From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-2.2 required=3.0 tests=HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS,USER_AGENT_SANE_1 autolearn=no autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id E0BF7C76195 for ; Thu, 18 Jul 2019 16:11:36 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id B840021849 for ; Thu, 18 Jul 2019 16:11:36 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1728031AbfGRQLf (ORCPT ); Thu, 18 Jul 2019 12:11:35 -0400 Received: from relay.sw.ru ([185.231.240.75]:40706 "EHLO relay.sw.ru" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1726040AbfGRQLe (ORCPT ); Thu, 18 Jul 2019 12:11:34 -0400 Received: from [172.16.25.12] by relay.sw.ru with esmtp (Exim 4.92) (envelope-from ) id 1ho902-00080M-Ln; Thu, 18 Jul 2019 19:11:18 +0300 Subject: Re: [PATCH v3] kasan: add memory corruption identification for software tag-based mode To: Walter Wu Cc: Dmitry Vyukov , Alexander Potapenko , Christoph Lameter , Pekka Enberg , David Rientjes , Joonsoo Kim , Matthias Brugger , Martin Schwidefsky , Arnd Bergmann , Vasily Gorbik , Andrey Konovalov , "Jason A . Donenfeld" , Miles Chen , kasan-dev , LKML , Linux-MM , Linux ARM , linux-mediatek@lists.infradead.org, wsd_upstream References: <20190613081357.1360-1-walter-zh.wu@mediatek.com> <1560447999.15814.15.camel@mtksdccf07> <1560479520.15814.34.camel@mtksdccf07> <1560744017.15814.49.camel@mtksdccf07> <1560774735.15814.54.camel@mtksdccf07> <1561974995.18866.1.camel@mtksdccf07> <1562640832.9077.32.camel@mtksdccf07> <1562839579.5846.12.camel@mtksdccf07> <37897fb7-88c1-859a-dfcc-0a5e89a642e0@virtuozzo.com> <1563160001.4793.4.camel@mtksdccf07> From: Andrey Ryabinin Message-ID: <9ab1871a-2605-ab34-3fd3-4b44a0e17ab7@virtuozzo.com> Date: Thu, 18 Jul 2019 19:11:21 +0300 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Thunderbird/60.8.0 MIME-Version: 1.0 In-Reply-To: <1563160001.4793.4.camel@mtksdccf07> Content-Type: text/plain; charset=utf-8 Content-Language: en-US Content-Transfer-Encoding: 8bit Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On 7/15/19 6:06 AM, Walter Wu wrote: > On Fri, 2019-07-12 at 13:52 +0300, Andrey Ryabinin wrote: >> >> On 7/11/19 1:06 PM, Walter Wu wrote: >>> On Wed, 2019-07-10 at 21:24 +0300, Andrey Ryabinin wrote: >>>> >>>> On 7/9/19 5:53 AM, Walter Wu wrote: >>>>> On Mon, 2019-07-08 at 19:33 +0300, Andrey Ryabinin wrote: >>>>>> >>>>>> On 7/5/19 4:34 PM, Dmitry Vyukov wrote: >>>>>>> On Mon, Jul 1, 2019 at 11:56 AM Walter Wu wrote: >>>> >>>>>>> >>>>>>> Sorry for delays. I am overwhelm by some urgent work. I afraid to >>>>>>> promise any dates because the next week I am on a conference, then >>>>>>> again a backlog and an intern starting... >>>>>>> >>>>>>> Andrey, do you still have concerns re this patch? This change allows >>>>>>> to print the free stack. >>>>>> >>>>>> I 'm not sure that quarantine is a best way to do that. Quarantine is made to delay freeing, but we don't that here. >>>>>> If we want to remember more free stacks wouldn't be easier simply to remember more stacks in object itself? >>>>>> Same for previously used tags for better use-after-free identification. >>>>>> >>>>> >>>>> Hi Andrey, >>>>> >>>>> We ever tried to use object itself to determine use-after-free >>>>> identification, but tag-based KASAN immediately released the pointer >>>>> after call kfree(), the original object will be used by another >>>>> pointer, if we use object itself to determine use-after-free issue, then >>>>> it has many false negative cases. so we create a lite quarantine(ring >>>>> buffers) to record recent free stacks in order to avoid those false >>>>> negative situations. >>>> >>>> I'm telling that *more* than one free stack and also tags per object can be stored. >>>> If object reused we would still have information about n-last usages of the object. >>>> It seems like much easier and more efficient solution than patch you proposing. >>>> >>> To make the object reused, we must ensure that no other pointers uses it >>> after kfree() release the pointer. >>> Scenario: >>> 1). The object reused information is valid when no another pointer uses >>> it. >>> 2). The object reused information is invalid when another pointer uses >>> it. >>> Do you mean that the object reused is scenario 1) ? >>> If yes, maybe we can change the calling quarantine_put() location. It >>> will be fully use that quarantine, but at scenario 2) it looks like to >>> need this patch. >>> If no, maybe i miss your meaning, would you tell me how to use invalid >>> object information? or? >>> >> >> >> KASAN keeps information about object with the object, right after payload in the kasan_alloc_meta struct. >> This information is always valid as long as slab page allocated. Currently it keeps only one last free stacktrace. >> It could be extended to record more free stacktraces and also record previously used tags which will allow you >> to identify use-after-free and extract right free stacktrace. > > Thanks for your explanation. > > For extend slub object, if one record is 9B (sizeof(u8)+ sizeof(struct > kasan_track)) and add five records into slub object, every slub object > may add 45B usage after the system runs longer. > Slub object number is easy more than 1,000,000(maybe it may be more > bigger), then the extending object memory usage should be 45MB, and > unfortunately it is no limit. The memory usage is more bigger than our > patch. No, it's not necessarily more. And there are other aspects to consider such as performance, how simple reliable the code is. > > We hope tag-based KASAN advantage is smaller memory usage. If it’s > possible, we should spend less memory in order to identify > use-after-free. Would you accept our patch after fine tune it? Sure, if you manage to fix issues and demonstrate that performance penalty of your patch is close to zero.