From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1754591AbcHARZn (ORCPT ); Mon, 1 Aug 2016 13:25:43 -0400 Received: from mail-db5eur01on0137.outbound.protection.outlook.com ([104.47.2.137]:34700 "EHLO EUR01-DB5-obe.outbound.protection.outlook.com" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S1754179AbcHARZO (ORCPT ); Mon, 1 Aug 2016 13:25:14 -0400 Authentication-Results: spf=none (sender IP is ) smtp.mailfrom=aryabinin@virtuozzo.com; From: Andrey Ryabinin To: Andrew Morton CC: Alexander Potapenko , Dave Jones , Vegard Nossum , "Sasha Levin" , Dmitry Vyukov , , , , Andrey Ryabinin Subject: [PATCH 1/6] mm/kasan: fix corruptions and false positive reports Date: Mon, 1 Aug 2016 17:45:10 +0300 Message-ID: <1470062715-14077-1-git-send-email-aryabinin@virtuozzo.com> X-Mailer: git-send-email 2.7.3 MIME-Version: 1.0 Content-Type: text/plain X-Originating-IP: [195.214.232.10] X-ClientProxiedBy: AM3PR08CA0029.eurprd08.prod.outlook.com (10.160.207.167) To VI1PR0801MB1982.eurprd08.prod.outlook.com (10.173.74.15) X-MS-Office365-Filtering-Correlation-Id: aaa18624-4205-4d9f-2065-08d3ba1a4aae X-Microsoft-Exchange-Diagnostics: 1;VI1PR0801MB1982;2:pWKZaASrZk4oN0uaS7NYg4KDnvY7jJek/JE6QXrXF9fY5r8gTnN6x5b6YB2OQ7FwQdwEDLeJlM1usmRo6f7/6N4et0jia1lHbMJ9ch/paOomRIxwpIblHPrGonCk6OZcElNp7bzr3gKgOMxFDw+NBHJGZvr2Ha54/5jul0voF6Rpjs7AiQ/Jea/Zel5POdM3;3:f/qwwAm5L5RzXNzUXJOXWGEMJ7rC/qQ62kzJSfZkKLRMi2tDBxm/5fSlNmXwZBzWn1zA2MBJICNO3ODjGItyMPAuD/D3lXCD3qUOOeQq+9PcX+ySpZv4TMYXfrRqS9q0;25:xPxohTjCrXny3HDBrU/dMlNMxwOlErOS8wnz1aMT2ex9LLCSC4L/x78GHWu2jdd60a+bkJoytbTtNUW3Wpj3pRbSDiD6HUOGiVNTy9AZ4qqh+UlPZm9t/9xYtNbbwxcysQYJJGiZ8oMFbx+z2v+HUEX7xG2AZqoOh0fPleuPf3of2D5Ws/lFHUm78pNqXmE+B1vTEQomyDox3zk9YY3wib3broq3AGKrJuWHySkzMDIoPMJgPyfrdUD+zaU5DqAHiPvh1BkVgCcPpwcrVS0UkONp3djv1rZ0f51nrxO2XbZ6JgnbBIBSzAgAt/MegvVk9r9szy8t8IuMmwXPo+shLYIhygFKIs/k+M94gN6spwutJVaPJxCU6ZK476caiBQnb1piB1uBr/tKGPMMHhgAsjcVYsE007NOdhQyZ08PuJk= X-Microsoft-Antispam: UriScan:;BCL:0;PCL:0;RULEID:;SRVR:VI1PR0801MB1982; X-Microsoft-Exchange-Diagnostics: 1;VI1PR0801MB1982;31:JSopM8xIaziPMlAlZcAXNoCrrIUCz7Y3zbA8hdrZCQdvq9D/IWZtMSPFdXe3xbF3Bg929AEgbBF6TuYEGzMKw6REhNo6SqUngNpgL474j5FsLloYgqRQcktaYm0G76pWOUgTRUScLPVvmUZrFP/qZg9LA4vTyfCF5zTk7xtBS8ktCT3WgaJc+bIYIGEDKsid9+3rDCI2JscdPzoNUdHPhQvm/6Wq1jLNehyuYEg7cO4=;4:ULCva/TYEhlBUoaMu6rL9ueOmr4Ue1pkO7pvGd7tYzHo9CMcqmgbVg82wTTUM3dvDXMcGlVMVHgY01TlI43hI2vgwT/jzKVOYKwf0w6ozpzGsjECtpnxWb4pPOr/EeeCdG9LNDa9VnQ/qiOWsEImGF71wfa3jda/cf4ERO0zBLe2Ghbcfrkb/3CiT6x4ZX3qILxfvW3INIr13EGfA1Ul9BabMTAQK606I1N+It4v/tqF89Lpj6dixEpMhq0hYfh8YPxa7RjLJDomV477aY5Fz4MCDIfhI8ssIqmQMKaFI3bc8ylUlXM1IDCgPF7a/RMlsIaoNmf0kRhKlUWFo61k1A3izTL2vBWRNfB7YM5IbPwLfDWMqX6frVHuzModW3zqTMRwie9ur2T4tscwbKymtx0JXyKv1MfSNNp9ipH0cdw1uq7SHwlanoq7lDGBhhGUmxZNDCPQTHaY1BBTCC0XZFUgCvT6H+GgTxwk07TnTGHj8koyhYDofwqu1UcR3AMueeHDZa2zGt3HgjInXCZF5QBwjlhcJNszisxYj74TdvE= X-Microsoft-Antispam-PRVS: X-Exchange-Antispam-Report-Test: UriScan:(20558992708506)(146099531331640)(154440410675630); X-Exchange-Antispam-Report-CFA-Test: BCL:0;PCL:0;RULEID:(6040130)(601004)(2401047)(8121501046)(5005006)(10201501046)(3002001)(6041072)(6043046);SRVR:VI1PR0801MB1982;BCL:0;PCL:0;RULEID:;SRVR:VI1PR0801MB1982; X-Forefront-PRVS: 0021920B5A X-Forefront-Antispam-Report: SFV:NSPM;SFS:(10019020)(4630300001)(6009001)(6069001)(7916002)(199003)(189002)(97736004)(92566002)(36756003)(47776003)(8676002)(101416001)(81166006)(42186005)(81156014)(189998001)(3846002)(6116002)(5003940100001)(107886002)(4326007)(50466002)(110136002)(305945005)(48376002)(66066001)(586003)(69596002)(4001430100002)(2906002)(77096005)(50226002)(86362001)(33646002)(106356001)(229853001)(68736007)(50986999)(19580405001)(19580395003)(53416004)(7846002)(7736002)(105586002)(76506005);DIR:OUT;SFP:1102;SCL:1;SRVR:VI1PR0801MB1982;H:localhost.sw.ru;FPR:;SPF:None;PTR:InfoNoRecords;A:1;MX:1;LANG:en; X-Microsoft-Exchange-Diagnostics: =?us-ascii?Q?1;VI1PR0801MB1982;23:bTdK8jEu2h9CzE8VeA2sZ4Kp3mHNPpIXQX8L1WP?= =?us-ascii?Q?N/jN2Fgqw7yULT49OBWVd73Vlq0vDl/cFb3iHGcNPDd1/nnoWQGxcDduiKxO?= =?us-ascii?Q?FQMvG3sVbI8/6dIPYqx8fKdmh2U+o3JvW4PjHCHC57ZPjL0SOAL7OAEnXKzE?= =?us-ascii?Q?o0pa5dXD3mihWU6+960A68fmONH2YQW517X2WIYMKXU56+KpkGF2jWzaBrdi?= =?us-ascii?Q?u00aFfLjz8sJi0FO1W5Ry9Crmnqd+8t8rqI5melnKZUvEU6yzWcxv9Qd8JwL?= =?us-ascii?Q?wvNPuMXjp9vrpvMU6OZwR8vlDu0wJwmkm9gz1sino/BfYyxUoilM3z9nrhyC?= =?us-ascii?Q?VTLlqrnEhIQ4yB9yB+r8Zd9Ol0jX3aCmMWk96I930u2+EDEFXb+/Su2NW5Th?= =?us-ascii?Q?QU1FnBVueYxzNvKBz+PmqZ96clF+FcIlBBIs1WadaQlA8EtPFS4XNRXc89DK?= =?us-ascii?Q?37/DGORWF89OI6KVmfrvewAIyW4xRsCsq27MXj72T2cxTLYvpJdoyS3/E8UM?= =?us-ascii?Q?fTsDURlnRkby/20ZPDb/yZRP2LSFEWW6hL9VU+95B6xbBEVFAG3g1GBzU0i7?= =?us-ascii?Q?RAGYjuf/RWjm8miBM8ijCLvQGlQjpB0Rq0x7azKoqqY9KcCW/ap0P0hjSItE?= =?us-ascii?Q?+wcRFG6GE/zxSwXKNTMPg9OvvZQeT3ZE6g5+elXyZctux4T3bBU4Aiox1SqS?= =?us-ascii?Q?ltC9GJeuzDglzbyzQl4fpS+6ExsgMLFWN1UkDG10fHKQEqy3lDCSZETvLc3W?= =?us-ascii?Q?jzxskq/+V8xNtehEhVnrPQkj6aYytg1IQJhiBk7tTlFaKlLDNRWz3KwZ1emX?= =?us-ascii?Q?W45gsw+vROrMvqeOwRmbugyIwVuTlqAgFp68pT10dml6aqjPn2vRJhuonJho?= =?us-ascii?Q?w6juoDJrtLRLIT/EOdJ6EFX8G5CYz/pfQX6Kx67foUUmMg2VkVQbTuYGU1vU?= =?us-ascii?Q?90xq3UsfxdZJDNL/y3tG37ZJ/mDUgZXUZgCrYoLs9KX+WsV/SlBNw/Lu7eq/?= =?us-ascii?Q?l8RmiPOIh90FQ/YcHO8Py1DkLeItvtf7RgVA/fnC31MU1I7a2sUiASIJcxmp?= =?us-ascii?Q?rWPrxwmIUviSqqlclrKUw3lDSQXC4DwKIwvR/1k0J8PEMZEfcIVoqe6j4xcn?= =?us-ascii?Q?N1X414IeiRW2Ic2AwDPeko06kqjL6K20d?= X-Microsoft-Exchange-Diagnostics: 1;VI1PR0801MB1982;6:MQTSZaQOmhrfh3KkkX5TsHkg3QBttqAZ9ePWs5ZEyHbmP+qLcnHFPLRFGdijJx5rk0pv+nCjB9tDaCAttDXFtHnx77gaICe3mfxtwkkreA7pJPTL7Iqzdsd3ZTnjzUWvqx/1GgxINEVrUxAzLrQoDpATrg3XICWaCFyYTWwoWIzM9g0UL2hcabsOD24EVpGf3NEb4Lz6mGBhqMR78A52twb16k3Np6KX53VpNBoy97NokDo3ea5eH3GFgNseo6Mbfwt1xWsqFLzr3yUFv9GYt/LWrVza2yPrlyXkQS83h3tsXajWlya7CdNwHvLwaPr5;5:U9Pe3jlA9U9rSNRlqouWRMgm6cJg0sb/n0kCcA4xD29ohxB1jEOwRtWvd0xf/p5Oa7jD4vZr8BYWy+YOKmO2th283g1kHcfAFsAQdtqnrP4DA2Wg4o9tpj5RPvP6/OAO+LaSNJnjsbDo3yAI5FnEPA==;24:wEThT1r5++/PKl2z/ZxuMq/1qFdBFhHYNLdyIqcaQFyK7uCCunB91uqS7qQ+l7gaU/lz1sWTQHZbIrBgeZkUQG8U8LOvD1TLoGAmiec0RkY=;7:uY0oafh4RUAlEUQQI2LskAWs2DOEQbj2ER/y8Uo3lUeJd6Qsgz6VeTDb5dCXmxNk5csYPZKGoafCxINZZND44avFv58uM9++juuyrujiPxtTTct0SWqk5ZhSI6tTi96oOuC8x3Euc9voO4QTyiQE6tGyx5ZaxfcmLcuOITTD4fij9ZXWrHF+retUIeUSqsTf3T5Xoe/xNkaTA7M5VdE6Jn43O4vPhPlLALbVCSr+iaSCTiLjaDARK87dSiWlJeGm SpamDiagnosticOutput: 1:99 SpamDiagnosticMetadata: NSPM X-Microsoft-Exchange-Diagnostics: 1;VI1PR0801MB1982;20:UgNc0MBtZ0uBNsCOOo+qntKke4fWurwEWlAxpU6U7Hv46ufugod3s3W7MLEbNXYNh7ylfuxKnkIsrQPHAo1Qrhca/fj6ovA5UbyL23g6kv5yU5/Co4m8gRZTF9G6UjYUUV/J7+vJISk2Dp7tAPXExwLZMCOi3d1fPFC5dotz4bo= X-OriginatorOrg: virtuozzo.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 01 Aug 2016 14:44:06.5646 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-Transport-CrossTenantHeadersStamped: VI1PR0801MB1982 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Once object put in quarantine, we no longer own it, i.e. object could leave the quarantine and be reallocated. So having set_track() call after the quarantine_put() may corrupt slab objects. BUG kmalloc-4096 (Not tainted): Poison overwritten ----------------------------------------------------------------------------- Disabling lock debugging due to kernel taint INFO: 0xffff8804540de850-0xffff8804540de857. First byte 0xb5 instead of 0x6b ... INFO: Freed in qlist_free_all+0x42/0x100 age=75 cpu=3 pid=24492 __slab_free+0x1d6/0x2e0 ___cache_free+0xb6/0xd0 qlist_free_all+0x83/0x100 quarantine_reduce+0x177/0x1b0 kasan_kmalloc+0xf3/0x100 kasan_slab_alloc+0x12/0x20 kmem_cache_alloc+0x109/0x3e0 mmap_region+0x53e/0xe40 do_mmap+0x70f/0xa50 vm_mmap_pgoff+0x147/0x1b0 SyS_mmap_pgoff+0x2c7/0x5b0 SyS_mmap+0x1b/0x30 do_syscall_64+0x1a0/0x4e0 return_from_SYSCALL_64+0x0/0x7a INFO: Slab 0xffffea0011503600 objects=7 used=7 fp=0x (null) flags=0x8000000000004080 INFO: Object 0xffff8804540de848 @offset=26696 fp=0xffff8804540dc588 Redzone ffff8804540de840: bb bb bb bb bb bb bb bb ........ Object ffff8804540de848: 6b 6b 6b 6b 6b 6b 6b 6b b5 52 00 00 f2 01 60 cc kkkkkkkk.R....`. Similarly, poisoning after the quarantine_put() leads to false positive use-after-free reports: BUG: KASAN: use-after-free in anon_vma_interval_tree_insert+0x304/0x430 at addr ffff880405c540a0 Read of size 8 by task trinity-c0/3036 CPU: 0 PID: 3036 Comm: trinity-c0 Not tainted 4.7.0-think+ #9 ffff880405c54200 00000000c5c4423e ffff88044a5ef9f0 ffffffffaea48532 ffff88044a5efa88 ffff880461497a00 ffff88044a5efa78 ffffffffae57cfe2 ffff88046501c958 ffff880436aa5440 0000000000000282 0000000000000007 Call Trace: [] dump_stack+0x68/0x96 [] kasan_report_error+0x222/0x600 [] __asan_report_load8_noabort+0x61/0x70 [] anon_vma_interval_tree_insert+0x304/0x430 [] anon_vma_chain_link+0x91/0xd0 [] anon_vma_clone+0x136/0x3f0 [] anon_vma_fork+0x81/0x4c0 [] copy_process.part.47+0x2c43/0x5b20 [] _do_fork+0x16d/0xbd0 [] SyS_clone+0x19/0x20 [] do_syscall_64+0x1a0/0x4e0 [] entry_SYSCALL64_slow_path+0x25/0x25 Fix this by putting an object in the quarantine after all other operations. Fixes: 80a9201a5965 ("mm, kasan: switch SLUB to stackdepot, enable memory quarantine for SLUB") Reported-by: Dave Jones Reported-by: Vegard Nossum Reported-by: Sasha Levin Signed-off-by: Andrey Ryabinin --- mm/kasan/kasan.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/mm/kasan/kasan.c b/mm/kasan/kasan.c index b6f99e8..3019cec 100644 --- a/mm/kasan/kasan.c +++ b/mm/kasan/kasan.c @@ -543,9 +543,9 @@ bool kasan_slab_free(struct kmem_cache *cache, void *object) switch (alloc_info->state) { case KASAN_STATE_ALLOC: alloc_info->state = KASAN_STATE_QUARANTINE; - quarantine_put(free_info, cache); set_track(&free_info->track, GFP_NOWAIT); kasan_poison_slab_free(cache, object); + quarantine_put(free_info, cache); return true; case KASAN_STATE_QUARANTINE: case KASAN_STATE_FREE: -- 2.7.3