一 概念
Kfence (Kernel Electric Fence) 是 Linux内核引入的一种低开销的内存错误检测机制，因为是低开销的所以它可以在运行的生产环境中开启，同样由于是低开销所以它的功能相比较 Kasan 会偏弱。Kfence 的基本原理非常简单，它创建了自己的专有检测内存池 kfence_pool。在 data page 的两边加上了 fence page 电子栅栏，利用 MMU 的特性把 fence page 设置成不可访问。如果对 data page的访问越过了 page 边界，就会立刻触发异常。
二 原理
检测kernel内存问题的一种方式，相比较于KASAN，它对系统的开销几乎为0，精度逊于KASAN，采用的是抽样时间检测的方法。主要是自己申请一个kfence_pool的内存池，该内存池的大小，可以进行配置，具体占用的计算公式：(CONFIG_KFENCE_NUM_OBJECTS + 1) * 2 * PAGE_SIZE
三 特点
如下，当前我们手机5.10配置的是500ms，抽样时间可以通过config进行设置
四 使能
内核的config选项
CONFIG_HAVE_ARCH_KFENCE=y
CONFIG_KFENCE=y
CONFIG_KFENCE_STATIC_KEYS=y
CONFIG_KFENCE_SAMPLE_INTERVAL=500 =》采用间隔500ms
CONFIG_KFENCE_NUM_OBJECTS=63 =》申请的kfence pool大小
CONFIG_KFENCE_STRESS_TEST_FAULTS=0五 实现
5.1 初始化
文件：kernel-5.10/init/main.c
asmlinkage __visible void __init __no_sanitize_address start_kernel(void)
{
.........
mm_init(); =》这里会初始化内存相关，kfence的pool alloc也是在这里面
.........
kfence_init(); =》kfence初始化相关
.........
}5.1.1 pool alloc初始化
mm_init函数
static void __init mm_init(void)
{
/*
* page_ext requires contiguous pages,
* bigger than MAX_ORDER unless SPARSEMEM.
*/
page_ext_init_flatmem();
init_mem_debugging_and_hardening();
kfence_alloc_pool(); =》here
..........
}文件：kernel-5.10/mm/kfence/core.c
kfence_alloc_pool函数
void __init kfence_alloc_pool(void)
{
if (!kfence_sample_interval) =》这个是通过config配置的，CONFIG_KFENCE_SAMPLE_INTERVAL，现在默认500，如果设置0，则关闭该功能
return;
__kfence_pool = memblock_alloc(KFENCE_POOL_SIZE, PAGE_SIZE);
=》memblock_alloc申请KFENCE_POOL_SIZE的size，计算公式如下，CONFIG_KFENCE_NUM_OBJECTS现在默认配置成63，申请512k大小数据
#define KFENCE_POOL_SIZE ((CONFIG_KFENCE_NUM_OBJECTS + 1) * 2 * PAGE_SIZE)
if (!__kfence_pool)
pr_err("failed to allocate pool\n");
}5.1.2 kfence metadata初始化
kfence_init函数
void __init kfence_init(void)
{
/* Setting kfence_sample_interval to 0 on boot disables KFENCE. */
if (!kfence_sample_interval) =》还是会判断CONFIG_KFENCE_SAMPLE_INTERVAL是否配置成0
return;
if (!kfence_init_pool()) { =》开始初始化kfence的内存池
pr_err("%s failed\n", __func__);
return;
}
WRITE_ONCE(kfence_enabled, true);
queue_delayed_work(system_unbound_wq, &kfence_timer, 0);
pr_info("initialized - using %lu bytes for %d objects at 0x%p-0x%p\n", KFENCE_POOL_SIZE,
CONFIG_KFENCE_NUM_OBJECTS, (void *)__kfence_pool,
(void *)(__kfence_pool + KFENCE_POOL_SIZE));
}kfence_init_pool函数
static bool __init kfence_init_pool(void)
{
unsigned long addr = (unsigned long)__kfence_pool;
struct page *pages;
int i;
if (!__kfence_pool) =》在前面alloc后，此处应该就已经申请到内存了
return false;
if (!arch_kfence_init_pool()) =》架构相关，这里不会拦截的，对于x86可能会有相关check
goto err;
pages = virt_to_page(addr); =》找到kfence内存池首地址对应的page结构体
/*
* Set up object pages: they must have PG_slab set, to avoid freeing
* these as real pages.
*
* We also want to avoid inserting kfence_free() in the kfree()
* fast-path in SLUB, and therefore need to ensure kfree() correctly
* enters __slab_free() slow-path.
*/
for (i = 0; i < KFENCE_POOL_SIZE / PAGE_SIZE; i++) {
if (!i || (i % 2)) =》跳过第0页和所有的奇数页
continue;
/* Verify we do not have a compound head page. */
if (WARN_ON(compound_head(&pages[i]) != &pages[i]))
goto err;
__SetPageSlab(&pages[i]); =》设置所有偶数页对应的slab标志，这样在free的时候能保证被释放
}
/*
* Protect the first 2 pages. The first page is mostly unnecessary, and
* merely serves as an extended guard page. However, adding one
* additional page in the beginning gives us an even number of pages,
* which simplifies the mapping of address to metadata index.
*/
for (i = 0; i < 2; i++) {
if (unlikely(!kfence_protect(addr))) =》对前两页进行保护，即page0/page1设置fence protect
goto err;
addr += PAGE_SIZE;
}
=> kfence_protect -> kfence_protect_page -> set_memory_valid(addr, 1, !protect) ->
->__change_memory_common(addr, PAGE_SIZE * numpages, __pgprot(PTE_VALID), __pgprot(0)) 主要是清除对应的pte项的present位，这样
当CPU访问前两页的时候就会触发缺页异常，就会进入fence的处理流程
for (i = 0; i < CONFIG_KFENCE_NUM_OBJECTS; i++) { =》开始遍历objects
struct kfence_metadata *meta = &kfence_metadata[i]; =>kfence_metadata是一个全局的struct kfence_metadata数组
/* Initialize metadata. */
INIT_LIST_HEAD(&meta->list); =》初始化kfence_metadata节点
raw_spin_lock_init(&meta->lock);
meta->state = KFENCE_OBJECT_UNUSED; =》设置unused标志
meta->addr = addr; /* Initialize for validation in metadata_to_pageaddr(). */ =》指向对应的page地址
list_add_tail(&meta->list, &kfence_freelist); =》将对应的kfence_metadata节点添加到kfence_freelist链表后
static struct list_head kfence_freelist = LIST_HEAD_INIT(kfence_freelist);
/* Protect the right redzone. */
if (unlikely(!kfence_protect(addr + PAGE_SIZE))) =》保护右边的区域
goto err;
addr += 2 * PAGE_SIZE; =》地址往后移动2个page，指向下一个可用page2、page4、page6....循环往复就可以完成整个pool的保护
}
/*
* The pool is live and will never be deallocated from this point on.
* Remove the pool object from the kmemleak object tree, as it would
* otherwise overlap with allocations returned by kfence_alloc(), which
* are registered with kmemleak through the slab post-alloc hook.
*/
kmemleak_free(__kfence_pool); =》删除在kmemleak里面的记录，整个kfence pool是一直活着的
return true;
err:
/*
* Only release unprotected pages, and do not try to go back and change
* page attributes due to risk of failing to do so as well. If changing
* page attributes for some pages fails, it is very likely that it also
* fails for the first page, and therefore expect addr==__kfence_pool in
* most failure cases.
*/
memblock_free_late(__pa(addr), KFENCE_POOL_SIZE - (addr - (unsigned long)__kfence_pool));
__kfence_pool = NULL;
return false;
}
文件：/kernel-5.10/mm/kfence/kfence.h
struct kfence_metadata {
struct list_head list; /* Freelist node; access under kfence_freelist_lock. */
struct rcu_head rcu_head; /* For delayed freeing. */ =》用于延迟释放
/*
* Lock protecting below data; to ensure consistency of the below data,
* since the following may execute concurrently: __kfence_alloc(),
* __kfence_free(), kfence_handle_page_fault(). However, note that we
* cannot grab the same metadata off the freelist twice, and multiple
* __kfence_alloc() cannot run concurrently on the same metadata.
*/
raw_spinlock_t lock;
/* The current state of the object; see above. */
enum kfence_object_state state;
/*
* Allocated object address; cannot be calculated from size, because of
* alignment requirements.
*
* Invariant: ALIGN_DOWN(addr, PAGE_SIZE) is constant.
*/
unsigned long addr;
/*
* The size of the original allocation.
*/
size_t size;
/*
* The kmem_cache cache of the last allocation; NULL if never allocated
* or the cache has already been destroyed.
*/
struct kmem_cache *cache;
/*
* In case of an invalid access, the page that was unprotected; we
* optimistically only store one address.
*/
unsigned long unprotected_page; =》记录发生异常的地址
/* Allocation and free stack information. */
struct kfence_track alloc_track; =》分配栈
struct kfence_track free_track; =》释放栈
};
/* KFENCE object states. */ =》KFENCE的三种状态
enum kfence_object_state {
KFENCE_OBJECT_UNUSED, /* Object is unused. */
KFENCE_OBJECT_ALLOCATED, /* Object is currently allocated. */
KFENCE_OBJECT_FREED, /* Object was allocated, and then freed. */
};5.1.3 kfence work
kfence_timer在init过程中已经启动，需要看看这个work具体要做的事
atomic_t kfence_allocation_gate = ATOMIC_INIT(1); =》初始化为1
static DECLARE_DELAYED_WORK(kfence_timer, toggle_allocation_gate); =》初始化一个延迟队列，toggle_allocation_gate是时间到达后的具体实现
static void toggle_allocation_gate(struct work_struct *work)
{
if (!READ_ONCE(kfence_enabled))
return;
atomic_set(&kfence_allocation_gate, 0); =》设置kfence_allocation_gate为0，周期性的将此值设置为0,0开启，不为0则关闭
#ifdef CONFIG_KFENCE_STATIC_KEYS =》定义过，用静态key功能，主要是来优化性能，每次读取kfence_allocation_gate性能开销比较大
/* Enable static key, and await allocation to happen. */
static_branch_enable(&kfence_allocation_key);
if (sysctl_hung_task_timeout_secs) { =》等于CONFIG_DEFAULT_HUNG_TASK_TIMEOUT=120
/*
* During low activity with no allocations we might wait a
* while; let's avoid the hung task warning.
*/
wait_event_idle_timeout(allocation_wait, atomic_read(&kfence_allocation_gate), sysctl_hung_task_timeout_secs * HZ / 2);
=》等待allocation_wait任务被唤醒，当kfence_allocation_gate为1或者超时时间到来才会继续向下执行，如果长时间没有内存分配这个进程就会因为D状态被内核警告
所以加了超时
} else {
wait_event_idle(allocation_wait, atomic_read(&kfence_allocation_gate));
=》如果hangtask的检测时间为0，表示时间无限长，可以放心等待下去，直到有人从kfence里面分配了内存，会将kfence_allocation_gate设置为1
}
/* Disable static key and reset timer. */
static_branch_disable(&kfence_allocation_key); =》disable静态key
#endif
queue_delayed_work(system_unbound_wq, &kfence_timer, msecs_to_jiffies(kfence_sample_interval)); =》如果上面条件满足后500ms又会调度这样的一个延迟任务
}
allocation_wait被wake_up的地方：
static DECLARE_WAIT_QUEUE_HEAD(allocation_wait);
static void wake_up_kfence_timer(struct irq_work *work)
{
wake_up(&allocation_wait);
}
static DEFINE_IRQ_WORK(wake_up_kfence_timer_work, wake_up_kfence_timer);
在kfence alloc的时候会通过irq_work_queue(&wake_up_kfence_timer_work);5.2 kfence alloc
kfence把自己hook到了slub/slab流程当中，在slub的分配和申请中符合条件的从kfence内存池中进行分配
5.2.1 kmalloc分配内存流程
文件：/kernel-5.10/include/linux/slab.h
kmalloc函数
static __always_inline void *kmalloc(size_t size, gfp_t flags)
{
if (__builtin_constant_p(size)) {
#ifndef CONFIG_SLOB
unsigned int index;
#endif
if (size > KMALLOC_MAX_CACHE_SIZE)
return kmalloc_large(size, flags);
#ifndef CONFIG_SLOB
index = kmalloc_index(size);
if (!index)
return ZERO_SIZE_PTR;
return kmem_cache_alloc_trace(
kmalloc_caches[kmalloc_type(flags)][index],
flags, size);
#endif
}
return __kmalloc(size, flags); =》here
}
/kernel-5.10/mm/slub.c
__kmalloc函数：
void *__kmalloc(size_t size, gfp_t flags)
{
struct kmem_cache *s;
void *ret;
if (unlikely(size > KMALLOC_MAX_CACHE_SIZE))
return kmalloc_large(size, flags);
s = kmalloc_slab(size, flags);
if (unlikely(ZERO_OR_NULL_PTR(s)))
return s;
ret = slab_alloc(s, flags, _RET_IP_, size); =》here
trace_kmalloc(_RET_IP_, ret, size, s->size, flags);
ret = kasan_kmalloc(s, ret, size, flags);
return ret;
}
slab_alloc函数：
static __always_inline void *slab_alloc(struct kmem_cache *s,
gfp_t gfpflags, unsigned long addr, size_t orig_size)
{
return slab_alloc_node(s, gfpflags, NUMA_NO_NODE, addr, orig_size);
}
static __always_inline void *slab_alloc_node(struct kmem_cache *s,
gfp_t gfpflags, int node, unsigned long addr, size_t orig_size)
{
void *object;
struct kmem_cache_cpu *c;
struct page *page;
unsigned long tid;
struct obj_cgroup *objcg = NULL;
bool init = false;
s = slab_pre_alloc_hook(s, &objcg, 1, gfpflags);
if (!s)
return NULL;
object = kfence_alloc(s, orig_size, gfpflags); =》here
if (unlikely(object))
goto out;
/kernel-5.10/include/linux/kfence.h
kmalloc-》__kmalloc-》slab_alloc-》slab_alloc_node-》slab_alloc_node -》kfence_alloc
static __always_inline void *kfence_alloc(struct kmem_cache *s, size_t size, gfp_t flags)
{
#ifdef CONFIG_KFENCE_STATIC_KEYS
if (static_branch_unlikely(&kfence_allocation_key)) =》直接读取kfence_allocation_key值，如果是读取到1，可以从kfence的pool里面去读取
#else
if (unlikely(!atomic_read(&kfence_allocation_gate)))
#endif
return __kfence_alloc(s, size, flags);
return NULL; =》否则返回空，继续前面的slab正常流程
}5.2.2 kfence_alloc流程
文件：/kernel-5.10/mm/kfence/core.c
__kfence_alloc函数
void *__kfence_alloc(struct kmem_cache *s, size_t size, gfp_t flags)
{
/*
* Perform size check before switching kfence_allocation_gate, so that
* we don't disable KFENCE without making an allocation.
*/
if (size > PAGE_SIZE) =》如果申请的超过page size 直接返回
return NULL;
/*
* Skip allocations from non-default zones, including DMA. We cannot
* guarantee that pages in the KFENCE pool will have the requested
* properties (e.g. reside in DMAable memory).
*/
if ((flags & GFP_ZONEMASK) ||
(s->flags & (SLAB_CACHE_DMA | SLAB_CACHE_DMA32))) =》如果是从DMA特殊zone申请的也直接返回
return NULL;
/*
* allocation_gate only needs to become non-zero, so it doesn't make
* sense to continue writing to it and pay the associated contention
* cost, in case we have a large number of concurrent allocations.
*/
if (atomic_read(&kfence_allocation_gate) || atomic_inc_return(&kfence_allocation_gate) > 1) =》如果kfence_allocation_gate非0，也直接返回
return NULL;
#ifdef CONFIG_KFENCE_STATIC_KEYS
/*
* waitqueue_active() is fully ordered after the update of
* kfence_allocation_gate per atomic_inc_return().
*/
if (waitqueue_active(&allocation_wait)) { =》检查是否有allocation_wait在阻塞，有的话，起一个work来唤醒被阻塞的进程，如下
/*
* Calling wake_up() here may deadlock when allocations happen
* from within timer code. Use an irq_work to defer it.
*/
irq_work_queue(&wake_up_kfence_timer_work);
}
#endif
if (!READ_ONCE(kfence_enabled)) =》判断kfence是否使能了，这个在初始化的时候，通过WRITE_ONCE(kfence_enabled, true)设置过
return NULL;
return kfence_guarded_alloc(s, size, flags);
}
static void wake_up_kfence_timer(struct irq_work *work)
{
wake_up(&allocation_wait); =》直接唤醒该进程
}
static DEFINE_IRQ_WORK(wake_up_kfence_timer_work, wake_up_kfence_timer);kfence_guarded_alloc函数
static void *kfence_guarded_alloc(struct kmem_cache *cache, size_t size, gfp_t gfp)
{
struct kfence_metadata *meta = NULL;
unsigned long flags;
struct page *page;
void *addr;
/* Try to obtain a free object. */
raw_spin_lock_irqsave(&kfence_freelist_lock, flags);
if (!list_empty(&kfence_freelist)) { =》检查内存池中是否有空闲的页
meta = list_entry(kfence_freelist.next, struct kfence_metadata, list); =》获取空闲页对应的kfence_metadata结构
list_del_init(&meta->list); =》将其从链表中移除并初始化
}
raw_spin_unlock_irqrestore(&kfence_freelist_lock, flags);
if (!meta)
return NULL;
if (unlikely(!raw_spin_trylock_irqsave(&meta->lock, flags))) {
/*
* This is extremely unlikely -- we are reporting on a
* use-after-free, which locked meta->lock, and the reporting
* code via printk calls kmalloc() which ends up in
* kfence_alloc() and tries to grab the same object that we're
* reporting on. While it has never been observed, lockdep does
* report that there is a possibility of deadlock. Fix it by
* using trylock and bailing out gracefully.
*/
raw_spin_lock_irqsave(&kfence_freelist_lock, flags);
/* Put the object back on the freelist. */
list_add_tail(&meta->list, &kfence_freelist);
raw_spin_unlock_irqrestore(&kfence_freelist_lock, flags);
return NULL;
}
meta->addr = metadata_to_pageaddr(meta); =》获取meta对应的空闲内存页的虚拟首地址
/* Unprotect if we're reusing this page. */
if (meta->state == KFENCE_OBJECT_FREED) =》如果对应的page是free的状态，那么就要把pte中的present标志位恢复，保证cpu访问这页内存不会发生缺页异常
kfence_unprotect(meta->addr); =》这里判断free状态是因为初始化的时候，设置的是un-use状态，所以如果等于free，代表此page是alloc后又free的，对于
刚初始化的page是没有加protect的，所以无需unprotect，如果是free的page会protect起来，所以再次使用的时候就需要unprotect
/*
* Note: for allocations made before RNG initialization, will always
* return zero. We still benefit from enabling KFENCE as early as
* possible, even when the RNG is not yet available, as this will allow
* KFENCE to detect bugs due to earlier allocations. The only downside
* is that the out-of-bounds accesses detected are deterministic for
* such allocations.
*/
if (prandom_u32_max(2)) { =》如果随机数发生器初始化之前分配，那么object的地址是从这页内存的起始位置开始，当随机发生器可以工作了，那么将object放到这页内存
/* Allocate on the "right" side, re-calculate address. */ =》的最右侧
meta->addr += PAGE_SIZE - size;
meta->addr = ALIGN_DOWN(meta->addr, cache->align);
}
addr = (void *)meta->addr; =》object的起始地址
/* Update remaining metadata. */
metadata_update_state(meta, KFENCE_OBJECT_ALLOCATED); =》更新meta的state，看看它做了些啥
/* Pairs with READ_ONCE() in kfence_shutdown_cache(). */
WRITE_ONCE(meta->cache, cache); =》将当前的kmem_cache记录到meta->cache中
meta->size = size; =》记录object的size
for_each_canary(meta, set_canary_byte); =》这里主要就是将对应的page空闲的地方全部填成与地址相关的pattern，用来检测越界问题，set_canary_byte是一个函数指针
/* Set required struct page fields. */
page = virt_to_page(meta->addr); =》获取这页内存对应的page结构
page->slab_cache = cache; =》page中记录对应的kmem_cache，释放的时候会用到
if (IS_ENABLED(CONFIG_SLUB))
page->objects = 1; =》kfence内存池中一个页只放了一个object
if (IS_ENABLED(CONFIG_SLAB))
page->s_mem = addr; =》如果是slab分配器，会记录第一个object的地址
raw_spin_unlock_irqrestore(&meta->lock, flags);
/* Memory initialization. */
/*
* We check slab_want_init_on_alloc() ourselves, rather than letting
* SL*B do the initialization, as otherwise we might overwrite KFENCE's
* redzone.
*/
if (unlikely(slab_want_init_on_alloc(gfp, cache))) =》判断如果alloc带了__GFP_ZERO标志，则执行memzero_explicit，对将要使用的那块区域清0
memzero_explicit(addr, size);
if (cache->ctor)
cache->ctor(addr);
if (CONFIG_KFENCE_STRESS_TEST_FAULTS && !prandom_u32_max(CONFIG_KFENCE_STRESS_TEST_FAULTS))
kfence_protect(meta->addr); /* Random "faults" by protecting the object. */
atomic_long_inc(&counters[KFENCE_COUNTER_ALLOCATED]); =》KFENCE_COUNTER_ALLOCATED表示有多少object被分配出去了，分配一个加1
atomic_long_inc(&counters[KFENCE_COUNTER_ALLOCS]); =》KFENCE_COUNTER_ALLOCS表示从内存池分配的次数，递增
return addr; =》最终返回相应的地址
}metadata_update_state函数
static noinline void metadata_update_state(struct kfence_metadata *meta,
enum kfence_object_state next)
{
struct kfence_track *track = =》判断当前是什么状态，对应的后面保存alloc或者free调用栈
next == KFENCE_OBJECT_FREED ? &meta->free_track : &meta->alloc_track;
lockdep_assert_held(&meta->lock);
/*
* Skip over 1 (this) functions; noinline ensures we do not accidentally
* skip over the caller by never inlining.
*/
track->num_stack_entries = stack_trace_save(track->stack_entries, KFENCE_STACK_DEPTH, 1); =》这里是对栈进行保存
track->pid = task_pid_nr(current); =》获取当前进程的pid
/*
* Pairs with READ_ONCE() in
* kfence_shutdown_cache(),
* kfence_handle_page_fault().
*/
WRITE_ONCE(meta->state, next); =》设置meta的状态为KFENCE_OBJECT_ALLOCATED，next就是对应的状态
}for_each_canary函数
static __always_inline void for_each_canary(const struct kfence_metadata *meta, bool (*fn)(u8 *))
{
const unsigned long pageaddr = ALIGN_DOWN(meta->addr, PAGE_SIZE);
unsigned long addr;
lockdep_assert_held(&meta->lock);
/*
* We'll iterate over each canary byte per-side until fn() returns
* false. However, we'll still iterate over the canary bytes to the
* right of the object even if there was an error in the canary bytes to
* the left of the object. Specifically, if check_canary_byte()
* generates an error, showing both sides might give more clues as to
* what the error is about when displaying which bytes were corrupted.
*/
/* Apply to left of object. */
for (addr = pageaddr; addr < meta->addr; addr++) { =》左边填充
if (!fn((u8 *)addr))
break;
}
/* Apply to right of object. */
for (addr = meta->addr + meta->size; addr < pageaddr + PAGE_SIZE; addr++) { =》右边填充
if (!fn((u8 *)addr))
break;
}
}
static inline bool set_canary_byte(u8 *addr)
{
*addr = KFENCE_CANARY_PATTERN(addr);
return true;
}
#define KFENCE_CANARY_PATTERN(addr) ((u8)0xaa ^ (u8)((unsigned long)(addr) & 0x7))5.3 kfence free流程
flow：free->slab_free->do_slab_free->kfence_free
static void __slab_free(struct kmem_cache *s, struct page *page,
void *head, void *tail, int cnt,
unsigned long addr)
{
void *prior;
int was_frozen;
struct page new;
unsigned long counters;
struct kmem_cache_node *n = NULL;
unsigned long flags;
stat(s, FREE_SLOWPATH);
if (kfence_free(head)) =》here
return;文件：/kernel-5.10/include/linux/kfence.h
kfence_free函数
static __always_inline __must_check bool kfence_free(void *addr)
{
if (!is_kfence_address(addr)) =》检查要释放的虚拟地址是否在kfence内存池的虚拟地址范围内
return false;
__kfence_free(addr); =》如果是的话，调用_kfence_free直接释放
return true;
}
static __always_inline bool is_kfence_address(const void *addr)
{
/*
* The __kfence_pool != NULL check is required to deal with the case
* where __kfence_pool == NULL && addr < KFENCE_POOL_SIZE. Keep it in
* the slow-path after the range-check!
*/
return unlikely((unsigned long)((char *)addr - __kfence_pool) < KFENCE_POOL_SIZE && __kfence_pool);
} =》主要看对应的addr减去__kfence_pool是否落在kfence pool池内，如果是的话，返回true文件：/kernel-5.10/mm/kfence/core.c
__kfence_free函数
void __kfence_free(void *addr)
{
struct kfence_metadata *meta = addr_to_metadata((unsigned long)addr);
=》根据addr获取对应的meta，就是根据地址获取对应的索引
/*
* If the objects of the cache are SLAB_TYPESAFE_BY_RCU, defer freeing
* the object, as the object page may be recycled for other-typed
* objects once it has been freed. meta->cache may be NULL if the cache
* was destroyed.
*/
=》如果对应的meta的kmem_cache有SLAB_TYPESAFE_BY_RCU，那么不能立即释放，需要异步处理，过了一个宽限期再释放
if (unlikely(meta->cache && (meta->cache->flags & SLAB_TYPESAFE_BY_RCU)))
call_rcu(&meta->rcu_head, rcu_guarded_free); =》rcu_guarded_free最终会调用kfence_guarded_free
else
kfence_guarded_free(addr, meta, false);
}
static void rcu_guarded_free(struct rcu_head *h)
{
struct kfence_metadata *meta = container_of(h, struct kfence_metadata, rcu_head);
kfence_guarded_free((void *)meta->addr, meta, false);
}
static inline struct kfence_metadata *addr_to_metadata(unsigned long addr)
{
long index;
/* The checks do not affect performance; only called from slow-paths. */
if (!is_kfence_address((void *)addr))
return NULL;
/*
* May be an invalid index if called with an address at the edge of
* __kfence_pool, in which case we would report an "invalid access"
* error.
*/
index = (addr - (unsigned long)__kfence_pool) / (PAGE_SIZE * 2) - 1;
if (index < 0 || index >= CONFIG_KFENCE_NUM_OBJECTS) =》索引的计算方法
return NULL;
return &kfence_metadata[index]; =》返回指向的那个meta对象
}kfence_guarded_free函数
static void kfence_guarded_free(void *addr, struct kfence_metadata *meta, bool zombie)
{
struct kcsan_scoped_access assert_page_exclusive;
unsigned long flags;
raw_spin_lock_irqsave(&meta->lock, flags);
if (meta->state != KFENCE_OBJECT_ALLOCATED || meta->addr != (unsigned long)addr) { =》首先判断对应的meta状态是不是已经alloc的
/* Invalid or double-free, bail out. */ =》如果不是alloc的就是无效的或者double free
atomic_long_inc(&counters[KFENCE_COUNTER_BUGS]); =》KFENCE_COUNTER_BUGS值加1
kfence_report_error((unsigned long)addr, false, NULL, meta,
KFENCE_ERROR_INVALID_FREE); =》直接上报异常，无效的free
raw_spin_unlock_irqrestore(&meta->lock, flags);
return;
}
/* Detect racy use-after-free, or incorrect reallocation of this page by KFENCE. */
kcsan_begin_scoped_access((void *)ALIGN_DOWN((unsigned long)addr, PAGE_SIZE), PAGE_SIZE,
KCSAN_ACCESS_SCOPED | KCSAN_ACCESS_WRITE | KCSAN_ACCESS_ASSERT,
&assert_page_exclusive);
if (CONFIG_KFENCE_STRESS_TEST_FAULTS) =》这个值是0
kfence_unprotect((unsigned long)addr); /* To check canary bytes. */
/* Restore page protection if there was an OOB access. */
if (meta->unprotected_page) { =》如果检测到了OOB内存错误，此条件就会满足，unprotected_page记录了发生异常的地址
memzero_explicit((void *)ALIGN_DOWN(meta->unprotected_page, PAGE_SIZE), PAGE_SIZE); =》将对应的地址所在的page清零
kfence_protect(meta->unprotected_page); =》将发生OOB的地址所在的内存页设置为保护，缺页异常会取消保护发生异常地址所在页
meta->unprotected_page = 0;
}
/* Check canary bytes for memory corruption. */
for_each_canary(meta, check_canary_byte); =》检查object所在空闲区域的pattern值是否发生了改变
/*
* Clear memory if init-on-free is set. While we protect the page, the
* data is still there, and after a use-after-free is detected, we
* unprotect the page, so the data is still accessible.
*/
if (!zombie && unlikely(slab_want_init_on_free(meta->cache)))
memzero_explicit(addr, meta->size);
/* Mark the object as freed. */
metadata_update_state(meta, KFENCE_OBJECT_FREED); =》标记当前的metadata是free状态，同alloc
=>1、记录了free的调用栈
=>2、记录了对应的pid
=>3、设置free状态
raw_spin_unlock_irqrestore(&meta->lock, flags);
/* Protect to detect use-after-frees. */
kfence_protect((unsigned long)addr); =》对free的page进行保护，避免user after free问题发生
kcsan_end_scoped_access(&assert_page_exclusive);
if (!zombie) {
/* Add it to the tail of the freelist for reuse. */
raw_spin_lock_irqsave(&kfence_freelist_lock, flags);
KFENCE_WARN_ON(!list_empty(&meta->list));
list_add_tail(&meta->list, &kfence_freelist); =》将meta重新放回freelist链表
raw_spin_unlock_irqrestore(&kfence_freelist_lock, flags);
atomic_long_dec(&counters[KFENCE_COUNTER_ALLOCATED]); =》free后被alloc出去的减一
atomic_long_inc(&counters[KFENCE_COUNTER_FREES]); =》free的值增一
} else {
/* See kfence_shutdown_cache(). */
atomic_long_inc(&counters[KFENCE_COUNTER_ZOMBIES]);
=》当kmem_cache被销毁时，所有未释放的object个数会记录到KFENCE_COUNTER_ZOMBIES，处于zomblie状态的
object也是free的，但是不能被重新分配了
}
}check_canary_byte函数
/* Check canary byte at @addr. */
static inline bool check_canary_byte(u8 *addr)
{
if (likely(*addr == KFENCE_CANARY_PATTERN(addr))) =》判断对应的地址patter内容是否匹配，如果匹配直接返回
return true;
atomic_long_inc(&counters[KFENCE_COUNTER_BUGS]); =》
kfence_report_error((unsigned long)addr, false, NULL, addr_to_metadata((unsigned long)addr),
KFENCE_ERROR_CORRUPTION); =》直接上报kfence erro corruption，如果pattern值被写入的话
return false;
}5.4 kmem_cache销毁
flow：kmem_cache_destory->shutdown_cache->kfence_shutdown_cache
kfence_shutdown_cache函数
void kfence_shutdown_cache(struct kmem_cache *s)
{
unsigned long flags;
struct kfence_metadata *meta;
int i;
for (i = 0; i < CONFIG_KFENCE_NUM_OBJECTS; i++) {
bool in_use;
meta = &kfence_metadata[i];
/*
* If we observe some inconsistent cache and state pair where we
* should have returned false here, cache destruction is racing
* with either kmem_cache_alloc() or kmem_cache_free(). Taking
* the lock will not help, as different critical section
* serialization will have the same outcome.
*/
if (READ_ONCE(meta->cache) != s ||
READ_ONCE(meta->state) != KFENCE_OBJECT_ALLOCATED)
continue; =>跳过不跟指定kmem_cache匹配的meta以及状态不是已分配的meta
raw_spin_lock_irqsave(&meta->lock, flags);
in_use = meta->cache == s && meta->state == KFENCE_OBJECT_ALLOCATED;
raw_spin_unlock_irqrestore(&meta->lock, flags);
if (in_use) {
/*
* This cache still has allocations, and we should not
* release them back into the freelist so they can still
* safely be used and retain the kernel's default
* behaviour of keeping the allocations alive (leak the
* cache); however, they effectively become "zombie
* allocations" as the KFENCE objects are the only ones
* still in use and the owning cache is being destroyed.
*
* We mark them freed, so that any subsequent use shows
* more useful error messages that will include stack
* traces of the user of the object, the original
* allocation, and caller to shutdown_cache().
*/
kfence_guarded_free((void *)meta->addr, meta, /*zombie=*/true);
=》将zombie设置为true，释放的meta就不会添加到freelist，也就不会分配出去，处于zombie的object也属于free，但是不能再被分配
}
}
for (i = 0; i < CONFIG_KFENCE_NUM_OBJECTS; i++) {
meta = &kfence_metadata[i];
/* See above. */
if (READ_ONCE(meta->cache) != s || READ_ONCE(meta->state) != KFENCE_OBJECT_FREED)
continue;
raw_spin_lock_irqsave(&meta->lock, flags);
if (meta->cache == s && meta->state == KFENCE_OBJECT_FREED)
meta->cache = NULL; =>将meta的cache字段清除
raw_spin_unlock_irqrestore(&meta->lock, flags);
}
}5.5 异常上报处理
缺页异常：do_page_fault->__do_page_fault->kfence_handle_page_fault
文件：/kernel-5.10/arch/arm64/mm/fault.c
static void __do_kernel_fault(unsigned long addr, unsigned int esr,
struct pt_regs *regs)
{
const char *msg;
/*
* Are we prepared to handle this kernel fault?
* We are almost certainly not prepared to handle instruction faults.
*/
if (!is_el1_instruction_abort(esr) && fixup_exception(regs))
return;
if (WARN_RATELIMIT(is_spurious_el1_translation_fault(addr, esr, regs),
"Ignoring spurious kernel translation fault at virtual address %016lx\n", addr))
return;
if (is_el1_mte_sync_tag_check_fault(esr)) {
do_tag_recovery(addr, esr, regs);
return;
}
if (is_el1_permission_fault(addr, esr, regs)) {
if (esr & ESR_ELx_WNR)
msg = "write to read-only memory";
else if (is_el1_instruction_abort(esr))
msg = "execute from non-executable memory";
else
msg = "read from unreadable memory";
} else if (addr < PAGE_SIZE) {
msg = "NULL pointer dereference";
} else {
if (kfence_handle_page_fault(addr, esr & ESR_ELx_WNR, regs))
return;
msg = "paging request";
}
die_kernel_fault(msg, addr, esr, regs);
}
/kernel-5.10/mm/kfence/core.c
bool kfence_handle_page_fault(unsigned long addr, bool is_write, struct pt_regs *regs)
{
const int page_index = (addr - (unsigned long)__kfence_pool) / PAGE_SIZE;
struct kfence_metadata *to_report = NULL;
enum kfence_error_type error_type;
unsigned long flags;
if (!is_kfence_address((void *)addr))
return false;
if (!READ_ONCE(kfence_enabled)) /* If disabled at runtime ... */
return kfence_unprotect(addr); /* ... unprotect and proceed. */
atomic_long_inc(&counters[KFENCE_COUNTER_BUGS]);
if (page_index % 2) {
/* This is a redzone, report a buffer overflow. */
struct kfence_metadata *meta;
int distance = 0;
meta = addr_to_metadata(addr - PAGE_SIZE);
if (meta && READ_ONCE(meta->state) == KFENCE_OBJECT_ALLOCATED) {
to_report = meta;
/* Data race ok; distance calculation approximate. */
distance = addr - data_race(meta->addr + meta->size);
}
meta = addr_to_metadata(addr + PAGE_SIZE);
if (meta && READ_ONCE(meta->state) == KFENCE_OBJECT_ALLOCATED) {
/* Data race ok; distance calculation approximate. */
if (!to_report || distance > data_race(meta->addr) - addr)
to_report = meta;
}
if (!to_report)
goto out;
raw_spin_lock_irqsave(&to_report->lock, flags);
to_report->unprotected_page = addr; =》保存了oob的地址
error_type = KFENCE_ERROR_OOB;
/*
* If the object was freed before we took the look we can still
* report this as an OOB -- the report will simply show the
* stacktrace of the free as well.
*/
} else {
to_report = addr_to_metadata(addr);
if (!to_report)
goto out;
raw_spin_lock_irqsave(&to_report->lock, flags);
error_type = KFENCE_ERROR_UAF;
/*
* We may race with __kfence_alloc(), and it is possible that a
* freed object may be reallocated. We simply report this as a
* use-after-free, with the stack trace showing the place where
* the object was re-allocated.
*/
}
out:
if (to_report) {
kfence_report_error(addr, is_write, regs, to_report, error_type);
raw_spin_unlock_irqrestore(&to_report->lock, flags);
} else {
/* This may be a UAF or OOB access, but we can't be sure. */
kfence_report_error(addr, is_write, regs, NULL, KFENCE_ERROR_INVALID);
}
return kfence_unprotect(addr); /* Unprotect and let access proceed. */
}文件：/kernel-5.10/mm/kfence/report.c
kfence_report_error函数
void kfence_report_error(unsigned long address, bool is_write, struct pt_regs *regs,
const struct kfence_metadata *meta, enum kfence_error_type type)
{
unsigned long stack_entries[KFENCE_STACK_DEPTH] = { 0 };
const ptrdiff_t object_index = meta ? meta - kfence_metadata : -1;
int num_stack_entries;
int skipnr = 0;
if (regs) {
num_stack_entries = stack_trace_save_regs(regs, stack_entries, KFENCE_STACK_DEPTH, 0);
} else {
num_stack_entries = stack_trace_save(stack_entries, KFENCE_STACK_DEPTH, 1);
skipnr = get_stack_skipnr(stack_entries, num_stack_entries, &type);
}
/* Require non-NULL meta, except if KFENCE_ERROR_INVALID. */
if (WARN_ON(type != KFENCE_ERROR_INVALID && !meta))
return;
if (meta)
lockdep_assert_held(&meta->lock);
/*
* Because we may generate reports in printk-unfriendly parts of the
* kernel, such as scheduler code, the use of printk() could deadlock.
* Until such time that all printing code here is safe in all parts of
* the kernel, accept the risk, and just get our message out (given the
* system might already behave unpredictably due to the memory error).
* As such, also disable lockdep to hide warnings, and avoid disabling
* lockdep for the rest of the kernel.
*/
lockdep_off();
pr_err("==================================================================\n");
/* Print report header. */
switch (type) {
case KFENCE_ERROR_OOB: {
const bool left_of_object = address < meta->addr;
pr_err("BUG: KFENCE: out-of-bounds %s in %pS\n\n", get_access_type(is_write),
(void *)stack_entries[skipnr]);
pr_err("Out-of-bounds %s at 0x%p (%luB %s of kfence-#%td):\n",
get_access_type(is_write), (void *)address,
left_of_object ? meta->addr - address : address - meta->addr,
left_of_object ? "left" : "right", object_index);
break;
}
case KFENCE_ERROR_UAF:
pr_err("BUG: KFENCE: use-after-free %s in %pS\n\n", get_access_type(is_write),
(void *)stack_entries[skipnr]);
pr_err("Use-after-free %s at 0x%p (in kfence-#%td):\n",
get_access_type(is_write), (void *)address, object_index);
break;
case KFENCE_ERROR_CORRUPTION:
pr_err("BUG: KFENCE: memory corruption in %pS\n\n", (void *)stack_entries[skipnr]);
pr_err("Corrupted memory at 0x%p ", (void *)address);
print_diff_canary(address, 16, meta);
pr_cont(" (in kfence-#%td):\n", object_index);
break;
case KFENCE_ERROR_INVALID:
pr_err("BUG: KFENCE: invalid %s in %pS\n\n", get_access_type(is_write),
(void *)stack_entries[skipnr]);
pr_err("Invalid %s at 0x%p:\n", get_access_type(is_write),
(void *)address);
break;
case KFENCE_ERROR_INVALID_FREE:
pr_err("BUG: KFENCE: invalid free in %pS\n\n", (void *)stack_entries[skipnr]);
pr_err("Invalid free of 0x%p (in kfence-#%td):\n", (void *)address,
object_index);
break;
}
/* Print stack trace and object info. */
stack_trace_print(stack_entries + skipnr, num_stack_entries - skipnr, 0);
if (meta) {
pr_err("\n");
kfence_print_object(NULL, meta);
}
/* Print report footer. */
pr_err("\n");
if (no_hash_pointers && regs)
show_regs(regs);
else
dump_stack_print_info(KERN_ERR);
trace_error_report_end(ERROR_DETECTOR_KFENCE, address);
pr_err("==================================================================\n");
lockdep_on();
if (panic_on_warn) =》触发panic的条件，这个通常不会打开
panic("panic_on_warn set ...\n");
/* We encountered a memory unsafety error, taint the kernel! */
add_taint(TAINT_BAD_PAGE, LOCKDEP_STILL_OK);
}
/kernel-5.10/kernel/panic.c
void add_taint(unsigned flag, enum lockdep_ok lockdep_ok)
{
if (lockdep_ok == LOCKDEP_NOW_UNRELIABLE && __debug_locks_off())
pr_warn("Disabling lock debugging due to kernel taint\n");
set_bit(flag, &tainted_mask);
if (tainted_mask & panic_on_taint) { =》触发panic的条件
panic_on_taint = 0;
panic("panic_on_taint set ...");
}
}
EXPORT_SYMBOL(add_taint)六 案例
6.1 越界访问
diff --git a/drivers/misc/mediatek/aee/aed/aed-debug.c b/drivers/misc/mediatek/aee/aed/aed-debug.c
index ec7567e08b35..f1212b786302 100644
--- a/drivers/misc/mediatek/aee/aed/aed-debug.c
+++ b/drivers/misc/mediatek/aee/aed/aed-debug.c
@@ -350,12 +350,26 @@ static ssize_t proc_generate_oops_read(struct file *file,
{
int len;
char buffer[BUFSIZE];
-
+ //add for test start
+ char *p;
+ size_t size1 = 110;
+ //add for mte test end
len = snprintf(buffer, BUFSIZE, "Oops Generated!\n");
if (copy_to_user(buf, buffer, len))
pr_notice("%s fail to output info.\n", __func__);
-
- BUG();
+ //add for test start
+ printk("[FJ]: heap overflow 11");
+ p = kmalloc(size1, GFP_KERNEL);
+ if (!p)
+ {
+ printk("[FJ]: alloc failed");
+ return -1;
+ }
+ p[size1] = 'X'; =》越界写
+ printk("[FJ]: heap overflow 22");
+ kfree(p);
+// BUG();
diff --git a/drivers/misc/mediatek/aee/aed/aed-main.c b/drivers/misc/mediatek/aee/aed/aed-main.c
index 0dddd7923ee3..2ca2558f3ad0 100644
--- a/drivers/misc/mediatek/aee/aed/aed-main.c
+++ b/drivers/misc/mediatek/aee/aed/aed-main.c
@@ -2469,9 +2469,9 @@ static int aed_proc_init(void)
AED_PROC_ENTRY(current-ee-coredump, current_ke_ee_coredump, 0400);
aee_rr_proc_init(aed_proc_dir);
-#if IS_ENABLED(CONFIG_MTK_AEE_UT)
+//#if IS_ENABLED(CONFIG_MTK_AEE_UT)
aed_proc_debug_init(aed_proc_dir);
-#endif
+//#endif
return 0;
}
@@ -2481,9 +2481,9 @@ static int aed_proc_done(void)
remove_proc_entry(CURRENT_EE_COREDUMP, aed_proc_dir);
aee_rr_proc_done(aed_proc_dir);
-#if IS_ENABLED(CONFIG_MTK_AEE_UT)
+//#if IS_ENABLED(CONFIG_MTK_AEE_UT)
aed_proc_debug_done(aed_proc_dir);
-#endif
+//#endif异常log：
[ 57.023539] [T706154] ==================================================================
[ 57.023563] [T706154] BUG: KFENCE: memory corruption in proc_generate_oops_read+0xf0/0x124 [aee_aed]
[ 57.023567] [T706154] Corrupted memory at 0x00000000bcc4b242 =》这是往具体的地址写超的数据
[ 57.023569] [T706154] [ =》这里面的数据是越界写入的，因为安全，所以这边显示的就不是具体数值
[ 57.023571] [T706154] !
[ 57.023573] [T706154] .
[ 57.023575] [T706154] .
[ 57.023577] [T706154] .
[ 57.023578] [T706154] .
[ 57.023580] [T706154] .
[ 57.023581] [T706154] .
[ 57.023583] [T706154] .
[ 57.023585] [T706154] .
[ 57.023586] [T706154] .
[ 57.023588] [T706154] .
[ 57.023590] [T706154] .
[ 57.023591] [T706154] .
[ 57.023593] [T706154] .
[ 57.023594] [T706154] .
[ 57.023596] [T706154] .
[ 57.023598] [T706154] ]
[ 57.023600] [T706154] (in kfence-#61):
[ 57.023608] [T706154] proc_generate_oops_read+0xf0/0x124 [aee_aed]
[ 57.023614] [T706154] proc_reg_read+0xec/0x20c
[ 57.023620] [T706154] vfs_read+0xf4/0x368
[ 57.023623] [T706154] ksys_read+0x7c/0xf0
[ 57.023625] [T706154] __arm64_sys_read+0x20/0x30
[ 57.023632] [T706154] el0_svc_common+0xd4/0x270
[ 57.023640] [T706154] el0_svc+0x28/0x88
[ 57.023642] [T706154] el0_sync_handler+0x8c/0xf0
[ 57.023646] [T706154] el0_sync+0x1b4/0x1c0
[ 57.023652] [T706154] kfence-#61 [0x000000000d82a343-0x00000000822d7acd, size=110, cache=kmalloc-128] allocated by task 6154:
[ 57.023661] [T706154] proc_generate_oops_read+0xb8/0x124 [aee_aed]
[ 57.023663] [T706154] proc_reg_read+0xec/0x20c
[ 57.023665] [T706154] vfs_read+0xf4/0x368
[ 57.023668] [T706154] ksys_read+0x7c/0xf0
[ 57.023670] [T706154] __arm64_sys_read+0x20/0x30
[ 57.023673] [T706154] el0_svc_common+0xd4/0x270
[ 57.023675] [T706154] el0_svc+0x28/0x88
[ 57.023677] [T706154] el0_sync_handler+0x8c/0xf0
[ 57.023680] [T706154] el0_sync+0x1b4/0x1c0
[ 57.023686] [T706154] CPU: 7 PID: 6154 Comm: cat Tainted: P S W O 5.10.117-android12-9-00008-g95279078149a-ab9073836 #1
[ 57.023689] [T706154] Hardware name: MT6983Z/CZA (DT)
[ 57.023700] [T706154] ==================================================================
[ 57.023703] [T706154] Kernel panic - not syncing: panic_on_taint set ...
[ 57.023705] [T706154] CPU: 7 PID: 6154 Comm: cat Tainted: P S B W O 5.10.117-android12-9-00008-g95279078149a-ab9073836 #1
[ 57.023707] [T706154] Hardware name: MT6983Z/CZA (DT)
[ 57.023709] [T706154] Call trace:
[ 57.023712] [T706154] dump_backtrace.cfi_jt+0x0/0x8
[ 57.023718] [T706154] dump_stack_lvl+0xc4/0x140
[ 57.023723] [T706154] panic+0x178/0x464
[ 57.023725] [T706154] kfence_report_error+0x53c/0x67c
[ 57.023728] [T706154] kfence_guarded_free+0x42c/0x984
[ 57.023730] [T706154] __slab_free+0xac/0x6b0
[ 57.023732] [T706154] kfree+0x300/0x78c
[ 57.023738] [T706154] proc_generate_oops_read+0xf0/0x124 [aee_aed]
[ 57.023740] [T706154] proc_reg_read+0xec/0x20c
[ 57.023742] [T706154] vfs_read+0xf4/0x368
[ 57.023745] [T706154] ksys_read+0x7c/0xf0
[ 57.023748] [T706154] __arm64_sys_read+0x20/0x30
[ 57.023750] [T706154] el0_svc_common+0xd4/0x270
[ 57.023752] [T706154] el0_svc+0x28/0x88
[ 57.023755] [T706154] el0_sync_handler+0x8c/0xf0
[ 57.023757] [T706154] el0_sync+0x1b4/0x1c0
[ 57.023763] [T706154] SMP: stopping secondary CPUs
[ 57.024178] [T706154] Kernel Offset: 0x12eee00000 from 0xffffffc010000000
[ 57.024180] [T706154] PHYS_OFFSET: 0x40000000
[ 57.024184] [T706154] CPU features: 0x000,79dd0157,6a40a238
[ 57.024186] [T706154] Memory Limit: none
[ 57.024265] [T706154] [<7045248654788522104>] invalid lr
[ 57.035552] [T706154] Kernel Offset: 0x12eee00000 from 0xffffffc010000000
[ 57.035557] [T706154] PHYS_OFFSET: 0x40000000
如果新增一个"no_hash_pointers"，最后打印出来的地址才是实际值，避免信息泄露
[ 109.692396] [T706194] [FJ]: heap overflow 11
[ 109.692406] [T706194] [FJ]: heap overflow 22
[ 109.692420] [T706194] ==================================================================
[ 109.692437] [T706194] BUG: KFENCE: memory corruption in proc_generate_oops_read+0xf0/0x124 [aee_aed]
[ 109.692440] [T706194] Corrupted memory at 0xffffff81ad7c406e
[ 109.692442] [T706194] [
[ 109.692443] [T706194] 0x58 =》可以看到这里是写入的值，对应的ASCII码里查询下，就是我们写的字符串X
[ 109.692445] [T706194] .
[ 109.692447] [T706194] .
[ 109.692448] [T706194] .
[ 109.692450] [T706194] .
[ 109.692451] [T706194] .
[ 109.692453] [T706194] .
[ 109.692454] [T706194] .
[ 109.692456] [T706194] .
[ 109.692457] [T706194] .
[ 109.692459] [T706194] .
[ 109.692460] [T706194] .
[ 109.692462] [T706194] .
[ 109.692463] [T706194] .
[ 109.692465] [T706194] .
[ 109.692466] [T706194] .
[ 109.692468] [T706194] ]
[ 109.692470] [T706194] (in kfence-#37):
[ 109.692478] [T706194] proc_generate_oops_read+0xf0/0x124 [aee_aed]
[ 109.692482] [T706194] proc_reg_read+0xec/0x20c
[ 109.692486] [T706194] vfs_read+0xf4/0x368
[ 109.692488] [T706194] ksys_read+0x7c/0xf0
[ 109.692491] [T706194] __arm64_sys_read+0x20/0x30
[ 109.692495] [T706194] el0_svc_common+0xd4/0x270
[ 109.692500] [T706194] el0_svc+0x28/0x88
[ 109.692503] [T706194] el0_sync_handler+0x8c/0xf0
[ 109.692506] [T706194] el0_sync+0x1b4/0x1c0
[ 109.692510] [T706194] kfence-#37 [0xffffff81ad7c4000-0xffffff81ad7c406d, size=110, cache=kmalloc-128] allocated by task 6194:
[ 109.692519] [T706194] proc_generate_oops_read+0xb8/0x124 [aee_aed]
[ 109.692521] [T706194] proc_reg_read+0xec/0x20c
[ 109.692523] [T706194] vfs_read+0xf4/0x368
[ 109.692525] [T706194] ksys_read+0x7c/0xf0
[ 109.692528] [T706194] __arm64_sys_read+0x20/0x30
[ 109.692530] [T706194] el0_svc_common+0xd4/0x270
[ 109.692532] [T706194] el0_svc+0x28/0x88
[ 109.692535] [T706194] el0_sync_handler+0x8c/0xf0
[ 109.692537] [T706194] el0_sync+0x1b4/0x1c0
[ 109.692542] [T706194] CPU: 7 PID: 6194 Comm: cat Tainted: P S W O 5.10.117-android12-9-00008-g95279078149a-ab9073836 #1
[ 109.692545] [T706194] Hardware name: MT6983Z/CZA (DT)
[ 109.692559] [T706194] ==================================================================
[ 109.692561] [T706194] Kernel panic - not syncing: panic_on_taint set ...
[ 109.692564] [T706194] CPU: 7 PID: 6194 Comm: cat Tainted: P S B W O 5.10.117-android12-9-00008-g95279078149a-ab9073836 #1
[ 109.692566] [T706194] Hardware name: MT6983Z/CZA (DT)
[ 109.692569] [T706194] Call trace:
[ 109.692572] [T706194] dump_backtrace.cfi_jt+0x0/0x8
[ 109.692578] [T706194] dump_stack_lvl+0xc4/0x140
[ 109.692582] [T706194] panic+0x178/0x464
[ 109.692585] [T706194] kfence_report_error+0x53c/0x67c
[ 109.692587] [T706194] kfence_guarded_free+0x42c/0x984
[ 109.692590] [T706194] __slab_free+0xac/0x6b0
[ 109.692593] [T706194] kfree+0x300/0x78c
[ 109.692599] [T706194] proc_generate_oops_read+0xf0/0x124 [aee_aed]
[ 109.692601] [T706194] proc_reg_read+0xec/0x20c
[ 109.692604] [T706194] vfs_read+0xf4/0x368
[ 109.692607] [T706194] ksys_read+0x7c/0xf0
[ 109.692609] [T706194] __arm64_sys_read+0x20/0x30
[ 109.692611] [T706194] el0_svc_common+0xd4/0x270
[ 109.692614] [T706194] el0_svc+0x28/0x88
[ 109.692617] [T706194] el0_sync_handler+0x8c/0xf0
[ 109.692619] [T706194] el0_sync+0x1b4/0x1c0
[ 109.692627] [T706194] SMP: stopping secondary CPUs
[ 109.693081] [T706194] Kernel Offset: 0x15d7800000 from 0xffffffc010000000
[ 109.693083] [T706194] PHYS_OFFSET: 0x40000000
[ 109.693087] [T706194] CPU features: 0x000,79dd0157,6a40a238
[ 109.693090] [T706194] Memory Limit: none
[ 109.693170] [T706194] [<4519573151500726392>] invalid lr
[ 109.704673] [T706194] Kernel Offset: 0x15d7800000 from 0xffffffc010000000
[ 109.704678] [T706194] PHYS_OFFSET: 0x400000006.2 use after free
376 //use after free
377 char *p;
378 size_t size1 = 110;
379 p = kmalloc(size1, GFP_KERNEL);
380 if (!p)
381 {
382 printk("[FJ]: alloc failed \n");
383 return -1;
384 }
385 printk("[FJ]: use after free 00");
386 kfree(p);
387 printk("[FJ]: use after free 01");
388 p[size1-1] = 'W';
389 printk("[FJ]: use after free 02");
异常log：
[ 202.811476] [T708013] ==================================================================
[ 202.811498] [T708013] BUG: KFENCE: use-after-free write in proc_generate_oops_read+0x6c/0x90 [aee_aed]
[ 202.811502] [T708013] Use-after-free write at 0xffffff81ad7ca06d (in kfence-#40):
[ 202.811514] [T708013] proc_generate_oops_read+0x6c/0x90 [aee_aed]
[ 202.811523] [T708013] proc_reg_read+0xec/0x20c
[ 202.811529] [T708013] vfs_read+0xf4/0x368
[ 202.811531] [T708013] ksys_read+0x7c/0xf0
[ 202.811535] [T708013] __arm64_sys_read+0x20/0x30
[ 202.811541] [T708013] el0_svc_common+0xd4/0x270
[ 202.811549] [T708013] el0_svc+0x28/0x88
[ 202.811552] [T708013] el0_sync_handler+0x8c/0xf0
[ 202.811556] [T708013] el0_sync+0x1b4/0x1c0
[ 202.811562] [T708013] kfence-#40 [0xffffff81ad7ca000-0xffffff81ad7ca06d, size=110, cache=kmalloc-128] allocated by task 8013:
[ 202.811578] [T708013] proc_generate_oops_read+0x28/0x90 [aee_aed]
[ 202.811580] [T708013] proc_reg_read+0xec/0x20c
[ 202.811583] [T708013] vfs_read+0xf4/0x368
[ 202.811585] [T708013] ksys_read+0x7c/0xf0
[ 202.811587] [T708013] __arm64_sys_read+0x20/0x30
[ 202.811590] [T708013] el0_svc_common+0xd4/0x270
[ 202.811593] [T708013] el0_svc+0x28/0x88
[ 202.811595] [T708013] el0_sync_handler+0x8c/0xf0
[ 202.811597] [T708013] el0_sync+0x1b4/0x1c0
[ 202.811600] [T708013]
freed by task 8013:
[ 202.811607] [T708013] proc_generate_oops_read+0x54/0x90 [aee_aed]
[ 202.811610] [T708013] proc_reg_read+0xec/0x20c
[ 202.811612] [T708013] vfs_read+0xf4/0x368
[ 202.811614] [T708013] ksys_read+0x7c/0xf0
[ 202.811617] [T708013] __arm64_sys_read+0x20/0x30
[ 202.811619] [T708013] el0_svc_common+0xd4/0x270
[ 202.811622] [T708013] el0_svc+0x28/0x88
[ 202.811624] [T708013] el0_sync_handler+0x8c/0xf0
[ 202.811627] [T708013] el0_sync+0x1b4/0x1c0
[ 202.811633] [T708013] CPU: 7 PID: 8013 Comm: cat Tainted: P S W O 5.10.117-android12-9-00008-g95279078149a-ab9073836 #1
[ 202.811636] [T708013] Hardware name: MT6983Z/CZA (DT)
[ 202.811640] [T708013] pstate: 62400005 (nZCv daif +PAN -UAO +TCO BTYPE=--)
[ 202.811646] [T708013] pc : proc_generate_oops_read+0x6c/0x90 [aee_aed]
[ 202.811653] [T708013] lr : proc_generate_oops_read+0x60/0x90 [aee_aed]
[ 202.811655] [T708013] sp : ffffffc03a36bcc0
[ 202.811657] [T708013] x29: ffffffc03a36bcc0
[ 202.811660] [T708013] x28: ffffff80b0718000
[ 202.811666] [T708013] x27: 0000000000000000
[ 202.811666] [T708013] x26: 0000000000000000
[ 202.811671] [T708013] x25: 0000000000000000
[ 202.811672] [T708013] x24: ffffff8003b04578
[ 202.811678] [T708013] x23: ffffff80b0718000
[ 202.811679] [T708013] x22: 0000000000001000
[ 202.811684] [T708013] x21: 00000056b70d09d0
[ 202.811685] [T708013] x20: ffffffd123d0bf68
[ 202.811690] [T708013] x19: ffffff81ad7ca000
[ 202.811690] [T708013] x18: ffffffc032dc5040
[ 202.811695] [T708013] x17: 0000000000000000
[ 202.811696] [T708013] x16: 0000000000306e08
[ 202.811701] [T708013] x15: 0000000000000004
[ 202.811702] [T708013] x14: 0000000000008ce4
[ 202.811707] [T708013] x13: ffffff81aea4b560
[ 202.811707] [T708013] x12: 0000000000000003
[ 202.811712] [T708013] x11: 00000000ffffffff
[ 202.811713] [T708013] x10: c0000000ffff8ce4
[ 202.811718] [T708013] x9 : 6aa6aae4523f1000
[ 202.811719] [T708013] x8 : 0000000000000057
[ 202.811724] [T708013] x7 : 382e32303220205b
[ 202.811724] [T708013] x6 : ffffffd129198e7d
[ 202.811729] [T708013] x5 : ffffffffffffffff
[ 202.811729] [T708013] x4 : 0000000000000000
[ 202.811734] [T708013] x3 : ffffffd1288e6800
[ 202.811735] [T708013] x2 : 0000000000000000
[ 202.811739] [T708013] x1 : 0000000000000001
[ 202.811740] [T708013] x0 : ffffffd123d0e188
[ 202.811746] [T708013] Call trace:
[ 202.811752] [T708013] proc_generate_oops_read+0x6c/0x90 [aee_aed]
[ 202.811754] [T708013] proc_reg_read+0xec/0x20c
[ 202.811757] [T708013] vfs_read+0xf4/0x368
[ 202.811759] [T708013] ksys_read+0x7c/0xf0
[ 202.811762] [T708013] __arm64_sys_read+0x20/0x30
[ 202.811764] [T708013] el0_svc_common+0xd4/0x270
[ 202.811767] [T708013] el0_svc+0x28/0x88
[ 202.811769] [T708013] el0_sync_handler+0x8c/0xf0
[ 202.811771] [T708013] el0_sync+0x1b4/0x1c0
[ 202.811782] [T708013] ==================================================================
[ 202.811785] [T708013] Kernel panic - not syncing: panic_on_taint set ...
[ 202.811788] [T708013] CPU: 7 PID: 8013 Comm: cat Tainted: P S B W O 5.10.117-android12-9-00008-g95279078149a-ab9073836 #1
[ 202.811791] [T708013] Hardware name: MT6983Z/CZA (DT)
[ 202.811793] [T708013] Call trace:
[ 202.811795] [T708013] dump_backtrace.cfi_jt+0x0/0x8
[ 202.811801] [T708013] dump_stack_lvl+0xc4/0x140
[ 202.811807] [T708013] panic+0x178/0x464
[ 202.811809] [T708013] kfence_report_error+0x53c/0x67c
[ 202.811812] [T708013] kfence_handle_page_fault+0x324/0x584
[ 202.811816] [T708013] __do_kernel_fault+0x190/0x27c
[ 202.811818] [T708013] do_bad_area+0x48/0x184
[ 202.811825] [T708013] do_translation_fault+0x50/0x64
[ 202.811827] [T708013] do_mem_abort+0x6c/0x164
[ 202.811830] [T708013] el1_abort+0x44/0x68
[ 202.811832] [T708013] el1_sync_handler+0x58/0x88
[ 202.811834] [T708013] el1_sync+0x8c/0x140
[ 202.811840] [T708013] proc_generate_oops_read+0x6c/0x90 [aee_aed]
[ 202.811842] [T708013] proc_reg_read+0xec/0x20c
[ 202.811845] [T708013] vfs_read+0xf4/0x368
[ 202.811847] [T708013] ksys_read+0x7c/0xf0
[ 202.811850] [T708013] __arm64_sys_read+0x20/0x30
[ 202.811852] [T708013] el0_svc_common+0xd4/0x270
[ 202.811855] [T708013] el0_svc+0x28/0x88
[ 202.811857] [T708013] el0_sync_handler+0x8c/0xf0
[ 202.811859] [T708013] el0_sync+0x1b4/0x1c0
[ 202.811866] [T708013] SMP: stopping secondary CPUs
[ 202.812037] [T708013] Kernel Offset: 0x1116800000 from 0xffffffc010000000
[ 202.812040] [T708013] PHYS_OFFSET: 0x40000000
[ 202.812043] [T708013] CPU features: 0x000,79dd0157,6a40a238
[ 202.812046] [T708013] Memory Limit: none
[ 202.812128] [T708013] [<14752060996991840376>] invalid lr
[ 202.823449] [T708013] Kernel Offset: 0x1116800000 from 0xffffffc010000000
[ 202.823454] [T708013] PHYS_OFFSET: 0x40000000
七 总结
目前kernel-5.10的默认kernel config都打开了，但是如果需要KFENCE生效，还需要cmdline里面传入对应的参数："panic_on_taint=20" ，这样真正检测到异常后才会触发panic，不然只会打印warning信息。
536
被折叠的 条评论
为什么被折叠?
到【灌水乐园】发言
