rFV+FY0CzeT5fg MwA7ARhwYEQ2ZlNXeSvcl70c85FE4ezAk3dHohbdRUqY++MzM5gYDAPld w5M3d7syM9w96UD326tHY1CK9137c7lfWhlwOS4nFm4J4dVg06nLazICQ Q==; X-IronPort-AV: E=McAfee;i="6500,9779,10546"; a="295039302" X-IronPort-AV: E=Sophos;i="5.96,205,1665471600"; d="scan'208";a="295039302" Received: from fmsmga005.fm.intel.com ([10.253.24.32]) by fmsmga106.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 30 Nov 2022 00:57:51 -0800 X-ExtLoop1: 1 X-IronPort-AV: E=McAfee;i="6500,9779,10546"; a="973026150" X-IronPort-AV: E=Sophos;i="5.96,205,1665471600"; d="scan'208";a="973026150" Received: from feng-clx.sh.intel.com ([10.238.200.228]) by fmsmga005.fm.intel.com with ESMTP; 30 Nov 2022 00:57:48 -0800 From: Feng Tang To: Vlastimil Babka , Marco Elver , Andrew Morton , Oliver Glitta , Christoph Lameter , Pekka Enberg , David Rientjes , Joonsoo Kim , Roman Gushchin , Hyeonggon Yoo <42.hyeyoo@gmail.com> Cc: linux-mm@kvack.org, linux-kernel@vger.kernel.org, Feng Tang Subject: [PATCH v3 2/2] mm/slub, kunit: Add a test case for kmalloc redzone check Date: Wed, 30 Nov 2022 16:54:51 +0800 Message-Id: <20221130085451.3390992-2-feng.tang@intel.com> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20221130085451.3390992-1-feng.tang@intel.com> References: <20221130085451.3390992-1-feng.tang@intel.com> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Spam-Status: No, score=-4.4 required=5.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_MED, SPF_HELO_PASS,SPF_NONE autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org kmalloc redzone check for slub has been merged, and it's better to add a kunit case for it, which is inspired by a real-world case as described in commit 120ee599b5bf ("staging: octeon-usb: prevent memory corruption"): " octeon-hcd will crash the kernel when SLOB is used. This usually happens after the 18-byte control transfer when a device descriptor is read. The DMA engine is always transferring full 32-bit words and if the transfer is shorter, some random garbage appears after the buffer. The problem is not visible with SLUB since it rounds up the allocations to word boundary, and the extra bytes will go undetected. " To avoid interrupting the normal functioning of kmalloc caches, a kmem_cache mimicing kmalloc cache is created with similar flags, and kmalloc_trace() is used to really test the orig_size and redzone setup. Suggested-by: Vlastimil Babka Signed-off-by: Feng Tang --- Changelog: since v2: * only add SLAB_KMALLOC to SLAB_CACHE_FLAGS and SLAB_FLAGS_PERMITTEDa, and use new wrapper of cache creation(Vlastimil Babka) since v1: * create a new cache mimicing kmalloc cache, reduce dependency over global slub_debug setting (Vlastimil Babka) lib/slub_kunit.c | 22 ++++++++++++++++++++++ mm/slab.h | 4 +++- 2 files changed, 25 insertions(+), 1 deletion(-) diff --git a/lib/slub_kunit.c b/lib/slub_kunit.c index 5b0c8e7eb6dc..ff24879e3afe 100644 --- a/lib/slub_kunit.c +++ b/lib/slub_kunit.c @@ -135,6 +135,27 @@ static void test_clobber_redzone_free(struct kunit *test) kmem_cache_destroy(s); } +static void test_kmalloc_redzone_access(struct kunit *test) +{ + struct kmem_cache *s = test_kmem_cache_create("TestSlub_RZ_kmalloc", 32, + SLAB_KMALLOC|SLAB_STORE_USER|SLAB_RED_ZONE); + u8 *p = kmalloc_trace(s, GFP_KERNEL, 18); + + kasan_disable_current(); + + /* Suppress the -Warray-bounds warning */ + OPTIMIZER_HIDE_VAR(p); + p[18] = 0xab; + p[19] = 0xab; + + kmem_cache_free(s, p); + validate_slab_cache(s); + KUNIT_EXPECT_EQ(test, 2, slab_errors); + + kasan_enable_current(); + kmem_cache_destroy(s); +} + static int test_init(struct kunit *test) { slab_errors = 0; @@ -154,6 +175,7 @@ static struct kunit_case test_cases[] = { #endif KUNIT_CASE(test_clobber_redzone_free), + KUNIT_CASE(test_kmalloc_redzone_access), {} }; diff --git a/mm/slab.h b/mm/slab.h index c71590f3a22b..7cc432969945 100644 --- a/mm/slab.h +++ b/mm/slab.h @@ -344,7 +344,8 @@ static inline slab_flags_t kmem_cache_flags(unsigned int object_size, SLAB_ACCOUNT) #elif defined(CONFIG_SLUB) #define SLAB_CACHE_FLAGS (SLAB_NOLEAKTRACE | SLAB_RECLAIM_ACCOUNT | \ - SLAB_TEMPORARY | SLAB_ACCOUNT | SLAB_NO_USER_FLAGS) + SLAB_TEMPORARY | SLAB_ACCOUNT | \ + SLAB_NO_USER_FLAGS | SLAB_KMALLOC) #else #define SLAB_CACHE_FLAGS (SLAB_NOLEAKTRACE) #endif @@ -364,6 +365,7 @@ static inline slab_flags_t kmem_cache_flags(unsigned int object_size, SLAB_RECLAIM_ACCOUNT | \ SLAB_TEMPORARY | \ SLAB_ACCOUNT | \ + SLAB_KMALLOC | \ SLAB_NO_USER_FLAGS) bool __kmem_cache_empty(struct kmem_cache *); -- 2.34.1