From nobody Mon Nov 01 14:33:01 2021 X-Original-To: dev-commits-src-all@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 50F4B182DA05; Mon, 1 Nov 2021 14:33:05 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R3" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4Hjb9X1f1Cz3sDv; Mon, 1 Nov 2021 14:33:04 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id 81E0A13613; Mon, 1 Nov 2021 14:33:01 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from gitrepo.freebsd.org ([127.0.1.44]) by gitrepo.freebsd.org (8.16.1/8.16.1) with ESMTP id 1A1EX13x021386; Mon, 1 Nov 2021 14:33:01 GMT (envelope-from git@gitrepo.freebsd.org) Received: (from git@localhost) by gitrepo.freebsd.org (8.16.1/8.16.1/Submit) id 1A1EX1nE021385; Mon, 1 Nov 2021 14:33:01 GMT (envelope-from git) Date: Mon, 1 Nov 2021 14:33:01 GMT Message-Id: <202111011433.1A1EX1nE021385@gitrepo.freebsd.org> To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Mark Johnston Subject: git: ed66f9c61b0f - stable/13 - kmem: Add KASAN state transitions List-Id: Commit messages for all branches of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-all List-Help: List-Post: List-Subscribe: List-Unsubscribe: Sender: owner-dev-commits-src-all@freebsd.org X-BeenThere: dev-commits-src-all@freebsd.org MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: markj X-Git-Repository: src X-Git-Refname: refs/heads/stable/13 X-Git-Reftype: branch X-Git-Commit: ed66f9c61b0f91194164702bf0919c12c0354344 Auto-Submitted: auto-generated X-ThisMailContainsUnwantedMimeParts: N The branch stable/13 has been updated by markj: URL: https://cgit.FreeBSD.org/src/commit/?id=ed66f9c61b0f91194164702bf0919c12c0354344 commit ed66f9c61b0f91194164702bf0919c12c0354344 Author: Mark Johnston AuthorDate: 2021-04-13 21:40:01 +0000 Commit: Mark Johnston CommitDate: 2021-11-01 14:03:11 +0000 kmem: Add KASAN state transitions Memory allocated with kmem_* is unmapped upon free, so KASAN doesn't provide a lot of benefit, but since allocations are always a multiple of the page size we can create a redzone when the allocation request size is not a multiple of the page size. Sponsored by: The FreeBSD Foundation (cherry picked from commit 2b914b85ddf4c25d112b2639bbbb7618641872b4) --- sys/vm/vm_kern.c | 36 ++++++++++++++++++++++-------------- 1 file changed, 22 insertions(+), 14 deletions(-) diff --git a/sys/vm/vm_kern.c b/sys/vm/vm_kern.c index 160821ba3a19..f25784857440 100644 --- a/sys/vm/vm_kern.c +++ b/sys/vm/vm_kern.c @@ -71,12 +71,13 @@ __FBSDID("$FreeBSD$"); #include #include -#include /* for ticks and hz */ +#include #include #include +#include #include -#include #include +#include #include #include #include @@ -215,25 +216,26 @@ kmem_alloc_attr_domain(int domain, vm_size_t size, int flags, vm_paddr_t low, vm_object_t object; vm_offset_t addr, i, offset; vm_page_t m; + vm_size_t asize; int pflags; vm_prot_t prot; object = kernel_object; - size = round_page(size); + asize = round_page(size); vmem = vm_dom[domain].vmd_kernel_arena; - if (vmem_alloc(vmem, size, M_BESTFIT | flags, &addr)) + if (vmem_alloc(vmem, asize, M_BESTFIT | flags, &addr)) return (0); offset = addr - VM_MIN_KERNEL_ADDRESS; pflags = malloc2vm_flags(flags) | VM_ALLOC_WIRED; prot = (flags & M_EXEC) != 0 ? VM_PROT_ALL : VM_PROT_RW; VM_OBJECT_WLOCK(object); - for (i = 0; i < size; i += PAGE_SIZE) { + for (i = 0; i < asize; i += PAGE_SIZE) { m = kmem_alloc_contig_pages(object, atop(offset + i), domain, pflags, 1, low, high, PAGE_SIZE, 0, memattr); if (m == NULL) { VM_OBJECT_WUNLOCK(object); kmem_unback(object, addr, i); - vmem_free(vmem, addr, size); + vmem_free(vmem, addr, asize); return (0); } KASSERT(vm_page_domain(m) == domain, @@ -246,6 +248,7 @@ kmem_alloc_attr_domain(int domain, vm_size_t size, int flags, vm_paddr_t low, prot | PMAP_ENTER_WIRED, 0); } VM_OBJECT_WUNLOCK(object); + kasan_mark((void *)addr, size, asize, KASAN_KMEM_REDZONE); return (addr); } @@ -294,23 +297,24 @@ kmem_alloc_contig_domain(int domain, vm_size_t size, int flags, vm_paddr_t low, vm_object_t object; vm_offset_t addr, offset, tmp; vm_page_t end_m, m; + vm_size_t asize; u_long npages; int pflags; object = kernel_object; - size = round_page(size); + asize = round_page(size); vmem = vm_dom[domain].vmd_kernel_arena; - if (vmem_alloc(vmem, size, flags | M_BESTFIT, &addr)) + if (vmem_alloc(vmem, asize, flags | M_BESTFIT, &addr)) return (0); offset = addr - VM_MIN_KERNEL_ADDRESS; pflags = malloc2vm_flags(flags) | VM_ALLOC_WIRED; - npages = atop(size); + npages = atop(asize); VM_OBJECT_WLOCK(object); m = kmem_alloc_contig_pages(object, atop(offset), domain, pflags, npages, low, high, alignment, boundary, memattr); if (m == NULL) { VM_OBJECT_WUNLOCK(object); - vmem_free(vmem, addr, size); + vmem_free(vmem, addr, asize); return (0); } KASSERT(vm_page_domain(m) == domain, @@ -327,6 +331,7 @@ kmem_alloc_contig_domain(int domain, vm_size_t size, int flags, vm_paddr_t low, tmp += PAGE_SIZE; } VM_OBJECT_WUNLOCK(object); + kasan_mark((void *)addr, size, asize, KASAN_KMEM_REDZONE); return (addr); } @@ -402,21 +407,23 @@ kmem_malloc_domain(int domain, vm_size_t size, int flags) { vmem_t *arena; vm_offset_t addr; + vm_size_t asize; int rv; if (__predict_true((flags & M_EXEC) == 0)) arena = vm_dom[domain].vmd_kernel_arena; else arena = vm_dom[domain].vmd_kernel_rwx_arena; - size = round_page(size); - if (vmem_alloc(arena, size, flags | M_BESTFIT, &addr)) + asize = round_page(size); + if (vmem_alloc(arena, asize, flags | M_BESTFIT, &addr)) return (0); - rv = kmem_back_domain(domain, kernel_object, addr, size, flags); + rv = kmem_back_domain(domain, kernel_object, addr, asize, flags); if (rv != KERN_SUCCESS) { - vmem_free(arena, addr, size); + vmem_free(arena, addr, asize); return (0); } + kasan_mark((void *)addr, size, asize, KASAN_KMEM_REDZONE); return (addr); } @@ -608,6 +615,7 @@ kmem_free(vm_offset_t addr, vm_size_t size) struct vmem *arena; size = round_page(size); + kasan_mark((void *)addr, size, size, 0); arena = _kmem_unback(kernel_object, addr, size); if (arena != NULL) vmem_free(arena, addr, size);