From: Vlastimil Babka <vbabka@suse.cz>
To: "Jiazi.Li" <jqqlijiazi@gmail.com>,
Christoph Lameter <cl@linux.com>,
Pekka Enberg <penberg@kernel.org>,
David Rientjes <rientjes@google.com>,
Joonsoo Kim <iamjoonsoo.kim@lge.com>,
Andrew Morton <akpm@linux-foundation.org>,
Roman Gushchin <roman.gushchin@linux.dev>,
Hyeonggon Yoo <42.hyeyoo@gmail.com>
Cc: "Jiazi.Li" <jiazi.li@transsion.com>,
linux-mm@kvack.org, Kees Cook <keescook@chromium.org>,
Kernel Hardening <kernel-hardening@lists.openwall.com>
Subject: Re: [PATCH] mm/slab: always use cache from obj
Date: Tue, 14 Feb 2023 11:33:21 +0100 [thread overview]
Message-ID: <bb6ad3ee-8d00-bdd5-3f50-a8f836892d51@suse.cz> (raw)
In-Reply-To: <20230214101949.7461-1-jiazi.li@transsion.com>
On 2/14/23 11:19, Jiazi.Li wrote:
> If free obj to a wrong cache, in addition random, different offset
> and object_size will also cause problems:
> 1. The offset of a cache with a ctor is not zero, free an object from
> this cache to cache with offset zero, will write next freepointer to
> wrong location, resulting in confusion of freelist.
Kernels hardened against freelist corruption will enable
CONFIG_SLAB_FREELIST_HARDENED, so that's already covered, no?
> 2. If wrong cache want init on free, and cache->object_size is large
> than obj size, which may lead to overwrite issue.
In general, being defensive against usage errors is part of either hardening
or debugging, which is what the existing code takes into account.
> Compared with adding a lot of if-else, it may be better to use obj's
> cache directly.
>
> Signed-off-by: Jiazi.Li <jiazi.li@transsion.com>
> ---
> mm/slab.h | 4 ----
> 1 file changed, 4 deletions(-)
>
> diff --git a/mm/slab.h b/mm/slab.h
> index 63fb4c00d529..ed39b2e4f27b 100644
> --- a/mm/slab.h
> +++ b/mm/slab.h
> @@ -670,10 +670,6 @@ static inline struct kmem_cache *cache_from_obj(struct kmem_cache *s, void *x)
> {
> struct kmem_cache *cachep;
>
> - if (!IS_ENABLED(CONFIG_SLAB_FREELIST_HARDENED) &&
> - !kmem_cache_debug_flags(s, SLAB_CONSISTENCY_CHECKS))
> - return s;
> -
> cachep = virt_to_cache(x);
> if (WARN(cachep && cachep != s,
> "%s: Wrong slab cache. %s but object is from %s\n",
next parent reply other threads:[~2023-02-14 10:33 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
[not found] <20230214101949.7461-1-jiazi.li@transsion.com>
2023-02-14 10:33 ` Vlastimil Babka [this message]
2023-02-15 5:49 ` [PATCH] mm/slab: always use cache from obj lijiazi
2023-02-15 9:41 ` Vlastimil Babka
2023-02-15 10:03 ` lijiazi
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=bb6ad3ee-8d00-bdd5-3f50-a8f836892d51@suse.cz \
--to=vbabka@suse.cz \
--cc=42.hyeyoo@gmail.com \
--cc=akpm@linux-foundation.org \
--cc=cl@linux.com \
--cc=iamjoonsoo.kim@lge.com \
--cc=jiazi.li@transsion.com \
--cc=jqqlijiazi@gmail.com \
--cc=keescook@chromium.org \
--cc=kernel-hardening@lists.openwall.com \
--cc=linux-mm@kvack.org \
--cc=penberg@kernel.org \
--cc=rientjes@google.com \
--cc=roman.gushchin@linux.dev \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).