Received-SPF: pass (google.com: domain of linux-kernel+bounces-192364-linux.lists.archive=gmail.com@vger.kernel.org designates 2604:1380:45d1:ec00::1 as permitted sender) client-ip=2604:1380:45d1:ec00::1;
Date: Tue, 28 May 2024 21:05:26 +0800
From: Feng Tang <feng.tang@intel.com>
To: Chengming Zhou <chengming.zhou@linux.dev>
CC: Christoph Lameter <cl@linux.com>, Pekka Enberg <penberg@kernel.org>, David
 Rientjes <rientjes@google.com>, Joonsoo Kim <iamjoonsoo.kim@lge.com>, Andrew
 Morton <akpm@linux-foundation.org>, Vlastimil Babka <vbabka@suse.cz>, Roman
 Gushchin <roman.gushchin@linux.dev>, Hyeonggon Yoo <42.hyeyoo@gmail.com>,
	<linux-mm@kvack.org>, <linux-kernel@vger.kernel.org>,
	<zhouchengming@bytedance.com>
Subject: Re: [PATCH 2/3] slab: don't put freepointer outside of object if
 only orig_size
Message-ID: <ZlXWlrjdZpoD4bS9@feng-clx.sh.intel.com>
References: <20240528-b4-slab-debug-v1-0-8694ef4802df@linux.dev>
 <20240528-b4-slab-debug-v1-2-8694ef4802df@linux.dev>
Content-Type: text/plain; charset="us-ascii"
Content-Disposition: inline
In-Reply-To: <20240528-b4-slab-debug-v1-2-8694ef4802df@linux.dev>
Precedence: bulk
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?RSrJZGHfhFLLww4gi38KXvsiW9cOIWbI9cnC1Q6qWwb0XxuFecynWcqGVK0o?=
 =?us-ascii?Q?l8fxwzMSOXYMN4QKvDRt5YALVYcDGiOVNPSTQso2h9Jkajw9EK1FCZsqEvS+?=
 =?us-ascii?Q?jlWfEGcg4XuxM1G0ZJic5JiFltyiqShs3VcxXjc/lDZpC2Lxjbq4MUo/ySCK?=
 =?us-ascii?Q?4PUsq+4CeonhURgdJ5m/IBl7vlqHcL0Ahl3uxrp+8mebx4gdnx5vMtIuIDQX?=
 =?us-ascii?Q?XMBqFpzc2py7JHx+zx6MFC3vhySupc0T780xP70aXqAHXeqeQEhaBhp6lj3m?=
 =?us-ascii?Q?M+PXx773a+xfExJEh3oGX/M92H9XoKJ6u5wA55XONNy5aLQQGQ5e5GaxkkQ2?=
 =?us-ascii?Q?x5fzi35r8YTEt167yOgJp+QZroYxKmnhpCc5QE4B1L7RghAXeLeK5lbUu0Wy?=
 =?us-ascii?Q?eJ8rXoztWoLxZonBqFff2T6yYOpX2HVgMbBKlIV0CQKI8Fsnks900Z36Jfu2?=
 =?us-ascii?Q?EbsyZUInb82yU70P8NSKojFlcktDRu5rA837B5F/NBUv3fcNDnWB2c1PhlQA?=
 =?us-ascii?Q?4y3E+4f9pwaCBOWiHTOy8gVMMUhaRGf1U+YdrEHOd03l3weu63aGvWu1Gh96?=
 =?us-ascii?Q?hQoVXZD53/rtXSHfBgPg/VHuzpTSkhOilVVGXh9boDMOaBEh3SoyAX44vTAq?=
 =?us-ascii?Q?7BcO6yuPknpHPt/Gy2pEgBAzrNRqNBOnlcTjvl7G4c/HAzOF6E1aVmwqBy84?=
 =?us-ascii?Q?hAKxow5Bod27ikszhGVJvOymVPLFWtP0v94uYamg0I5aIw0ivwRLiM74ZFiU?=
 =?us-ascii?Q?Q9vmfA7irUBx5xBGm3gsPd7cYB3u4AaG5J7C6wxAt0BObOl34Va/cyTlEPdx?=
 =?us-ascii?Q?goqE1yCJK4CF5VpMOAhcvjCJT6CBN6Y8MIeRMOZL+1Ey/gRpFcF1nt/y+wLi?=
 =?us-ascii?Q?1Duar7dADyKOnEB1p4eh0vITvpZEuw9XgI1VCPjGUMQfUpnHsSSqWl3CF4Ni?=
 =?us-ascii?Q?zftDAMlXXTyWEFl4uwQ6BQmF7zPxAYZqzhlbfmQtfS9f3QCUhz6q7kkaJYx3?=
 =?us-ascii?Q?KDBepXrhIDE5s7jYbcSA+Jjb6cFTM970KUS5kVG6OEHoviQ76x+7UnEMRp6k?=
 =?us-ascii?Q?jZPGWFu+hC0iykYPaqafVFP243KnyzSG+8HRc9NASDelzwoCAk0GVlYBQAku?=
 =?us-ascii?Q?NbceSeUp7Njfvjw+ANI7EjzDoSufXksNWEG5nWtej1nsGP4KJoXR0JE9UuGi?=
 =?us-ascii?Q?kRfBOTTZ2mtDG5f+bHq/QFqU80ayoRPQ09GagJ4OF0SPt9Y0t/7j3m6Q1jC/?=
 =?us-ascii?Q?qa3XzH4QC97Fw8ZdkJ2HuEanzf8ytvEq+WgW9EvOa92p8x1raNCjfOXIKI4Z?=
 =?us-ascii?Q?lbvIrn04odwz/c3rCdA/Qa1m8nClXzZttSCJrtZkPQ6p0K8q87lkKyOau7W6?=
 =?us-ascii?Q?979b56cvPCUz6/O9r3zJFURy2L5EsX0PFM2br4w7K3QnpcGP3kzRdNB+XPKh?=
 =?us-ascii?Q?7oCyw0ITEz8+cc6A8PO+TyOyjlAE0u4nf/DKmImubwUTyO4dxBvD3BUWnVei?=
 =?us-ascii?Q?6wEjhtHr/SgBzsxB/L4gfTIPxGwOIhgvrCGGQwVEftbUZlIBcLoaSlrriVfA?=
 =?us-ascii?Q?aLzl3QYkkGzeu9dofq8VsiCgCRdev9t1vmE0iJ+r?=
X-MS-Exchange-CrossTenant-Network-Message-Id: 63969335-0bf0-4e3e-a7d3-08dc7f16dcf2
X-MS-Exchange-CrossTenant-AuthSource: MN0PR11MB6304.namprd11.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 28 May 2024 13:05:35.4445
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 46c98d88-e344-4ed4-8496-4ed7712e255d
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: j2bS7G2Q0rI2OzYuOaVT1aktiKrREt0o02Mkb8LTMY+9oPjAU8T1LTF4gUc4D2lmACcEB/vpe1Y+i+N7igQvXQ==
X-MS-Exchange-Transport-CrossTenantHeadersStamped: DS7PR11MB6038
X-OriginatorOrg: intel.com

On Tue, May 28, 2024 at 03:16:47PM +0800, Chengming Zhou wrote:
> The commit 946fa0dbf2d8 ("mm/slub: extend redzone check to extra
> allocated kmalloc space than requested") will extend right redzone
> when allocating for orig_size < object_size. So we can't overlay the
> freepointer in the object space in this case.
> 
> But the code looks like it forgot to check SLAB_RED_ZONE, since there
> won't be extended right redzone if only orig_size enabled.

Look good to me. Thanks!

Reviewed-by: Feng Tang <feng.tang@intel.com>

> 
> Signed-off-by: Chengming Zhou <chengming.zhou@linux.dev>
> ---
>  mm/slub.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/mm/slub.c b/mm/slub.c
> index de57512734ac..b92d9a557852 100644
> --- a/mm/slub.c
> +++ b/mm/slub.c
> @@ -5150,7 +5150,7 @@ static int calculate_sizes(struct kmem_cache *s)
>  	 */
>  	s->inuse = size;
>  
> -	if (slub_debug_orig_size(s) ||
> +	if (((flags & SLAB_RED_ZONE) && slub_debug_orig_size(s)) ||
>  	    (flags & (SLAB_TYPESAFE_BY_RCU | SLAB_POISON)) ||
>  	    ((flags & SLAB_RED_ZONE) && s->object_size < sizeof(void *)) ||
>  	    s->ctor) {
> 
> -- 
> 2.45.1
>