mm: slub: add kernel address sanitizer support for slub allocator

With this patch kasan will be able to catch bugs in memory allocated by
slub.  Initially all objects in newly allocated slab page, marked as
redzone.  Later, when allocation of slub object happens, requested by
caller number of bytes marked as accessible, and the rest of the object
(including slub's metadata) marked as redzone (inaccessible).

We also mark object as accessible if ksize was called for this object.
There is some places in kernel where ksize function is called to inquire
size of really allocated area.  Such callers could validly access whole
allocated memory, so it should be marked as accessible.

Code in slub.c and slab_common.c files could validly access to object's
metadata, so instrumentation for this files are disabled.

Signed-off-by: Andrey Ryabinin <a.ryabinin@samsung.com>
Signed-off-by: Dmitry Chernenkov <dmitryc@google.com>
Cc: Dmitry Vyukov <dvyukov@google.com>
Cc: Konstantin Serebryany <kcc@google.com>
Signed-off-by: Andrey Konovalov <adech.fo@gmail.com>
Cc: Yuri Gribov <tetra2005@gmail.com>
Cc: Konstantin Khlebnikov <koct9i@gmail.com>
Cc: Sasha Levin <sasha.levin@oracle.com>
Cc: Christoph Lameter <cl@linux.com>
Cc: Joonsoo Kim <iamjoonsoo.kim@lge.com>
Cc: Dave Hansen <dave.hansen@intel.com>
Cc: Andi Kleen <andi@firstfloor.org>
Cc: Ingo Molnar <mingo@elte.hu>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: "H. Peter Anvin" <hpa@zytor.com>
Cc: Christoph Lameter <cl@linux.com>
Cc: Pekka Enberg <penberg@kernel.org>
Cc: David Rientjes <rientjes@google.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

3 files changed, 124 insertions, 0 deletions

diff --git a/mm/kasan/kasan.c b/mm/kasan/kasan.c
index b516eb8632b9..dc83f070edb6 100644
--- a/mm/kasan/kasan.c
+++ b/mm/kasan/kasan.c
@@ -31,6 +31,7 @@
 #include <linux/kasan.h>
 
 #include "kasan.h"
+#include "../slab.h"
 
 /*
  * Poisons the shadow memory for 'size' bytes starting from 'addr'.
@@ -268,6 +269,103 @@ void kasan_free_pages(struct page *page, unsigned int order)
                                 KASAN_FREE_PAGE);
 }
 
+void kasan_poison_slab(struct page *page)
+{
+        kasan_poison_shadow(page_address(page),
+                        PAGE_SIZE << compound_order(page),
+                        KASAN_KMALLOC_REDZONE);
+}
+
+void kasan_unpoison_object_data(struct kmem_cache *cache, void *object)
+{
+        kasan_unpoison_shadow(object, cache->object_size);
+}
+
+void kasan_poison_object_data(struct kmem_cache *cache, void *object)
+{
+        kasan_poison_shadow(object,
+                        round_up(cache->object_size, KASAN_SHADOW_SCALE_SIZE),
+                        KASAN_KMALLOC_REDZONE);
+}
+
+void kasan_slab_alloc(struct kmem_cache *cache, void *object)
+{
+        kasan_kmalloc(cache, object, cache->object_size);
+}
+
+void kasan_slab_free(struct kmem_cache *cache, void *object)
+{
+        unsigned long size = cache->object_size;
+        unsigned long rounded_up_size = round_up(size, KASAN_SHADOW_SCALE_SIZE);
+
+        /* RCU slabs could be legally used after free within the RCU period */
+        if (unlikely(cache->flags & SLAB_DESTROY_BY_RCU))
+                return;
+
+        kasan_poison_shadow(object, rounded_up_size, KASAN_KMALLOC_FREE);
+}
+
+void kasan_kmalloc(struct kmem_cache *cache, const void *object, size_t size)
+{
+        unsigned long redzone_start;
+        unsigned long redzone_end;
+
+        if (unlikely(object == NULL))
+                return;
+
+        redzone_start = round_up((unsigned long)(object + size),
+                                KASAN_SHADOW_SCALE_SIZE);
+        redzone_end = round_up((unsigned long)object + cache->object_size,
+                                KASAN_SHADOW_SCALE_SIZE);
+
+        kasan_unpoison_shadow(object, size);
+        kasan_poison_shadow((void *)redzone_start, redzone_end - redzone_start,
+                KASAN_KMALLOC_REDZONE);
+}
+EXPORT_SYMBOL(kasan_kmalloc);
+
+void kasan_kmalloc_large(const void *ptr, size_t size)
+{
+        struct page *page;
+        unsigned long redzone_start;
+        unsigned long redzone_end;
+
+        if (unlikely(ptr == NULL))
+                return;
+
+        page = virt_to_page(ptr);
+        redzone_start = round_up((unsigned long)(ptr + size),
+                                KASAN_SHADOW_SCALE_SIZE);
+        redzone_end = (unsigned long)ptr + (PAGE_SIZE << compound_order(page));
+
+        kasan_unpoison_shadow(ptr, size);
+        kasan_poison_shadow((void *)redzone_start, redzone_end - redzone_start,
+                KASAN_PAGE_REDZONE);
+}
+
+void kasan_krealloc(const void *object, size_t size)
+{
+        struct page *page;
+
+        if (unlikely(object == ZERO_SIZE_PTR))
+                return;
+
+        page = virt_to_head_page(object);
+
+        if (unlikely(!PageSlab(page)))
+                kasan_kmalloc_large(object, size);
+        else
+                kasan_kmalloc(page->slab_cache, object, size);
+}
+
+void kasan_kfree_large(const void *ptr)
+{
+        struct page *page = virt_to_page(ptr);
+
+        kasan_poison_shadow(ptr, PAGE_SIZE << compound_order(page),
+                        KASAN_FREE_PAGE);
+}
+
 #define DEFINE_ASAN_LOAD_STORE(size)                            \
         void __asan_load##size(unsigned long addr)              \
         {                                                       \
diff --git a/mm/kasan/kasan.h b/mm/kasan/kasan.h
index d3c90d5dd97a..5b052ab40cf9 100644
--- a/mm/kasan/kasan.h
+++ b/mm/kasan/kasan.h
@@ -7,6 +7,11 @@
 #define KASAN_SHADOW_MASK       (KASAN_SHADOW_SCALE_SIZE - 1)
 
 #define KASAN_FREE_PAGE         0xFF  /* page was freed */
+#define KASAN_FREE_PAGE         0xFF  /* page was freed */
+#define KASAN_PAGE_REDZONE      0xFE  /* redzone for kmalloc_large allocations */
+#define KASAN_KMALLOC_REDZONE   0xFC  /* redzone inside slub object */
+#define KASAN_KMALLOC_FREE      0xFB  /* object was freed (kmem_cache_free/kfree) */
+
 
 struct kasan_access_info {
         const void *access_addr;
diff --git a/mm/kasan/report.c b/mm/kasan/report.c
index fab8e7882ff1..2760edb4d0a8 100644
--- a/mm/kasan/report.c
+++ b/mm/kasan/report.c
@@ -24,6 +24,7 @@
 #include <linux/kasan.h>
 
 #include "kasan.h"
+#include "../slab.h"
 
 /* Shadow layout customization. */
 #define SHADOW_BYTES_PER_BLOCK 1
@@ -55,8 +56,11 @@ static void print_error_description(struct kasan_access_info *info)
 
         switch (shadow_val) {
         case KASAN_FREE_PAGE:
+        case KASAN_KMALLOC_FREE:
                 bug_type = "use after free";
                 break;
+        case KASAN_PAGE_REDZONE:
+        case KASAN_KMALLOC_REDZONE:
         case 0 ... KASAN_SHADOW_SCALE_SIZE - 1:
                 bug_type = "out of bounds access";
                 break;
@@ -77,6 +81,23 @@ static void print_address_description(struct kasan_access_info *info)
         if ((addr >= (void *)PAGE_OFFSET) &&
                 (addr < high_memory)) {
                 struct page *page = virt_to_head_page(addr);
+
+                if (PageSlab(page)) {
+                        void *object;
+                        struct kmem_cache *cache = page->slab_cache;
+                        void *last_object;
+
+                        object = virt_to_obj(cache, page_address(page), addr);
+                        last_object = page_address(page) +
+                                page->objects * cache->size;
+
+                        if (unlikely(object > last_object))
+                                object = last_object; /* we hit into padding */
+
+                        object_err(cache, page, object,
+                                "kasan: bad access detected");
+                        return;
+                }
                 dump_page(page, "kasan: bad access detected");
         }