From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-10.2 required=3.0 tests=BAYES_00, HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_CR_TRAILER,MAILING_LIST_MULTI, SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_AGENT_SANE_1 autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id E82FBC4338F for ; Tue, 27 Jul 2021 19:22:25 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id CE19760F9C for ; Tue, 27 Jul 2021 19:22:25 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S231899AbhG0TWY (ORCPT ); Tue, 27 Jul 2021 15:22:24 -0400 Received: from mail.kernel.org ([198.145.29.99]:57882 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229737AbhG0TWY (ORCPT ); Tue, 27 Jul 2021 15:22:24 -0400 Received: by mail.kernel.org (Postfix) with ESMTPSA id 9A76E60F6E; Tue, 27 Jul 2021 19:22:21 +0000 (UTC) Date: Tue, 27 Jul 2021 20:22:18 +0100 From: Catalin Marinas To: Kuan-Ying Lee Cc: Marco Elver , Nicholas Tang , Andrew Yang , Andrey Konovalov , Andrey Ryabinin , Alexander Potapenko , Chinwen Chang , Andrew Morton , kasan-dev@googlegroups.com, linux-mm@kvack.org, linux-kernel@vger.kernel.org, linux-arm-kernel@lists.infradead.org, linux-mediatek@lists.infradead.org Subject: Re: [PATCH 1/2] kasan, mm: reset tag when access metadata Message-ID: <20210727192217.GV13920@arm.com> References: <20210727040021.21371-1-Kuan-Ying.Lee@mediatek.com> <20210727040021.21371-2-Kuan-Ying.Lee@mediatek.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: User-Agent: Mutt/1.10.1 (2018-07-13) Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Tue, Jul 27, 2021 at 04:32:02PM +0800, Kuan-Ying Lee wrote: > On Tue, 2021-07-27 at 09:10 +0200, Marco Elver wrote: > > +Cc Catalin > > > > On Tue, 27 Jul 2021 at 06:00, Kuan-Ying Lee < > > Kuan-Ying.Lee@mediatek.com> wrote: > > > > > > Hardware tag-based KASAN doesn't use compiler instrumentation, we > > > can not use kasan_disable_current() to ignore tag check. > > > > > > Thus, we need to reset tags when accessing metadata. > > > > > > Signed-off-by: Kuan-Ying Lee > > > > This looks reasonable, but the patch title is not saying this is > > kmemleak, nor does the description say what the problem is. What > > problem did you encounter? Was it a false positive? > > kmemleak would scan kernel memory to check memory leak. > When it scans on the invalid slab and dereference, the issue > will occur like below. > > So I think we should reset the tag before scanning. > > # echo scan > /sys/kernel/debug/kmemleak > [ 151.905804] > ================================================================== > [ 151.907120] BUG: KASAN: out-of-bounds in scan_block+0x58/0x170 > [ 151.908773] Read at addr f7ff0000c0074eb0 by task kmemleak/138 > [ 151.909656] Pointer tag: [f7], memory tag: [fe] It would be interesting to find out why the tag doesn't match. Kmemleak should in principle only scan valid objects that have been allocated and the pointer can be safely dereferenced. 0xfe is KASAN_TAG_INVALID, so it either goes past the size of the object (into the red zone) or it still accesses the object after it was marked as freed but before being released from kmemleak. With slab, looking at __cache_free(), it calls kasan_slab_free() before ___cache_free() -> kmemleak_free_recursive(), so the second scenario is possible. With slub, however, slab_free_hook() first releases the object from kmemleak before poisoning it. Based on the stack dump, you are using slub, so it may be that kmemleak goes into the object red zones. I'd like this clarified before blindly resetting the tag. -- Catalin