Page MenuHomeFreeBSD

kmem: Add KASAN state transitions
ClosedPublic

Authored by markj on Mar 27 2021, 11:29 PM.

Details

Summary

Memory allocated with kmem_* is unmapped upon free, so KASAN doesn't
provide a ton of benefit, but since allocations are always a multiple of
the page size we can create a redzone.

Diff Detail

Repository
R10 FreeBSD src repository
Lint
Automatic diff as part of commit; lint not applicable.
Unit
Automatic diff as part of commit; unit tests not applicable.

Event Timeline

andrew added inline comments.
sys/vm/vm_kern.c
422–423

Does this mean we don't get buffer overflow checks when size is a multiple of PAGE_SIZE?

sys/vm/vm_kern.c
422–423

That's correct. I thought about padding it by one page but was a bit wary about doing so for contig allocs, since that could conceivably result in an impossible allocation request. For instance, suppose that high - low == size, we wouldn't be able to add padding. And we have to either pad all allocations or none.

One thing we could do is add a guard page instead, so that overflows result in a page fault. That's not KASAN-specific, of course, but it'd make sense to enable that when KASAN is enabled. Any thoughts?

This revision was not accepted when it landed; it landed in state Needs Review.Tue, Apr 13, 9:42 PM
This revision was automatically updated to reflect the committed changes.