8:54 p.m.
This reverts commit 9253b40a0ecb2d365f89f0a5ebc28a01735c1d24.
The commit 9253b40a0ecb only handles the current issue on X86 64/X86
architectures, furthermore the freelist_ptr_bswap_x86() depends on
disassembling a static symbol which might not be available, depending on
how the compiler decides to optimize the code, that is to say, the
compiler might generate different code eventually.
More importantly, a subsequent patch can cover the current issue on
various architectures. Given that, revert the commit.
Signed-off-by: Lianbo Jiang <lijiang(a)redhat.com>
---
defs.h | 1 -
memory.c | 49 +------------------------------------------------
2 files changed, 1 insertion(+), 49 deletions(-)
diff --git a/defs.h b/defs.h
index 5ee60f1eb3a5..b7d2382cb314 100644
--- a/defs.h
+++ b/defs.h
@@ -2662,7 +2662,6 @@ struct vm_table { /* kernel VM-related data */
#define SLAB_OVERLOAD_PAGE (0x8000000)
#define SLAB_CPU_CACHE (0x10000000)
#define SLAB_ROOT_CACHES (0x20000000)
-#define FREELIST_PTR_BSWAP (0x40000000)
#define IS_FLATMEM() (vt->flags & FLATMEM)
#define IS_DISCONTIGMEM() (vt->flags & DISCONTIGMEM)
diff --git a/memory.c b/memory.c
index acbee6389472..626c6039c6d9 100644
--- a/memory.c
+++ b/memory.c
@@ -320,7 +320,6 @@ static void dump_per_cpu_offsets(void);
static void dump_page_flags(ulonglong);
static ulong kmem_cache_nodelists(ulong);
static void dump_hstates(void);
-static void freelist_ptr_init(void);
static ulong freelist_ptr(struct meminfo *, ulong, ulong);
static ulong handle_each_vm_area(struct handle_each_vm_area_args *);
@@ -791,8 +790,6 @@ vm_init(void)
MEMBER_OFFSET_INIT(kmem_cache_name, "kmem_cache", "name");
MEMBER_OFFSET_INIT(kmem_cache_flags, "kmem_cache", "flags");
MEMBER_OFFSET_INIT(kmem_cache_random, "kmem_cache", "random");
- if (VALID_MEMBER(kmem_cache_random))
- freelist_ptr_init();
MEMBER_OFFSET_INIT(kmem_cache_cpu_freelist, "kmem_cache_cpu",
"freelist");
MEMBER_OFFSET_INIT(kmem_cache_cpu_page, "kmem_cache_cpu", "page");
if (INVALID_MEMBER(kmem_cache_cpu_page))
@@ -13965,8 +13962,6 @@ dump_vm_table(int verbose)
fprintf(fp, "%sSLAB_CPU_CACHE", others++ ? "|" : "");\
if (vt->flags & SLAB_ROOT_CACHES)
fprintf(fp, "%sSLAB_ROOT_CACHES", others++ ? "|" : "");\
- if (vt->flags & FREELIST_PTR_BSWAP)
- fprintf(fp, "%sFREELIST_PTR_BSWAP", others++ ? "|" :
"");\
if (vt->flags & USE_VMAP_AREA)
fprintf(fp, "%sUSE_VMAP_AREA", others++ ? "|" : "");\
if (vt->flags & CONFIG_NUMA)
@@ -19653,55 +19648,13 @@ count_free_objects(struct meminfo *si, ulong freelist)
return c;
}
-/*
- * With CONFIG_SLAB_FREELIST_HARDENED, freelist_ptr's are crypted with xor's,
- * and for recent release with an additionnal bswap. Some releases prio to 5.7.0
- * may be using the additionnal bswap. The only easy and reliable way to tell is
- * to inspect assembly code (eg. "__slab_free") for a bswap instruction.
- */
-static int
-freelist_ptr_bswap_x86(void)
-{
- char buf1[BUFSIZE];
- char buf2[BUFSIZE];
- char *arglist[MAXARGS];
- int found;
-
- sprintf(buf1, "disassemble __slab_free");
- open_tmpfile();
- if (!gdb_pass_through(buf1, pc->tmpfile, GNU_RETURN_ON_ERROR)) {
- close_tmpfile();
- return FALSE;
- }
- rewind(pc->tmpfile);
- found = FALSE;
- while (fgets(buf2, BUFSIZE, pc->tmpfile)) {
- if (parse_line(buf2, arglist) < 3)
- continue;
- if (STREQ(arglist[2], "bswap")) {
- found = TRUE;
- break;
- }
- }
- close_tmpfile();
- return found;
-}
-
-static void
-freelist_ptr_init(void)
-{
- if (THIS_KERNEL_VERSION >= LINUX(5,7,0) ||
- ((machine_type("X86_64") || machine_type("X86")) &&
freelist_ptr_bswap_x86()))
- vt->flags |= FREELIST_PTR_BSWAP;
-}
-
static ulong
freelist_ptr(struct meminfo *si, ulong ptr, ulong ptr_addr)
{
if (VALID_MEMBER(kmem_cache_random)) {
/* CONFIG_SLAB_FREELIST_HARDENED */
- if (vt->flags & FREELIST_PTR_BSWAP)
+ if (THIS_KERNEL_VERSION >= LINUX(5,7,0))
ptr_addr = (sizeof(long) == 8) ? bswap_64(ptr_addr)
: bswap_32(ptr_addr);
return (ptr ^ si->random ^ ptr_addr);
--
2.37.1
8:54 p.m.
New subject: [PATCH 2/2] Fix "kmem -s|-S" not working properly when CONFIG_SLAB_FREELIST_HARDENED is enabled
Currently, crash-utility still depends on detecting the kernel version,
or the asm instruction 'bswap' on X86 64/X86 architectures to decide how
to deal with the freelist ptr obfuscation, when kernel option
CONFIG_SLAB_FREELIST_HARDENED is enabled.
As you known, the bit diffusion for freelist ptr obfuscation has
experienced the changes several times on the kernel side, For most
distributions, usually they might backport these kernel patches from
upstream, especially for the old kernel, the 'kmem -s|-S' will fail with
an error "invalid freepointer", which can be observed on ppc64le and
S390x architectures, etc. That is really not friendly.
Given that, let's fix the above issues this time, and it won't rely
on the linux version number or asm instruction 'bswap' to decide how to
dereference the freelist ptr.
Reported-by: Lucas Oakley <soakley(a)redhat.com>
Signed-off-by: Lianbo Jiang <lijiang(a)redhat.com>
---
memory.c | 9 ++++++---
1 file changed, 6 insertions(+), 3 deletions(-)
diff --git a/memory.c b/memory.c
index 626c6039c6d9..562914ee9230 100644
--- a/memory.c
+++ b/memory.c
@@ -19654,9 +19654,12 @@ freelist_ptr(struct meminfo *si, ulong ptr, ulong ptr_addr)
if (VALID_MEMBER(kmem_cache_random)) {
/* CONFIG_SLAB_FREELIST_HARDENED */
- if (THIS_KERNEL_VERSION >= LINUX(5,7,0))
- ptr_addr = (sizeof(long) == 8) ? bswap_64(ptr_addr)
- : bswap_32(ptr_addr);
+ ulong addr = (sizeof(long) == 8) ? bswap_64(ptr_addr) : bswap_32(ptr_addr);
+ addr = ptr ^ si->random ^ addr;
+
+ if (!addr || accessible(addr))
+ return addr;
+
return (ptr ^ si->random ^ ptr_addr);
} else
return ptr;
--
2.37.1
7:09 a.m.
New subject: [PATCH 2/2] Fix "kmem -s|-S" not working properly when CONFIG_SLAB_FREELIST_HARDENED is enabled
On Mon, Aug 14, 2023 at 09:54:24AM +0800, Lianbo Jiang wrote:
Currently, crash-utility still depends on detecting the kernel
version,
or the asm instruction 'bswap' on X86 64/X86 architectures to decide how
to deal with the freelist ptr obfuscation, when kernel option
CONFIG_SLAB_FREELIST_HARDENED is enabled.
As you known, the bit diffusion for freelist ptr obfuscation has
experienced the changes several times on the kernel side, For most
distributions, usually they might backport these kernel patches from
upstream, especially for the old kernel, the 'kmem -s|-S' will fail with
an error "invalid freepointer", which can be observed on ppc64le and
S390x architectures, etc. That is really not friendly.
Given that, let's fix the above issues this time, and it won't rely
on the linux version number or asm instruction 'bswap' to decide how to
dereference the freelist ptr.
Reported-by: Lucas Oakley <soakley(a)redhat.com>
Signed-off-by: Lianbo Jiang <lijiang(a)redhat.com>
---
memory.c | 9 ++++++---
1 file changed, 6 insertions(+), 3 deletions(-)
diff --git a/memory.c b/memory.c
index 626c6039c6d9..562914ee9230 100644
--- a/memory.c
+++ b/memory.c
@@ -19654,9 +19654,12 @@ freelist_ptr(struct meminfo *si, ulong ptr, ulong ptr_addr)
if (VALID_MEMBER(kmem_cache_random)) {
/* CONFIG_SLAB_FREELIST_HARDENED */
- if (THIS_KERNEL_VERSION >= LINUX(5,7,0))
- ptr_addr = (sizeof(long) == 8) ? bswap_64(ptr_addr)
- : bswap_32(ptr_addr);
+ ulong addr = (sizeof(long) == 8) ? bswap_64(ptr_addr) : bswap_32(ptr_addr);
+ addr = ptr ^ si->random ^ addr;
+
+ if (!addr || accessible(addr))
+ return addr;
+
return (ptr ^ si->random ^ ptr_addr);
} else
return ptr;
--
2.37.1
Lucas and I finished testing this set across x86_64, AARCH64, PPC64LE and
S390X with no hiccups observed.
Thanks for following it up!
Acked-by: Rafael Aquini <aquini(a)redhat.com>
7:29 p.m.
New subject: [PATCH 2/2] Fix "kmem -s|-S" not working properly when CONFIG_SLAB_FREELIST_HARDENED is enabled
On 2023/08/14 10:54, Lianbo Jiang wrote:
Currently, crash-utility still depends on detecting the kernel
version,
or the asm instruction 'bswap' on X86 64/X86 architectures to decide how
to deal with the freelist ptr obfuscation, when kernel option
CONFIG_SLAB_FREELIST_HARDENED is enabled.
As you known, the bit diffusion for freelist ptr obfuscation has
experienced the changes several times on the kernel side, For most
distributions, usually they might backport these kernel patches from
upstream, especially for the old kernel, the 'kmem -s|-S' will fail with
an error "invalid freepointer", which can be observed on ppc64le and
S390x architectures, etc. That is really not friendly.
Given that, let's fix the above issues this time, and it won't rely
on the linux version number or asm instruction 'bswap' to decide how to
dereference the freelist ptr.
Reported-by: Lucas Oakley <soakley(a)redhat.com>
Signed-off-by: Lianbo Jiang <lijiang(a)redhat.com>
Thank you for the fix.
Maybe we don't have to revert that patch and can use both of the bswap
way and this way, but seems no big benefit with it, so agree to revert it.
Applied.
Thanks!
Kazu
> ---
> memory.c | 9 ++++++---
> 1 file changed, 6 insertions(+), 3 deletions(-)
>
> diff --git a/memory.c b/memory.c
> index 626c6039c6d9..562914ee9230 100644
> --- a/memory.c
> +++ b/memory.c
> @@ -19654,9 +19654,12 @@ freelist_ptr(struct meminfo *si, ulong ptr, ulong
ptr_addr)
> if (VALID_MEMBER(kmem_cache_random)) {
> /* CONFIG_SLAB_FREELIST_HARDENED */
>
> - if (THIS_KERNEL_VERSION >= LINUX(5,7,0))
> - ptr_addr = (sizeof(long) == 8) ? bswap_64(ptr_addr)
> - : bswap_32(ptr_addr);
> + ulong addr = (sizeof(long) == 8) ? bswap_64(ptr_addr) : bswap_32(ptr_addr);
> + addr = ptr ^ si->random ^ addr;
> +
> + if (!addr || accessible(addr))
> + return addr;
> +
> return (ptr ^ si->random ^ ptr_addr);
> } else
> return ptr;
10:01 p.m.
New subject: [PATCH 2/2] Fix "kmem -s|-S" not working properly when CONFIG_SLAB_FREELIST_HARDENED is enabled
On Thu, Aug 17, 2023 at 8:29 AM HAGIO KAZUHITO(萩尾 一仁) <k-hagio-ab(a)nec.com>
wrote:
On 2023/08/14 10:54, Lianbo Jiang wrote:
> Currently, crash-utility still depends on detecting the kernel version,
> or the asm instruction 'bswap' on X86 64/X86 architectures to decide how
> to deal with the freelist ptr obfuscation, when kernel option
> CONFIG_SLAB_FREELIST_HARDENED is enabled.
>
> As you known, the bit diffusion for freelist ptr obfuscation has
> experienced the changes several times on the kernel side, For most
> distributions, usually they might backport these kernel patches from
> upstream, especially for the old kernel, the 'kmem -s|-S' will fail with
> an error "invalid freepointer", which can be observed on ppc64le and
> S390x architectures, etc. That is really not friendly.
>
> Given that, let's fix the above issues this time, and it won't rely
> on the linux version number or asm instruction 'bswap' to decide how to
> dereference the freelist ptr.
>
> Reported-by: Lucas Oakley <soakley(a)redhat.com>
> Signed-off-by: Lianbo Jiang <lijiang(a)redhat.com>
Thank you for the fix.
Maybe we don't have to revert that patch and can use both of the bswap
way and this way, but seems no big benefit with it, so agree to revert it.
You are right, Kazu. That is also why I would like to revert the patch
first.
Also thank you for helping with the test, Rafael and Lucas.
Thanks.
Lianbo
319
days inactive
322
days old
devel@lists.crash-utility.osci.io
4 comments
4 participants
participants (4)
-
HAGIO KAZUHITO(萩尾 一仁) -
Lianbo Jiang -
lijiang
-
Rafael Aquini