Commit 1e4dd8a4 authored by Peng Fan's avatar Peng Fan Committed by Liu Shixin
Browse files

mm, slub: avoid zeroing kmalloc redzone 

mainline inclusion
from mainline-v6.12-rc1
commit 59090e479ac78ae18facd4c58eb332562a23020e
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAYRAH
CVE: CVE-2024-49885

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=59090e479ac78ae18facd4c58eb332562a23020e



--------------------------------

Since commit 946fa0db ("mm/slub: extend redzone check to extra
allocated kmalloc space than requested"), setting orig_size treats
the wasted space (object_size - orig_size) as a redzone. However with
init_on_free=1 we clear the full object->size, including the redzone.

Additionally we clear the object metadata, including the stored orig_size,
making it zero, which makes check_object() treat the whole object as a
redzone.

These issues lead to the following BUG report with "slub_debug=FUZ
init_on_free=1":

[    0.000000] =============================================================================
[    0.000000] BUG kmalloc-8 (Not tainted): kmalloc Redzone overwritten
[    0.000000] -----------------------------------------------------------------------------
[    0.000000]
[    0.000000] 0xffff000010032858-0xffff00001003285f @offset=2136. First byte 0x0 instead of 0xcc
[    0.000000] FIX kmalloc-8: Restoring kmalloc Redzone 0xffff000010032858-0xffff00001003285f=0xcc
[    0.000000] Slab 0xfffffdffc0400c80 objects=36 used=23 fp=0xffff000010032a18 flags=0x3fffe0000000200(workingset|node=0|zone=0|lastcpupid=0x1ffff)
[    0.000000] Object 0xffff000010032858 @offset=2136 fp=0xffff0000100328c8
[    0.000000]
[    0.000000] Redzone  ffff000010032850: cc cc cc cc cc cc cc cc                          ........
[    0.000000] Object   ffff000010032858: cc cc cc cc cc cc cc cc                          ........
[    0.000000] Redzone  ffff000010032860: cc cc cc cc cc cc cc cc                          ........
[    0.000000] Padding  ffff0000100328b4: 00 00 00 00 00 00 00 00 00 00 00 00              ............
[    0.000000] CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted 6.11.0-rc3-next-20240814-00004-g61844c55c3f4 #144
[    0.000000] Hardware name: NXP i.MX95 19X19 board (DT)
[    0.000000] Call trace:
[    0.000000]  dump_backtrace+0x90/0xe8
[    0.000000]  show_stack+0x18/0x24
[    0.000000]  dump_stack_lvl+0x74/0x8c
[    0.000000]  dump_stack+0x18/0x24
[    0.000000]  print_trailer+0x150/0x218
[    0.000000]  check_object+0xe4/0x454
[    0.000000]  free_to_partial_list+0x2f8/0x5ec

To address the issue, use orig_size to clear the used area. And restore
the value of orig_size after clear the remaining area.

When CONFIG_SLUB_DEBUG not defined, (get_orig_size()' directly returns
s->object_size. So when using memset to init the area, the size can simply
be orig_size, as orig_size returns object_size when CONFIG_SLUB_DEBUG not
enabled. And orig_size can never be bigger than object_size.

Fixes: 946fa0db ("mm/slub: extend redzone check to extra allocated kmalloc space than requested")
Cc: <stable@vger.kernel.org>
Reviewed-by: default avatarFeng Tang <feng.tang@intel.com>
Acked-by: default avatarDavid Rientjes <rientjes@google.com>
Signed-off-by: default avatarPeng Fan <peng.fan@nxp.com>
Signed-off-by: default avatarVlastimil Babka <vbabka@suse.cz>
Conflicts:
	mm/slub.c
[ Context conflict due to miss commit 4d2bcefa965b, 2d5524635b00
  and 8f828aa48812. ]
Signed-off-by: default avatarLiu Shixin <liushixin2@huawei.com>
parent 01fdcdfe

mm/slub.c

+72 −66
Original line number Diff line number Diff line
@@ -467,6 +467,26 @@ static inline void set_freepointer(struct kmem_cache *s, void *object, void *fp) 
	*(freeptr_t *)freeptr_addr = freelist_ptr_encode(s, fp, freeptr_addr);

}



/*

 * See comment in calculate_sizes().

 */

static inline bool freeptr_outside_object(struct kmem_cache *s)

{

	return s->offset >= s->inuse;

}



/*

 * Return offset of the end of info block which is inuse + free pointer if

 * not overlapping with object.

 */

static inline unsigned int get_info_end(struct kmem_cache *s)

{

	if (freeptr_outside_object(s))

		return s->inuse + sizeof(void *);

	else

		return s->inuse;

}



/* Loop over all objects in a slab */

#define for_each_object(__p, __s, __addr, __objects) \

	for (__p = fixup_red_left(__s, __addr); \
@@ -642,6 +662,50 @@ static inline bool slab_update_freelist(struct kmem_cache *s, struct slab *slab, 
	return false;

}



/*

 * kmalloc caches has fixed sizes (mostly power of 2), and kmalloc() API

 * family will round up the real request size to these fixed ones, so

 * there could be an extra area than what is requested. Save the original

 * request size in the meta data area, for better debug and sanity check.

 */

static inline void set_orig_size(struct kmem_cache *s,

				void *object, unsigned int orig_size)

{

	void *p = kasan_reset_tag(object);



	if (!slub_debug_orig_size(s))

		return;



#ifdef CONFIG_KASAN_GENERIC

	/*

	 * KASAN could save its free meta data in object's data area at

	 * offset 0, if the size is larger than 'orig_size', it will

	 * overlap the data redzone in [orig_size+1, object_size], and

	 * the check should be skipped.

	 */

	if (kasan_metadata_size(s, true) > orig_size)

		orig_size = s->object_size;

#endif



	p += get_info_end(s);

	p += sizeof(struct track) * 2;



	*(unsigned int *)p = orig_size;

}



static inline unsigned int get_orig_size(struct kmem_cache *s, void *object)

{

	void *p = kasan_reset_tag(object);



	if (!slub_debug_orig_size(s))

		return s->object_size;



	p += get_info_end(s);

	p += sizeof(struct track) * 2;



	return *(unsigned int *)p;

}



#ifdef CONFIG_SLUB_DEBUG

static unsigned long object_map[BITS_TO_LONGS(MAX_OBJS_PER_PAGE)];

static DEFINE_SPINLOCK(object_map_lock);
@@ -755,26 +819,6 @@ static void print_section(char *level, char *text, u8 *addr, 
	metadata_access_disable();

}



/*

 * See comment in calculate_sizes().

 */

static inline bool freeptr_outside_object(struct kmem_cache *s)

{

	return s->offset >= s->inuse;

}



/*

 * Return offset of the end of info block which is inuse + free pointer if

 * not overlapping with object.

 */

static inline unsigned int get_info_end(struct kmem_cache *s)

{

	if (freeptr_outside_object(s))

		return s->inuse + sizeof(void *);

	else

		return s->inuse;

}



static struct track *get_track(struct kmem_cache *s, void *object,

	enum track_item alloc)

{
@@ -875,50 +919,6 @@ static void print_slab_info(const struct slab *slab) 
	       folio_flags(folio, 0));

}



/*

 * kmalloc caches has fixed sizes (mostly power of 2), and kmalloc() API

 * family will round up the real request size to these fixed ones, so

 * there could be an extra area than what is requested. Save the original

 * request size in the meta data area, for better debug and sanity check.

 */

static inline void set_orig_size(struct kmem_cache *s,

				void *object, unsigned int orig_size)

{

	void *p = kasan_reset_tag(object);



	if (!slub_debug_orig_size(s))

		return;



#ifdef CONFIG_KASAN_GENERIC

	/*

	 * KASAN could save its free meta data in object's data area at

	 * offset 0, if the size is larger than 'orig_size', it will

	 * overlap the data redzone in [orig_size+1, object_size], and

	 * the check should be skipped.

	 */

	if (kasan_metadata_size(s, true) > orig_size)

		orig_size = s->object_size;

#endif



	p += get_info_end(s);

	p += sizeof(struct track) * 2;



	*(unsigned int *)p = orig_size;

}



static inline unsigned int get_orig_size(struct kmem_cache *s, void *object)

{

	void *p = kasan_reset_tag(object);



	if (!slub_debug_orig_size(s))

		return s->object_size;



	p += get_info_end(s);

	p += sizeof(struct track) * 2;



	return *(unsigned int *)p;

}



void skip_orig_size_check(struct kmem_cache *s, const void *object)

{

	set_orig_size(s, (void *)object, s->object_size);
@@ -1764,7 +1764,6 @@ static inline void inc_slabs_node(struct kmem_cache *s, int node, 
							int objects) {}

static inline void dec_slabs_node(struct kmem_cache *s, int node,

							int objects) {}



#ifndef CONFIG_SLUB_TINY

static bool freelist_corrupted(struct kmem_cache *s, struct slab *slab,

			       void **freelist, void *nextfree)
@@ -1804,12 +1803,19 @@ static __always_inline bool slab_free_hook(struct kmem_cache *s, 
	 */

	if (init) {

		int rsize;

		unsigned int orig_size;



		orig_size = get_orig_size(s, x);

		if (!kasan_has_integrated_init())

			memset(kasan_reset_tag(x), 0, s->object_size);

			memset(kasan_reset_tag(x), 0, orig_size);

		rsize = (s->flags & SLAB_RED_ZONE) ? s->red_left_pad : 0;

		memset((char *)kasan_reset_tag(x) + s->inuse, 0,

		       s->size - s->inuse - rsize);

		/*

		 * Restore orig_size, otherwize kmalloc redzone overwritten

		 * would be reported

		 */

		set_orig_size(s, x, orig_size);

	}

	/* KASAN might put x into memory quarantine, delaying its reuse. */

	return kasan_slab_free(s, x, init);