On Mon, Jul 5, 2021 at 12:33 PM <yee.lee@xxxxxxxxxxxx> wrote:
>
> From: Yee Lee <yee.lee@xxxxxxxxxxxx>
>
> Issue: when SLUB debug is on, hwtag kasan_unpoison() would overwrite
> the redzone of object with unaligned size.
>
> An additional memzero_explicit() path is added to replacing init by
> hwtag instruction for those unaligned size at SLUB debug mode.
>
> The penalty is acceptable since they are only enabled in debug mode,
> not production builds. A block of comment is added for explanation.
>
> Cc: Andrey Ryabinin <ryabinin.a.a@xxxxxxxxx>
> Cc: Alexander Potapenko <glider@xxxxxxxxxx>
> Cc: Dmitry Vyukov <dvyukov@xxxxxxxxxx>
> Cc: Andrew Morton <akpm@xxxxxxxxxxxxxxxxxxxx>
> Suggested-by: Marco Elver <elver@xxxxxxxxxx>
> Suggested-by: Andrey Konovalov <andreyknvl@xxxxxxxxx>
> Signed-off-by: Yee Lee <yee.lee@xxxxxxxxxxxx>
> ---
> mm/kasan/kasan.h | 12 ++++++++++++
> 1 file changed, 12 insertions(+)
>
> diff --git a/mm/kasan/kasan.h b/mm/kasan/kasan.h
> index 98e3059bfea4..d739cdd1621a 100644
> --- a/mm/kasan/kasan.h
> +++ b/mm/kasan/kasan.h
> @@ -9,6 +9,7 @@
> #ifdef CONFIG_KASAN_HW_TAGS
>
> #include <linux/static_key.h>
> +#include "../slab.h"
>
> DECLARE_STATIC_KEY_FALSE(kasan_flag_stacktrace);
> extern bool kasan_flag_async __ro_after_init;
> @@ -387,6 +388,17 @@ static inline void kasan_unpoison(const void *addr, size_t size, bool init)
>
> if (WARN_ON((unsigned long)addr & KASAN_GRANULE_MASK))
> return;
> + /*
> + * Explicitly initialize the memory with the precise object size to
> + * avoid overwriting the SLAB redzone. This disables initialization in
> + * the arch code and may thus lead to performance penalty. The penalty
> + * is accepted since SLAB redzones aren't enabled in production builds.
> + */
> + if (__slub_debug_enabled() &&
What happened to slub_debug_enabled_unlikely()? Was it renamed? Why? I
didn't receive patch #1 of v6 (nor of v5).
> + init && ((unsigned long)size & KASAN_GRANULE_MASK)) {
> + init = false;
> + memzero_explicit((void *)addr, size);
> + }
> size = round_up(size, KASAN_GRANULE_SIZE);
>
> hw_set_mem_tag_range((void *)addr, size, tag, init);
> --
> 2.18.0
>
