linux-toradex.git/include/linux/kasan.h, branch v6.12-rc4

slub: Introduce CONFIG_SLUB_RCU_DEBUG

2024-08-27T12:12:51+00:00

Currently, KASAN is unable to catch use-after-free in SLAB_TYPESAFE_BY_RCU
slabs because use-after-free is allowed within the RCU grace period by
design.

Add a SLUB debugging feature which RCU-delays every individual
kmem_cache_free() before either actually freeing the object or handing it
off to KASAN, and change KASAN to poison freed objects as normal when this
option is enabled.

For now I've configured Kconfig.debug to default-enable this feature in the
KASAN GENERIC and SW_TAGS modes; I'm not enabling it by default in HW_TAGS
mode because I'm not sure if it might have unwanted performance degradation
effects there.

Note that this is mostly useful with KASAN in the quarantine-based GENERIC
mode; SLAB_TYPESAFE_BY_RCU slabs are basically always also slabs with a
->ctor, and KASAN's assign_tag() currently has to assign fixed tags for
those, reducing the effectiveness of SW_TAGS/HW_TAGS mode.
(A possible future extension of this work would be to also let SLUB call
the ->ctor() on every allocation instead of only when the slab page is
allocated; then tag-based modes would be able to assign new tags on every
reallocation.)

Tested-by: syzbot+263726e59eab6b442723@syzkaller.appspotmail.com
Reviewed-by: Andrey Konovalov 
Acked-by: Marco Elver 
Acked-by: Vlastimil Babka  #slab
Signed-off-by: Jann Horn 
Signed-off-by: Vlastimil Babka

kasan: catch invalid free before SLUB reinitializes the object

2024-08-27T12:12:51+00:00

Currently, when KASAN is combined with init-on-free behavior, the
initialization happens before KASAN's "invalid free" checks.

More importantly, a subsequent commit will want to RCU-delay the actual
SLUB freeing of an object, and we'd like KASAN to still validate
synchronously that freeing the object is permitted. (Otherwise this
change will make the existing testcase kmem_cache_invalid_free fail.)

So add a new KASAN hook that allows KASAN to pre-validate a
kmem_cache_free() operation before SLUB actually starts modifying the
object or its metadata.

Inside KASAN, this:

 - moves checks from poison_slab_object() into check_slab_allocation()
 - moves kasan_arch_is_ready() up into callers of poison_slab_object()
 - removes "ip" argument of poison_slab_object() and __kasan_slab_free()
   (since those functions no longer do any reporting)

Acked-by: Vlastimil Babka  #slub
Reviewed-by: Andrey Konovalov 
Signed-off-by: Jann Horn 
Signed-off-by: Vlastimil Babka

mm, slab, kasan: replace kasan_never_merge() with SLAB_NO_MERGE

2024-02-26T09:10:07+00:00

The SLAB_KASAN flag prevents merging of caches in some configurations,
which is handled in a rather complicated way via kasan_never_merge().
Since we now have a generic SLAB_NO_MERGE flag, we can instead use it
for KASAN caches in addition to SLAB_KASAN in those configurations,
and simplify the SLAB_NEVER_MERGE handling.

Tested-by: Xiongwei Song 
Reviewed-by: Chengming Zhou 
Reviewed-by: Andrey Konovalov 
Tested-by: David Rientjes 
Signed-off-by: Vlastimil Babka

mm, kasan: use KASAN_TAG_KERNEL instead of 0xff

2023-12-29T19:58:44+00:00

Use the KASAN_TAG_KERNEL marco instead of open-coding 0xff in the mm code.
This macro is provided by include/linux/kasan-tags.h, which does not
include any other headers, so it's safe to include it into mm.h without
causing circular include dependencies.

Link: https://lkml.kernel.org/r/71db9087b0aebb6c4dccbc609cc0cd50621533c7.1703188911.git.andreyknvl@google.com
Signed-off-by: Andrey Konovalov 
Cc: Alexander Potapenko 
Cc: Andrey Ryabinin 
Cc: Dmitry Vyukov 
Cc: Marco Elver 
Signed-off-by: Andrew Morton

kasan: rename and document kasan_(un)poison_object_data

2023-12-29T19:58:40+00:00

Rename kasan_unpoison_object_data to kasan_unpoison_new_object and add a
documentation comment.  Do the same for kasan_poison_object_data.

The new names and the comments should suggest the users that these hooks
are intended for internal use by the slab allocator.

The following patch will remove non-slab-internal uses of these hooks.

No functional changes.

[andreyknvl@google.com: update references to renamed functions in comments]
  Link: https://lkml.kernel.org/r/20231221180637.105098-1-andrey.konovalov@linux.dev
Link: https://lkml.kernel.org/r/eab156ebbd635f9635ef67d1a4271f716994e628.1703024586.git.andreyknvl@google.com
Signed-off-by: Andrey Konovalov 
Reviewed-by: Marco Elver 
Cc: Alexander Lobakin 
Cc: Alexander Potapenko 
Cc: Andrey Ryabinin 
Cc: Breno Leitao 
Cc: Dmitry Vyukov 
Cc: Evgenii Stepanov 
Signed-off-by: Andrew Morton

kasan: save alloc stack traces for mempool

2023-12-29T19:58:39+00:00

Update kasan_mempool_unpoison_object to properly poison the redzone and
save alloc strack traces for kmalloc and slab pools.

As a part of this change, split out and use a unpoison_slab_object helper
function from __kasan_slab_alloc.

[nathan@kernel.org: mark unpoison_slab_object() as static]
  Link: https://lkml.kernel.org/r/20231221180042.104694-1-andrey.konovalov@linux.dev
Link: https://lkml.kernel.org/r/05ad235da8347cfe14d496d01b2aaf074b4f607c.1703024586.git.andreyknvl@google.com
Signed-off-by: Andrey Konovalov 
Signed-off-by: Nathan Chancellor 
Cc: Alexander Lobakin 
Cc: Alexander Potapenko 
Cc: Andrey Ryabinin 
Cc: Breno Leitao 
Cc: Dmitry Vyukov 
Cc: Evgenii Stepanov 
Cc: Marco Elver 
Signed-off-by: Andrew Morton

kasan: save free stack traces for slab mempools

2023-12-29T19:58:38+00:00

Make kasan_mempool_poison_object save free stack traces for slab and
kmalloc mempools when the object is freed into the mempool.

Also simplify and rename ____kasan_slab_free to poison_slab_object and do
a few other reability changes.

Link: https://lkml.kernel.org/r/413a7c7c3344fb56809853339ffaabc9e4905e94.1703024586.git.andreyknvl@google.com
Signed-off-by: Andrey Konovalov 
Cc: Alexander Lobakin 
Cc: Alexander Potapenko 
Cc: Andrey Ryabinin 
Cc: Breno Leitao 
Cc: Dmitry Vyukov 
Cc: Evgenii Stepanov 
Cc: Marco Elver 
Signed-off-by: Andrew Morton

kasan: introduce kasan_mempool_unpoison_pages

2023-12-29T19:58:37+00:00

Introduce and document a new kasan_mempool_unpoison_pages hook to be used
by the mempool code instead of kasan_unpoison_pages.

This hook is not functionally different from kasan_unpoison_pages, but
using it improves the mempool code readability.

Link: https://lkml.kernel.org/r/239bd9af6176f2cc59f5c25893eb36143184daff.1703024586.git.andreyknvl@google.com
Signed-off-by: Andrey Konovalov 
Cc: Alexander Lobakin 
Cc: Alexander Potapenko 
Cc: Andrey Ryabinin 
Cc: Breno Leitao 
Cc: Dmitry Vyukov 
Cc: Evgenii Stepanov 
Cc: Marco Elver 
Signed-off-by: Andrew Morton

kasan: introduce kasan_mempool_poison_pages

2023-12-29T19:58:37+00:00

Introduce and document a kasan_mempool_poison_pages hook to be used by the
mempool code instead of kasan_poison_pages.

Compated to kasan_poison_pages, the new hook:

1. For the tag-based modes, skips checking and poisoning allocations that
   were not tagged due to sampling.

2. Checks for double-free and invalid-free bugs.

In the future, kasan_poison_pages can also be updated to handle #2, but
this is out-of-scope of this series.

Link: https://lkml.kernel.org/r/88dc7340cce28249abf789f6e0c792c317df9ba5.1703024586.git.andreyknvl@google.com
Signed-off-by: Andrey Konovalov 
Cc: Alexander Lobakin 
Cc: Alexander Potapenko 
Cc: Andrey Ryabinin 
Cc: Breno Leitao 
Cc: Dmitry Vyukov 
Cc: Evgenii Stepanov 
Cc: Marco Elver 
Signed-off-by: Andrew Morton

kasan: introduce kasan_mempool_unpoison_object

2023-12-29T19:58:37+00:00

Introduce and document a kasan_mempool_unpoison_object hook.

This hook serves as a replacement for the generic kasan_unpoison_range
that the mempool code relies on right now.  mempool will be updated to use
the new hook in one of the following patches.

For now, define the new hook to be identical to kasan_unpoison_range.  One
of the following patches will update it to add stack trace collection.

Link: https://lkml.kernel.org/r/dae25f0e18ed8fd50efe509c5b71a0592de5c18d.1703024586.git.andreyknvl@google.com
Signed-off-by: Andrey Konovalov 
Cc: Alexander Lobakin 
Cc: Alexander Potapenko 
Cc: Andrey Ryabinin 
Cc: Breno Leitao 
Cc: Dmitry Vyukov 
Cc: Evgenii Stepanov 
Cc: Marco Elver 
Signed-off-by: Andrew Morton