From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-12.9 required=3.0 tests=BAYES_00,DKIMWL_WL_MED, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS,USER_AGENT_SANE_1, USER_IN_DEF_DKIM_WL autolearn=no autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 3F02EC43461 for ; Tue, 8 Sep 2020 15:31:14 +0000 (UTC) Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by mail.kernel.org (Postfix) with ESMTP id CB0E222453 for ; Tue, 8 Sep 2020 15:31:13 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b="Ve3aQ+oi" DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org CB0E222453 Authentication-Results: mail.kernel.org; dmarc=fail (p=reject dis=none) header.from=google.com Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=owner-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix) id D91548E0001; Tue, 8 Sep 2020 11:31:12 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id D41A46B005D; Tue, 8 Sep 2020 11:31:12 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id C33098E0001; Tue, 8 Sep 2020 11:31:12 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from forelay.hostedemail.com (smtprelay0130.hostedemail.com [216.40.44.130]) by kanga.kvack.org (Postfix) with ESMTP id A62F86B0003 for ; Tue, 8 Sep 2020 11:31:12 -0400 (EDT) Received: from smtpin08.hostedemail.com (10.5.19.251.rfc1918.com [10.5.19.251]) by forelay02.hostedemail.com (Postfix) with ESMTP id 44A283628 for ; Tue, 8 Sep 2020 15:31:12 +0000 (UTC) X-FDA: 77240282784.08.ship96_3317051270d5 Received: from filter.hostedemail.com (10.5.16.251.rfc1918.com [10.5.16.251]) by smtpin08.hostedemail.com (Postfix) with ESMTP id 1D2391819E769 for ; Tue, 8 Sep 2020 15:31:12 +0000 (UTC) X-HE-Tag: ship96_3317051270d5 X-Filterd-Recvd-Size: 6402 Received: from mail-wr1-f68.google.com (mail-wr1-f68.google.com [209.85.221.68]) by imf34.hostedemail.com (Postfix) with ESMTP for ; Tue, 8 Sep 2020 15:31:11 +0000 (UTC) Received: by mail-wr1-f68.google.com with SMTP id j2so19585224wrx.7 for ; Tue, 08 Sep 2020 08:31:11 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=date:from:to:cc:subject:message-id:references:mime-version :content-disposition:in-reply-to:user-agent; bh=YQgUsxZ9GX3vVBI6rWEDHgnkdvr/rXnkrQPmjYVedKg=; b=Ve3aQ+oisG54K1DBOJ6Vv+bfGmYnw8xEga4PIbgpydxas1I6Ucz4AP85ilqGU5v42M ppBWoLaAg0QPXJrjC+pTOvaXY3oT3KTo5FkSxl5Br19DLYKrIf4ZE7i5XBHZfPaLWdLq swqZEgFcwM2oTWjcAm4wstHbLRyWM5dXa7puN16iULpm1dLlLp2PcZojXIWrAaAeMpne gGcrBg5oM48MAvo0LKHh34SO0eWxkl32XY8o0kJFUU6BPKXe7UVuPJTWZaMw/9ppvdlK v4uSzjMcHxXNB7lV2zW69TkrrX70h/88OKykIHufyVSGOfbJ2+daKNTfnHctp1asLp75 moPQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:date:from:to:cc:subject:message-id:references :mime-version:content-disposition:in-reply-to:user-agent; bh=YQgUsxZ9GX3vVBI6rWEDHgnkdvr/rXnkrQPmjYVedKg=; b=C+7EOk+H31CCLvKSBxefIlRsjBT8XQy/7RpyH+nh8iuz2tqJv7kP8PSItuElNuPRxQ DjrAT0OBGs1fnSAUapsENNT8JU38yGzVNyhZq/qqE/EKNLqMzYY0d9DOHNooEejmW4FC eyeebKLETggBvNyDQjnuNPxyNXDly6vu8WD5hedZLqVAqIxbbURCQ88ihMSix+Hjy2yp 1Bvm51kHtP6mBmhK9RRFrkyM5L/v9yA54a3h4Shb+/Lj4EcBtKKtO4vDfoRMHcLOv/Si f+QM9chGhV6HFltfs8aSG459KK+q/l+IHPWY/s+5MJYayRNrgE4M3WnHS9IezUr2/boP PL+w== X-Gm-Message-State: AOAM531DLiTuZZxGLdVQtzsUlxY2RI9CvqVdv2fzzCqS5CuiSO/iq8xr U382OBWL0XChBdzD9igbFoCwkg== X-Google-Smtp-Source: ABdhPJzpeL/LG5MivE4qK84Vzr9Pz3Mah/87BWpTWioecpMtrDM52Kk30hPIYNgBxE+EHgxQQKTYoQ== X-Received: by 2002:a5d:52c6:: with SMTP id r6mr172681wrv.141.1599579070236; Tue, 08 Sep 2020 08:31:10 -0700 (PDT) Received: from elver.google.com ([100.105.32.75]) by smtp.gmail.com with ESMTPSA id d6sm34017392wrq.67.2020.09.08.08.31.08 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 08 Sep 2020 08:31:09 -0700 (PDT) Date: Tue, 8 Sep 2020 17:31:02 +0200 From: Marco Elver To: Dave Hansen Cc: glider@google.com, akpm@linux-foundation.org, catalin.marinas@arm.com, cl@linux.com, rientjes@google.com, iamjoonsoo.kim@lge.com, mark.rutland@arm.com, penberg@kernel.org, hpa@zytor.com, paulmck@kernel.org, andreyknvl@google.com, aryabinin@virtuozzo.com, luto@kernel.org, bp@alien8.de, dave.hansen@linux.intel.com, dvyukov@google.com, edumazet@google.com, gregkh@linuxfoundation.org, mingo@redhat.com, jannh@google.com, corbet@lwn.net, keescook@chromium.org, peterz@infradead.org, cai@lca.pw, tglx@linutronix.de, will@kernel.org, x86@kernel.org, linux-doc@vger.kernel.org, linux-kernel@vger.kernel.org, kasan-dev@googlegroups.com, linux-arm-kernel@lists.infradead.org, linux-mm@kvack.org Subject: Re: [PATCH RFC 00/10] KFENCE: A low-overhead sampling-based memory safety error detector Message-ID: <20200908153102.GB61807@elver.google.com> References: <20200907134055.2878499-1-elver@google.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: User-Agent: Mutt/1.14.4 (2020-06-18) X-Rspamd-Queue-Id: 1D2391819E769 X-Spamd-Result: default: False [0.00 / 100.00] X-Rspamd-Server: rspam04 X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: On Tue, Sep 08, 2020 at 07:52AM -0700, Dave Hansen wrote: > On 9/7/20 6:40 AM, Marco Elver wrote: > > KFENCE is designed to be enabled in production kernels, and has near > > zero performance overhead. Compared to KASAN, KFENCE trades performance > > for precision. > > Could you talk a little bit about where you expect folks to continue to > use KASAN? How would a developer or a tester choose which one to use? We mention some of this in Documentation/dev-tools/kfence.rst: In the kernel, several tools exist to debug memory access errors, and in particular KASAN can detect all bug classes that KFENCE can detect. While KASAN is more precise, relying on compiler instrumentation, this comes at a performance cost. We want to highlight that KASAN and KFENCE are complementary, with different target environments. For instance, KASAN is the better debugging-aid, where a simple reproducer exists: due to the lower chance to detect the error, it would require more effort using KFENCE to debug. Deployments at scale, however, would benefit from using KFENCE to discover bugs due to code paths not exercised by test cases or fuzzers. If you can afford to use KASAN, continue using KASAN. Usually this only applies to test environments. If you have kernels for production use, and cannot enable KASAN for the obvious cost reasons, you could consider KFENCE. I'll try to make this clearer, maybe summarizing what I said here in Documentation as well. > > KFENCE objects each reside on a dedicated page, at either the left or > > right page boundaries. The pages to the left and right of the object > > page are "guard pages", whose attributes are changed to a protected > > state, and cause page faults on any attempted access to them. Such page > > faults are then intercepted by KFENCE, which handles the fault > > gracefully by reporting a memory access error. > > How much memory overhead does this end up having? I know it depends on > the object size and so forth. But, could you give some real-world > examples of memory consumption? Also, what's the worst case? Say I > have a ton of worst-case-sized (32b) slab objects. Will I notice? KFENCE objects are limited (default 255). If we exhaust KFENCE's memory pool, no more KFENCE allocations will occur. Documentation/dev-tools/kfence.rst gives a formula to calculate the KFENCE pool size: The total memory dedicated to the KFENCE memory pool can be computed as:: ( #objects + 1 ) * 2 * PAGE_SIZE Using the default config, and assuming a page size of 4 KiB, results in dedicating 2 MiB to the KFENCE memory pool. Does that clarify this point? Or anything else that could help clarify this? Thanks, -- Marco