Re: [PATCH RFC v2 8/8] mm, slab: deprecate CONFIG_SLUB_TINY and reduce its Kconfig effects

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] mm: slub: immediate slab free with SLUB_TINY breaks SLUB_DEBUG and KASAN
--

commit 1e2131ba6ae41313bf0a5ddd37175ec68730ea9a
Author: Vlastimil Babka (SUSE) <vbabka@kernel.org>

mm, slab: deprecate CONFIG_SLUB_TINY and reduce its Kconfig effects

This commit deprecates CONFIG_SLUB_TINY in its Kconfig description and
removes its dependencies and selections from related Kconfig options such
as KASAN, KVFREE_RCU_BATCHED, SLUB_DEBUG, SLUB_STATS, and slab hardening
configs.

> diff --git a/lib/Kconfig.kasan b/lib/Kconfig.kasan
> index a4bb610a7a6fa..f20b574f6653a 100644
> --- a/lib/Kconfig.kasan
> +++ b/lib/Kconfig.kasan
> @@ -49,7 +49,7 @@ menuconfig KASAN
>  		     (HAVE_ARCH_KASAN_SW_TAGS && CC_HAS_KASAN_SW_TAGS)) && \
>  		    CC_HAS_WORKING_NOSANITIZE_ADDRESS) || \
>  		   HAVE_ARCH_KASAN_HW_TAGS
> -	depends on SYSFS && !SLUB_TINY
> +	depends on SYSFS

[ ... ]

> diff --git a/mm/Kconfig.debug b/mm/Kconfig.debug
> index 9eaa25d1cf234..4e36c7c63ef78 100644
> --- a/mm/Kconfig.debug
> +++ b/mm/Kconfig.debug
> @@ -48,7 +48,7 @@ config DEBUG_PAGEALLOC_ENABLE_DEFAULT
>  config SLUB_DEBUG
>  	default y
>  	bool "Enable SLUB debugging support" if EXPERT
> -	depends on SYSFS && !SLUB_TINY
> +	depends on SYSFS

[Severity: High]
Can allowing CONFIG_SLUB_DEBUG and CONFIG_KASAN when CONFIG_SLUB_TINY=y
cause use-after-free writes to freed page-allocator pages and NULL pointer
dereferences when slab_tiny_enabled is active?

When slab_tiny_enabled is true (the default under CONFIG_SLUB_TINY=y),
do_kmem_cache_create() in mm/slub.c sets s->min_partial = 0 for all caches:

	s->min_partial = min_t(unsigned long, MAX_PARTIAL, ilog2(s->size) / 2);
	s->min_partial = max_t(unsigned long, MIN_PARTIAL, s->min_partial);
	if (slab_tiny_enabled)
		s->min_partial = 0;

When freeing the last in-use object in a slab via free_to_partial_list() in
mm/slub.c, s->min_partial == 0 causes the slab page to be immediately
removed from n->partial and freed back to the page allocator via
free_slab() -> __free_slab():

	if (slab->inuse == 0 && n->nr_partial >= s->min_partial)
		slab_free = slab;

With CONFIG_SLUB_DEBUG enabled alongside CONFIG_SLUB_TINY, tests in
lib/tests/slub_kunit.c (such as test_clobber_redzone_free(),
test_next_pointer(), test_first_word(), and test_clobber_50th_byte())
allocate a single object from a cache, call kmem_cache_free(s, p), and then
write to p before calling validate_slab_cache(s):

	kasan_disable_current();
	kmem_cache_free(s, p);
	p[64] = 0xab;

	validate_slab_cache(s);
	KUNIT_EXPECT_EQ(test, 2, slab_errors);

Because kmem_cache_free(s, p) frees the only object in the slab, the backing
slab page has already been returned to the page allocator when p[64] = 0xab
executes, turning those writes into use-after-free writes to a free buddy
page while validate_slab_cache(s) scans an empty partial list.

Similarly, under tag-based KASAN modes without quarantine
(CONFIG_KASAN_SW_TAGS or CONFIG_KASAN_HW_TAGS), freeing the sole object in a
slab immediately frees the slab page and clears its slab page type. If a
double-free occurs (such as in kmem_cache_double_free() in
mm/kasan/kasan_test_c.c):

	kmem_cache_free(cache, p);
	KUNIT_EXPECT_KASAN_FAIL(test, kmem_cache_free(cache, p));

kasan_slab_pre_free() -> check_slab_allocation() in mm/kasan/common.c calls
nearest_obj() with virt_to_slab(object) == NULL when
CONFIG_SLAB_FREELIST_HARDENED and SLAB_CONSISTENCY_CHECKS are not active:

	if (unlikely(nearest_obj(cache, virt_to_slab(object), object) != object)) {
		kasan_report_invalid_free(tagged_object, ip, KASAN_REPORT_INVALID_FREE);
		return true;
	}

Wouldn't this dereference NULL at slab->objects inside nearest_obj() (and
also cause kmem_cache_rcu_reuse() in mm/kasan/kasan_test_c.c to fail because
the slab is queued for rcu_free_slab() instead of remaining on n->partial)?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261024-slub_tiny_rework-v2-0-bf1419ab5ffd@kernel.org?part=8