2014-07-10 19:55 GMT+04:00 Dave Hansen [off-list ref]:

On 07/10/2014 05:12 AM, Andrey Ryabinin wrote:

quoted

On 07/10/14 00:26, Dave Hansen wrote:

quoted

On 07/09/2014 04:29 AM, Andrey Ryabinin wrote:

quoted

Address sanitizer dedicates 1/8 of the low memory to the shadow memory and uses direct
mapping with a scale and offset to translate a memory address to its corresponding
shadow address.

Here is function to translate address to corresponding shadow address:

     unsigned long kasan_mem_to_shadow(unsigned long addr)
     {
                return ((addr - PAGE_OFFSET) >> KASAN_SHADOW_SCALE_SHIFT)
                             + kasan_shadow_start;
     }

How does this interact with vmalloc() addresses or those from a kmap()?

It's used only for lowmem:

static inline bool addr_is_in_mem(unsigned long addr)
{
      return likely(addr >= PAGE_OFFSET && addr < (unsigned long)high_memory);
}

That's fine, and definitely covers the common cases.  Could you make
sure to call this out explicitly?  Also, there's nothing to _keep_ this
approach working for things out of the direct map, right?  It would just
be a matter of updating the shadow memory to have entries for the other
virtual address ranges.

Why do you want shadow for things out of the direct map?
If you want to catch use-after-free in vmalloc than DEBUG_PAGEALLOC
will be enough.
If you want catch out-of-bounds in vmalloc you don't need anything,
because vmalloc
allocates guarding hole in the end.
Or do you want something else?

addr_is_in_mem() is a pretty bad name for what it's doing. :)

I'd probably call it something like kasan_tracks_vaddr().

Agree

--
To unsubscribe, send a message with 'unsubscribe linux-mm' in
the body to majordomo at kvack.org.  For more info on Linux MM,
see: http://www.linux-mm.org/ .
Don't email: <a href=mailto:"dont@kvack.org"> email at kvack.org </a>

-- 
Best regards,
Andrey Ryabinin