Commit 56bdf83d authored by Jann Horn's avatar Jann Horn Committed by Andrew Morton
Browse files

kasan: skip quarantine if object is still accessible under RCU 

Currently, enabling KASAN masks bugs where a lockless lookup path gets a
pointer to a SLAB_TYPESAFE_BY_RCU object that might concurrently be
recycled and is insufficiently careful about handling recycled objects:
KASAN puts freed objects in SLAB_TYPESAFE_BY_RCU slabs onto its quarantine
queues, even when it can't actually detect UAF in these objects, and the
quarantine prevents fast recycling.

When I introduced CONFIG_SLUB_RCU_DEBUG, my intention was that enabling
CONFIG_SLUB_RCU_DEBUG should cause KASAN to mark such objects as freed
after an RCU grace period and put them on the quarantine, while disabling
CONFIG_SLUB_RCU_DEBUG should allow such objects to be reused immediately;
but that hasn't actually been working.

I discovered such a UAF bug involving SLAB_TYPESAFE_BY_RCU yesterday; I
could only trigger this bug in a KASAN build by disabling
CONFIG_SLUB_RCU_DEBUG and applying this patch.

Link: https://lkml.kernel.org/r/20250723-kasan-tsbrcu-noquarantine-v1-1-846c8645976c@google.com


Signed-off-by: default avatarJann Horn <jannh@google.com>
Acked-by: default avatarVlastimil Babka <vbabka@suse.cz>
Reviewed-by: default avatarAlexander Potapenko <glider@google.com>
Acked-by: default avatarAndrey Konovalov <andreyknvl@gmail.com>
Cc: Andrey Ryabinin <ryabinin.a.a@gmail.com>
Cc: Dmitriy Vyukov <dvyukov@google.com>
Cc: Vincenzo Frascino <vincenzo.frascino@arm.com>
Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
parent d171b10b

mm/kasan/common.c

+18 −7
Original line number Diff line number Diff line
@@ -230,16 +230,12 @@ static bool check_slab_allocation(struct kmem_cache *cache, void *object, 
}



static inline void poison_slab_object(struct kmem_cache *cache, void *object,

				      bool init, bool still_accessible)

				      bool init)

{

	void *tagged_object = object;



	object = kasan_reset_tag(object);



	/* RCU slabs could be legally used after free within the RCU period. */

	if (unlikely(still_accessible))

		return;



	kasan_poison(object, round_up(cache->object_size, KASAN_GRANULE_SIZE),

			KASAN_SLAB_FREE, init);
@@ -261,7 +257,22 @@ bool __kasan_slab_free(struct kmem_cache *cache, void *object, bool init, 
	if (!kasan_arch_is_ready() || is_kfence_address(object))

		return false;



	poison_slab_object(cache, object, init, still_accessible);

	/*

	 * If this point is reached with an object that must still be

	 * accessible under RCU, we can't poison it; in that case, also skip the

	 * quarantine. This should mostly only happen when CONFIG_SLUB_RCU_DEBUG

	 * has been disabled manually.

	 *

	 * Putting the object on the quarantine wouldn't help catch UAFs (since

	 * we can't poison it here), and it would mask bugs caused by

	 * SLAB_TYPESAFE_BY_RCU users not being careful enough about object

	 * reuse; so overall, putting the object into the quarantine here would

	 * be counterproductive.

	 */

	if (still_accessible)

		return false;



	poison_slab_object(cache, object, init);



	/*

	 * If the object is put into quarantine, do not let slab put the object
@@ -519,7 +530,7 @@ bool __kasan_mempool_poison_object(void *ptr, unsigned long ip) 
	if (check_slab_allocation(slab->slab_cache, ptr, ip))

		return false;



	poison_slab_object(slab->slab_cache, ptr, false, false);

	poison_slab_object(slab->slab_cache, ptr, false);

	return true;

}