lkml.org 
[lkml]   [2020]   [May]   [13]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    SubjectRe: [PATCH v2 1/3] rcu/kasan: record and print call_rcu() call stack
    From
    Date
    On Wed, 2020-05-13 at 11:16 +0200, Dmitry Vyukov wrote:
    > On Wed, May 13, 2020 at 11:05 AM Walter Wu <walter-zh.wu@mediatek.com> wrote:
    > >
    > > On Wed, 2020-05-13 at 08:51 +0200, 'Dmitry Vyukov' via kasan-dev wrote:
    > > > On Wed, May 13, 2020 at 3:48 AM Walter Wu <walter-zh.wu@mediatek.com> wrote:
    > > > > > > > Are you sure it will increase object size?
    > > > > > > > I think we overlap kasan_free_meta with the object as well. The only
    > > > > > > > case we don't overlap kasan_free_meta with the object are
    > > > > > > > SLAB_TYPESAFE_BY_RCU || cache->ctor. But these are rare and it should
    > > > > > > > only affect small objects with small redzones.
    > > > > > > > And I think now we simply have a bug for these objects, we check
    > > > > > > > KASAN_KMALLOC_FREE and then assume object contains free stack, but for
    > > > > > > > objects with ctor, they still contain live object data, we don't store
    > > > > > > > free stack in them.
    > > > > > > > Such objects can be both free and still contain user data.
    > > > > > > >
    > > > > > >
    > > > > > > Overlay kasan_free_meta. I see. but overlay it only when the object was
    > > > > > > freed. kasan_free_meta will be used until free object.
    > > > > > > 1). When put object into quarantine, it need kasan_free_meta.
    > > > > > > 2). When the object exit from quarantine, it need kasan_free_meta
    > > > > > >
    > > > > > > If we choose to overlay kasan_free_meta, then the free stack will be
    > > > > > > stored very late. It may has no free stack in report.
    > > > > >
    > > > > > Sorry, I don't understand what you mean.
    > > > > >
    > > > > > Why will it be stored too late?
    > > > > > In __kasan_slab_free() putting into quarantine and recording free
    > > > > > stack are literally adjacent lines of code:
    > > > > >
    > > > > > static bool __kasan_slab_free(struct kmem_cache *cache, void *object,
    > > > > > unsigned long ip, bool quarantine)
    > > > > > {
    > > > > > ...
    > > > > > kasan_set_free_info(cache, object, tag);
    > > > > > quarantine_put(get_free_info(cache, object), cache);
    > > > > >
    > > > > >
    > > > > > Just to make sure, what I meant is that we add free_track to kasan_free_meta:
    > > > > >
    > > > > > struct kasan_free_meta {
    > > > > > struct qlist_node quarantine_link;
    > > > > > + struct kasan_track free_track;
    > > > > > };
    > > > > >
    > > > >
    > > > > When I see above struct kasan_free_meta, I know why you don't understand
    > > > > my meaning, because I thought you were going to overlay the
    > > > > quarantine_link by free_track, but it seems like to add free_track to
    > > > > kasan_free_meta. Does it enlarge meta-data size?
    > > >
    > > > I would assume it should not increase meta-data size. In both cases we
    > > > store exactly the same information inside of the object: quarantine
    > > > link and free track.
    > > > I see it more as a question of code organization. We already have a
    > > > concept of "this data is placed inside of the freed object", we
    > > > already have a name for it (kasan_free_meta), we already have code to
    > > > choose where to place it, we already have helper functions to access
    > > > it. And your change effectively duplicates all of this to place the
    > > > free track.
    > > >
    > >
    > > I want to make a summary. Which of the following is the approach we
    > > want? or if I have some misunderstandings, please help me to correct.
    > > Thanks.
    > >
    > > 1) For different object, then it will has two ways.
    > > 1.a) When object are LAB_TYPESAFE_BY_RCU || cache->ctor, then store free
    > > stack into free track of struct kasan_free_meta.
    > > 2.b) Except 1.a), store free stack into freed object.
    > >
    > > or
    > >
    > > 2) We always store free stack into free track of struct kasan_free_meta
    >
    > I meant 2): We always store free stack into free track of struct
    > kasan_free_meta.
    > I think it will do the same as other options but just with less code
    > (and simpler code).
    >
    > Maybe I am missing something here?
    >

    You are right, I only make a final confirmation with you. Now there
    should be no problems, I will try to implement it.

    Thank you for your good suggestion.

    >
    >
    >
    > > > > > And I think its life-time and everything should be exactly what we need.
    > > > > >
    > > > > > Also it should help to fix the problem with ctors: kasan_free_meta is
    > > > > > already allocated on the side for such objects, and that's exactly
    > > > > > what we need for objects with ctor's.
    > > > >
    > > > > I see.

    \
     
     \ /
      Last update: 2020-05-13 11:23    [W:2.758 / U:0.776 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site