요약·해설과 원문, 전문 번역을 서로 분리했습니다. API 이름, symbol, source path는 원문 표기를 사용합니다.
1. 요약·해설
원문의 핵심 논리와 kernel programming 관점의 보충 설명입니다. 아래의 전문 번역과는 별도로 작성했습니다.
2. 영어 원문 전체
번역 기준이 된 Linux v6.18.37 원문입니다. 줄 번호는 이 버전의 파일 좌표입니다.
원문 전체 펼치기
.. SPDX-License-Identifier: GPL-2.0
.. Copyright (C) 2020, Google LLC.
Kernel Electric-Fence (KFENCE)
==============================
Kernel Electric-Fence (KFENCE) is a low-overhead sampling-based memory safety
error detector. KFENCE detects heap out-of-bounds access, use-after-free, and
invalid-free errors.
KFENCE is designed to be enabled in production kernels, and has near zero
performance overhead. Compared to KASAN, KFENCE trades performance for
precision. The main motivation behind KFENCE's design, is that with enough
total uptime KFENCE will detect bugs in code paths not typically exercised by
non-production test workloads. One way to quickly achieve a large enough total
uptime is when the tool is deployed across a large fleet of machines.
Usage
-----
To enable KFENCE, configure the kernel with::
CONFIG_KFENCE=y
To build a kernel with KFENCE support, but disabled by default (to enable, set
``kfence.sample_interval`` to non-zero value), configure the kernel with::
CONFIG_KFENCE=y
CONFIG_KFENCE_SAMPLE_INTERVAL=0
KFENCE provides several other configuration options to customize behaviour (see
the respective help text in ``lib/Kconfig.kfence`` for more info).
Tuning performance
~~~~~~~~~~~~~~~~~~
The most important parameter is KFENCE's sample interval, which can be set via
the kernel boot parameter ``kfence.sample_interval`` in milliseconds. The
sample interval determines the frequency with which heap allocations will be
guarded by KFENCE. The default is configurable via the Kconfig option
``CONFIG_KFENCE_SAMPLE_INTERVAL``. Setting ``kfence.sample_interval=0``
disables KFENCE.
The sample interval controls a timer that sets up KFENCE allocations. By
default, to keep the real sample interval predictable, the normal timer also
causes CPU wake-ups when the system is completely idle. This may be undesirable
on power-constrained systems. The boot parameter ``kfence.deferrable=1``
instead switches to a "deferrable" timer which does not force CPU wake-ups on
idle systems, at the risk of unpredictable sample intervals. The default is
configurable via the Kconfig option ``CONFIG_KFENCE_DEFERRABLE``.
.. warning::
The KUnit test suite is very likely to fail when using a deferrable timer
since it currently causes very unpredictable sample intervals.
By default KFENCE will only sample 1 heap allocation within each sample
interval. *Burst mode* allows to sample successive heap allocations, where the
kernel boot parameter ``kfence.burst`` can be set to a non-zero value which
denotes the *additional* successive allocations within a sample interval;
setting ``kfence.burst=N`` means that ``1 + N`` successive allocations are
attempted through KFENCE for each sample interval.
The KFENCE memory pool is of fixed size, and if the pool is exhausted, no
further KFENCE allocations occur. With ``CONFIG_KFENCE_NUM_OBJECTS`` (default
255), the number of available guarded objects can be controlled. Each object
requires 2 pages, one for the object itself and the other one used as a guard
page; object pages are interleaved with guard pages, and every object page is
therefore surrounded by two guard pages.
The total memory dedicated to the KFENCE memory pool can be computed as::
( #objects + 1 ) * 2 * PAGE_SIZE
Using the default config, and assuming a page size of 4 KiB, results in
dedicating 2 MiB to the KFENCE memory pool.
Note: On architectures that support huge pages, KFENCE will ensure that the
pool is using pages of size ``PAGE_SIZE``. This will result in additional page
tables being allocated.
Error reports
~~~~~~~~~~~~~
A typical out-of-bounds access looks like this::
==================================================================
BUG: KFENCE: out-of-bounds read in test_out_of_bounds_read+0xa6/0x234
Out-of-bounds read at 0xffff8c3f2e291fff (1B left of kfence-#72):
test_out_of_bounds_read+0xa6/0x234
kunit_try_run_case+0x61/0xa0
kunit_generic_run_threadfn_adapter+0x16/0x30
kthread+0x176/0x1b0
ret_from_fork+0x22/0x30
kfence-#72: 0xffff8c3f2e292000-0xffff8c3f2e29201f, size=32, cache=kmalloc-32
allocated by task 484 on cpu 0 at 32.919330s:
test_alloc+0xfe/0x738
test_out_of_bounds_read+0x9b/0x234
kunit_try_run_case+0x61/0xa0
kunit_generic_run_threadfn_adapter+0x16/0x30
kthread+0x176/0x1b0
ret_from_fork+0x22/0x30
CPU: 0 PID: 484 Comm: kunit_try_catch Not tainted 5.13.0-rc3+ #7
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.14.0-2 04/01/2014
==================================================================
The header of the report provides a short summary of the function involved in
the access. It is followed by more detailed information about the access and
its origin. Note that, real kernel addresses are only shown when using the
kernel command line option ``no_hash_pointers``.
Use-after-free accesses are reported as::
==================================================================
BUG: KFENCE: use-after-free read in test_use_after_free_read+0xb3/0x143
Use-after-free read at 0xffff8c3f2e2a0000 (in kfence-#79):
test_use_after_free_read+0xb3/0x143
kunit_try_run_case+0x61/0xa0
kunit_generic_run_threadfn_adapter+0x16/0x30
kthread+0x176/0x1b0
ret_from_fork+0x22/0x30
kfence-#79: 0xffff8c3f2e2a0000-0xffff8c3f2e2a001f, size=32, cache=kmalloc-32
allocated by task 488 on cpu 2 at 33.871326s:
test_alloc+0xfe/0x738
test_use_after_free_read+0x76/0x143
kunit_try_run_case+0x61/0xa0
kunit_generic_run_threadfn_adapter+0x16/0x30
kthread+0x176/0x1b0
ret_from_fork+0x22/0x30
freed by task 488 on cpu 2 at 33.871358s:
test_use_after_free_read+0xa8/0x143
kunit_try_run_case+0x61/0xa0
kunit_generic_run_threadfn_adapter+0x16/0x30
kthread+0x176/0x1b0
ret_from_fork+0x22/0x30
CPU: 2 PID: 488 Comm: kunit_try_catch Tainted: G B 5.13.0-rc3+ #7
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.14.0-2 04/01/2014
==================================================================
KFENCE also reports on invalid frees, such as double-frees::
==================================================================
BUG: KFENCE: invalid free in test_double_free+0xdc/0x171
Invalid free of 0xffff8c3f2e2a4000 (in kfence-#81):
test_double_free+0xdc/0x171
kunit_try_run_case+0x61/0xa0
kunit_generic_run_threadfn_adapter+0x16/0x30
kthread+0x176/0x1b0
ret_from_fork+0x22/0x30
kfence-#81: 0xffff8c3f2e2a4000-0xffff8c3f2e2a401f, size=32, cache=kmalloc-32
allocated by task 490 on cpu 1 at 34.175321s:
test_alloc+0xfe/0x738
test_double_free+0x76/0x171
kunit_try_run_case+0x61/0xa0
kunit_generic_run_threadfn_adapter+0x16/0x30
kthread+0x176/0x1b0
ret_from_fork+0x22/0x30
freed by task 490 on cpu 1 at 34.175348s:
test_double_free+0xa8/0x171
kunit_try_run_case+0x61/0xa0
kunit_generic_run_threadfn_adapter+0x16/0x30
kthread+0x176/0x1b0
ret_from_fork+0x22/0x30
CPU: 1 PID: 490 Comm: kunit_try_catch Tainted: G B 5.13.0-rc3+ #7
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.14.0-2 04/01/2014
==================================================================
KFENCE also uses pattern-based redzones on the other side of an object's guard
page, to detect out-of-bounds writes on the unprotected side of the object.
These are reported on frees::
==================================================================
BUG: KFENCE: memory corruption in test_kmalloc_aligned_oob_write+0xef/0x184
Corrupted memory at 0xffff8c3f2e33aff9 [ 0xac . . . . . . ] (in kfence-#156):
test_kmalloc_aligned_oob_write+0xef/0x184
kunit_try_run_case+0x61/0xa0
kunit_generic_run_threadfn_adapter+0x16/0x30
kthread+0x176/0x1b0
ret_from_fork+0x22/0x30
kfence-#156: 0xffff8c3f2e33afb0-0xffff8c3f2e33aff8, size=73, cache=kmalloc-96
allocated by task 502 on cpu 7 at 42.159302s:
test_alloc+0xfe/0x738
test_kmalloc_aligned_oob_write+0x57/0x184
kunit_try_run_case+0x61/0xa0
kunit_generic_run_threadfn_adapter+0x16/0x30
kthread+0x176/0x1b0
ret_from_fork+0x22/0x30
CPU: 7 PID: 502 Comm: kunit_try_catch Tainted: G B 5.13.0-rc3+ #7
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.14.0-2 04/01/2014
==================================================================
For such errors, the address where the corruption occurred as well as the
invalidly written bytes (offset from the address) are shown; in this
representation, '.' denote untouched bytes. In the example above ``0xac`` is
the value written to the invalid address at offset 0, and the remaining '.'
denote that no following bytes have been touched. Note that, real values are
only shown if the kernel was booted with ``no_hash_pointers``; to avoid
information disclosure otherwise, '!' is used instead to denote invalidly
written bytes.
And finally, KFENCE may also report on invalid accesses to any protected page
where it was not possible to determine an associated object, e.g. if adjacent
object pages had not yet been allocated::
==================================================================
BUG: KFENCE: invalid read in test_invalid_access+0x26/0xe0
Invalid read at 0xffffffffb670b00a:
test_invalid_access+0x26/0xe0
kunit_try_run_case+0x51/0x85
kunit_generic_run_threadfn_adapter+0x16/0x30
kthread+0x137/0x160
ret_from_fork+0x22/0x30
CPU: 4 PID: 124 Comm: kunit_try_catch Tainted: G W 5.8.0-rc6+ #7
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1 04/01/2014
==================================================================
DebugFS interface
~~~~~~~~~~~~~~~~~
Some debugging information is exposed via debugfs:
* The file ``/sys/kernel/debug/kfence/stats`` provides runtime statistics.
* The file ``/sys/kernel/debug/kfence/objects`` provides a list of objects
allocated via KFENCE, including those already freed but protected.
Implementation Details
----------------------
Guarded allocations are set up based on the sample interval. After expiration
of the sample interval, the next allocation through the main allocator (SLAB or
SLUB) returns a guarded allocation from the KFENCE object pool (allocation
sizes up to PAGE_SIZE are supported). At this point, the timer is reset, and
the next allocation is set up after the expiration of the interval.
When using ``CONFIG_KFENCE_STATIC_KEYS=y``, KFENCE allocations are "gated"
through the main allocator's fast-path by relying on static branches via the
static keys infrastructure. The static branch is toggled to redirect the
allocation to KFENCE. Depending on sample interval, target workloads, and
system architecture, this may perform better than the simple dynamic branch.
Careful benchmarking is recommended.
KFENCE objects each reside on a dedicated page, at either the left or right
page boundaries selected at random. The pages to the left and right of the
object page are "guard pages", whose attributes are changed to a protected
state, and cause page faults on any attempted access. Such page faults are then
intercepted by KFENCE, which handles the fault gracefully by reporting an
out-of-bounds access, and marking the page as accessible so that the faulting
code can (wrongly) continue executing (set ``panic_on_warn`` to panic instead).
To detect out-of-bounds writes to memory within the object's page itself,
KFENCE also uses pattern-based redzones. For each object page, a redzone is set
up for all non-object memory. For typical alignments, the redzone is only
required on the unguarded side of an object. Because KFENCE must honor the
cache's requested alignment, special alignments may result in unprotected gaps
on either side of an object, all of which are redzoned.
The following figure illustrates the page layout::
---+-----------+-----------+-----------+-----------+-----------+---
| xxxxxxxxx | O : | xxxxxxxxx | : O | xxxxxxxxx |
| xxxxxxxxx | B : | xxxxxxxxx | : B | xxxxxxxxx |
| x GUARD x | J : RED- | x GUARD x | RED- : J | x GUARD x |
| xxxxxxxxx | E : ZONE | xxxxxxxxx | ZONE : E | xxxxxxxxx |
| xxxxxxxxx | C : | xxxxxxxxx | : C | xxxxxxxxx |
| xxxxxxxxx | T : | xxxxxxxxx | : T | xxxxxxxxx |
---+-----------+-----------+-----------+-----------+-----------+---
Upon deallocation of a KFENCE object, the object's page is again protected and
the object is marked as freed. Any further access to the object causes a fault
and KFENCE reports a use-after-free access. Freed objects are inserted at the
tail of KFENCE's freelist, so that the least recently freed objects are reused
first, and the chances of detecting use-after-frees of recently freed objects
is increased.
If pool utilization reaches 75% (default) or above, to reduce the risk of the
pool eventually being fully occupied by allocated objects yet ensure diverse
coverage of allocations, KFENCE limits currently covered allocations of the
same source from further filling up the pool. The "source" of an allocation is
based on its partial allocation stack trace. A side-effect is that this also
limits frequent long-lived allocations (e.g. pagecache) of the same source
filling up the pool permanently, which is the most common risk for the pool
becoming full and the sampled allocation rate dropping to zero. The threshold
at which to start limiting currently covered allocations can be configured via
the boot parameter ``kfence.skip_covered_thresh`` (pool usage%).
Interface
---------
The following describes the functions which are used by allocators as well as
page handling code to set up and deal with KFENCE allocations.
.. kernel-doc:: include/linux/kfence.h
:functions: is_kfence_address
kfence_shutdown_cache
kfence_alloc kfence_free __kfence_free
kfence_ksize kfence_object_start
kfence_handle_page_fault
Related Tools
-------------
In userspace, a similar approach is taken by `GWP-ASan
<http://llvm.org/docs/GwpAsan.html>`_. GWP-ASan also relies on guard pages and
a sampling strategy to detect memory unsafety bugs at scale. KFENCE's design is
directly influenced by GWP-ASan, and can be seen as its kernel sibling. Another
similar but non-sampling approach, that also inspired the name "KFENCE", can be
found in the userspace `Electric Fence Malloc Debugger
<https://linux.die.net/man/3/efence>`_.
In the kernel, several tools exist to debug memory access errors, and in
particular KASAN can detect all bug classes that KFENCE can detect. While KASAN
is more precise, relying on compiler instrumentation, this comes at a
performance cost.
It is worth highlighting that KASAN and KFENCE are complementary, with
different target environments. For instance, KASAN is the better debugging-aid,
where test cases or reproducers exists: due to the lower chance to detect the
error, it would require more effort using KFENCE to debug. Deployments at scale
that cannot afford to enable KASAN, however, would benefit from using KFENCE to
discover bugs due to code paths not exercised by test cases or fuzzers.
3. 한국어 전문 번역
영어 원문의 문단 순서와 의미를 유지한 전체 번역입니다. 코드, 함수명, symbol과 URL은 원문 표기를 유지합니다.
KFENCE 개요와 활성화
1-33SPDX 라이선스 식별자: GPL-2.0
저작권 (C) 2020, Google LLC.
Kernel Electric-Fence (KFENCE)
Kernel Electric-Fence(KFENCE)는 overhead가 낮은 sampling 기반 memory safety error detector입니다. heap out-of-bounds access, use-after-free, invalid-free error를 탐지합니다.
KFENCE는 production kernel에서 활성화하도록 설계되었으며 performance overhead가 거의 0에 가깝습니다. KASAN과 비교하면 정밀도를 일부 포기해 성능을 얻습니다. 충분한 전체 uptime이 있으면 일반적인 non-production test workload가 실행하지 않는 code path의 bug도 탐지할 수 있다는 것이 주요 설계 동기입니다. 많은 machine에 배포하면 충분히 큰 전체 uptime을 빠르게 확보할 수 있습니다.
사용법
KFENCE를 활성화하려면 kernel을 다음과 같이 구성하십시오.
CONFIG_KFENCE=yKFENCE 지원을 포함하지만 기본적으로 비활성화한 kernel을 build하려면 다음과 같이 구성하십시오. 이후 `kfence.sample_interval`을 0이 아닌 값으로 설정해 활성화할 수 있습니다.
CONFIG_KFENCE=y
CONFIG_KFENCE_SAMPLE_INTERVAL=0KFENCE는 동작을 사용자 지정하는 다른 configuration option도 제공합니다. 자세한 내용은 `lib/Kconfig.kfence`의 각 help text를 참조하십시오.
sampling, burst, memory pool 조정
34-80성능 조정
가장 중요한 parameter는 millisecond 단위 kernel boot parameter `kfence.sample_interval`로 설정하는 sample interval입니다. heap allocation을 KFENCE가 보호하는 빈도를 결정합니다. 기본값은 `CONFIG_KFENCE_SAMPLE_INTERVAL` Kconfig option으로 구성하며 `kfence.sample_interval=0`은 KFENCE를 비활성화합니다.
sample interval은 KFENCE allocation을 준비하는 timer를 제어합니다. 기본 normal timer는 실제 sample interval을 예측 가능하게 유지하기 위해 system이 완전히 idle일 때도 CPU를 깨웁니다. power가 제한된 system에는 바람직하지 않을 수 있습니다. `kfence.deferrable=1`은 idle system에서 CPU wake-up을 강제하지 않는 deferrable timer로 전환하지만 sample interval이 예측 불가능해질 수 있습니다. 기본값은 `CONFIG_KFENCE_DEFERRABLE`로 구성합니다.
경고: deferrable timer를 사용하면 현재 sample interval이 매우 예측 불가능해지므로 KUnit test suite가 실패할 가능성이 매우 높습니다.
기본적으로 KFENCE는 각 sample interval에서 heap allocation 하나만 sample합니다. burst mode는 연속 allocation을 sample할 수 있습니다. `kfence.burst` boot parameter의 0이 아닌 값은 sample interval 안에서 추가로 시도할 연속 allocation 수를 뜻합니다. `kfence.burst=N`은 각 interval마다 `1 + N`개의 연속 allocation을 KFENCE로 시도한다는 뜻입니다.
KFENCE memory pool은 크기가 고정되어 있으며 pool이 소진되면 더 이상 KFENCE allocation이 발생하지 않습니다. `CONFIG_KFENCE_NUM_OBJECTS`로 사용 가능한 guarded object 수를 제어하며 기본값은 255입니다. object마다 object 자체 page와 guard page 하나, 총 2page가 필요합니다. object page와 guard page가 번갈아 배치되므로 모든 object page는 두 guard page 사이에 놓입니다.
KFENCE memory pool에 전용으로 할당되는 전체 memory는 다음과 같이 계산합니다.
( #objects + 1 ) * 2 * PAGE_SIZE기본 config와 4KiB page size를 가정하면 KFENCE memory pool에 2MiB를 할당합니다.
참고: huge page를 지원하는 architecture에서 KFENCE는 pool이 `PAGE_SIZE` 크기의 page를 사용하도록 보장합니다. 이 때문에 추가 page table이 할당됩니다.
KFENCE error report 유형
81-235Error report
일반적인 out-of-bounds access는 다음과 같습니다.
==================================================================
BUG: KFENCE: out-of-bounds read in test_out_of_bounds_read+0xa6/0x234
Out-of-bounds read at 0xffff8c3f2e291fff (1B left of kfence-#72):
test_out_of_bounds_read+0xa6/0x234
kunit_try_run_case+0x61/0xa0
kunit_generic_run_threadfn_adapter+0x16/0x30
kthread+0x176/0x1b0
ret_from_fork+0x22/0x30
kfence-#72: 0xffff8c3f2e292000-0xffff8c3f2e29201f, size=32, cache=kmalloc-32
allocated by task 484 on cpu 0 at 32.919330s:
test_alloc+0xfe/0x738
test_out_of_bounds_read+0x9b/0x234
kunit_try_run_case+0x61/0xa0
kunit_generic_run_threadfn_adapter+0x16/0x30
kthread+0x176/0x1b0
ret_from_fork+0x22/0x30
CPU: 0 PID: 484 Comm: kunit_try_catch Not tainted 5.13.0-rc3+ #7
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.14.0-2 04/01/2014
==================================================================guard page fault로 확인한 경계 밖 access의 조사 정보를 정리했습니다.
report header는 access에 관련된 function을 짧게 요약하고, 이어서 access와 origin에 관한 상세 정보를 제공합니다. 실제 kernel address는 `no_hash_pointers` kernel command-line option을 사용할 때만 표시됩니다.
use-after-free access는 다음과 같이 보고됩니다.
==================================================================
BUG: KFENCE: use-after-free read in test_use_after_free_read+0xb3/0x143
Use-after-free read at 0xffff8c3f2e2a0000 (in kfence-#79):
test_use_after_free_read+0xb3/0x143
kunit_try_run_case+0x61/0xa0
kunit_generic_run_threadfn_adapter+0x16/0x30
kthread+0x176/0x1b0
ret_from_fork+0x22/0x30
kfence-#79: 0xffff8c3f2e2a0000-0xffff8c3f2e2a001f, size=32, cache=kmalloc-32
allocated by task 488 on cpu 2 at 33.871326s:
test_alloc+0xfe/0x738
test_use_after_free_read+0x76/0x143
kunit_try_run_case+0x61/0xa0
kunit_generic_run_threadfn_adapter+0x16/0x30
kthread+0x176/0x1b0
ret_from_fork+0x22/0x30
freed by task 488 on cpu 2 at 33.871358s:
test_use_after_free_read+0xa8/0x143
kunit_try_run_case+0x61/0xa0
kunit_generic_run_threadfn_adapter+0x16/0x30
kthread+0x176/0x1b0
ret_from_fork+0x22/0x30
CPU: 2 PID: 488 Comm: kunit_try_catch Tainted: G B 5.13.0-rc3+ #7
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.14.0-2 04/01/2014
==================================================================해제된 object access를 allocation과 free 이력으로 추적합니다.
KFENCE는 double-free 같은 invalid free도 보고합니다.
==================================================================
BUG: KFENCE: invalid free in test_double_free+0xdc/0x171
Invalid free of 0xffff8c3f2e2a4000 (in kfence-#81):
test_double_free+0xdc/0x171
kunit_try_run_case+0x61/0xa0
kunit_generic_run_threadfn_adapter+0x16/0x30
kthread+0x176/0x1b0
ret_from_fork+0x22/0x30
kfence-#81: 0xffff8c3f2e2a4000-0xffff8c3f2e2a401f, size=32, cache=kmalloc-32
allocated by task 490 on cpu 1 at 34.175321s:
test_alloc+0xfe/0x738
test_double_free+0x76/0x171
kunit_try_run_case+0x61/0xa0
kunit_generic_run_threadfn_adapter+0x16/0x30
kthread+0x176/0x1b0
ret_from_fork+0x22/0x30
freed by task 490 on cpu 1 at 34.175348s:
test_double_free+0xa8/0x171
kunit_try_run_case+0x61/0xa0
kunit_generic_run_threadfn_adapter+0x16/0x30
kthread+0x176/0x1b0
ret_from_fork+0x22/0x30
CPU: 1 PID: 490 Comm: kunit_try_catch Tainted: G B 5.13.0-rc3+ #7
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.14.0-2 04/01/2014
==================================================================잘못된 free를 object 생명주기와 함께 보여 줍니다.
KFENCE는 object guard page의 반대편에도 pattern 기반 redzone을 사용해 보호되지 않은 쪽의 out-of-bounds write를 탐지합니다. 이 error는 free 시점에 보고됩니다.
==================================================================
BUG: KFENCE: memory corruption in test_kmalloc_aligned_oob_write+0xef/0x184
Corrupted memory at 0xffff8c3f2e33aff9 [ 0xac . . . . . . ] (in kfence-#156):
test_kmalloc_aligned_oob_write+0xef/0x184
kunit_try_run_case+0x61/0xa0
kunit_generic_run_threadfn_adapter+0x16/0x30
kthread+0x176/0x1b0
ret_from_fork+0x22/0x30
kfence-#156: 0xffff8c3f2e33afb0-0xffff8c3f2e33aff8, size=73, cache=kmalloc-96
allocated by task 502 on cpu 7 at 42.159302s:
test_alloc+0xfe/0x738
test_kmalloc_aligned_oob_write+0x57/0x184
kunit_try_run_case+0x61/0xa0
kunit_generic_run_threadfn_adapter+0x16/0x30
kthread+0x176/0x1b0
ret_from_fork+0x22/0x30
CPU: 7 PID: 502 Comm: kunit_try_catch Tainted: G B 5.13.0-rc3+ #7
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.14.0-2 04/01/2014
==================================================================object page 안의 보호되지 않은 쪽에서 바뀐 redzone byte를 표시합니다.
이런 error에서는 corruption이 발생한 address와 잘못 기록된 byte를 address 기준 offset과 함께 보여 줍니다. 이 표현에서 `.`은 건드리지 않은 byte입니다. 위 예에서 `0xac`는 offset 0의 invalid address에 기록된 값이며 나머지 `.`은 이후 byte가 바뀌지 않았음을 뜻합니다. 실제 값은 `no_hash_pointers`로 boot했을 때만 표시합니다. 그렇지 않으면 정보 노출을 피하려고 잘못 기록된 byte를 `!`로 표시합니다.
마지막으로, 인접 object page가 아직 할당되지 않은 경우처럼 연관 object를 확인할 수 없는 protected page의 invalid access도 KFENCE가 보고할 수 있습니다.
==================================================================
BUG: KFENCE: invalid read in test_invalid_access+0x26/0xe0
Invalid read at 0xffffffffb670b00a:
test_invalid_access+0x26/0xe0
kunit_try_run_case+0x51/0x85
kunit_generic_run_threadfn_adapter+0x16/0x30
kthread+0x137/0x160
ret_from_fork+0x22/0x30
CPU: 4 PID: 124 Comm: kunit_try_catch Tainted: G W 5.8.0-rc6+ #7
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1 04/01/2014
==================================================================protected page fault는 확인했지만 대응하는 object metadata가 없을 때의 출력입니다.
DebugFS interface
236-245DebugFS interface
일부 debugging 정보는 debugfs를 통해 노출됩니다.
`/sys/kernel/debug/kfence/stats` 파일은 runtime statistic을 제공합니다.
`/sys/kernel/debug/kfence/objects` 파일은 이미 free되었지만 보호 중인 object를 포함해 KFENCE로 할당한 object 목록을 제공합니다.
guard page와 redzone 구현
246-305구현 세부 사항
guarded allocation은 sample interval을 기준으로 준비됩니다. interval이 끝난 뒤 main allocator(SLAB 또는 SLUB)를 통한 다음 allocation이 KFENCE object pool에서 guarded allocation을 반환합니다. PAGE_SIZE 이하 allocation을 지원합니다. 이때 timer가 reset되고 다음 interval이 만료된 뒤 다음 allocation을 준비합니다.
`CONFIG_KFENCE_STATIC_KEYS=y`를 사용하면 static key infrastructure의 static branch를 이용해 main allocator fast path에서 KFENCE allocation을 gate합니다. static branch를 전환해 allocation을 KFENCE로 redirect합니다. sample interval, target workload, system architecture에 따라 단순 dynamic branch보다 성능이 좋을 수 있으므로 주의 깊은 benchmark를 권장합니다.
각 KFENCE object는 전용 page의 왼쪽 또는 오른쪽 경계에 무작위로 배치됩니다. object page 좌우의 guard page는 protected state로 바뀌어 어떤 access 시도에도 page fault를 일으킵니다. KFENCE가 fault를 가로채 out-of-bounds access를 보고하고 page를 accessible로 표시하므로 fault를 낸 code는 잘못된 상태로 계속 실행할 수 있습니다. 대신 panic하려면 `panic_on_warn`을 설정하십시오.
object page 자체 안의 out-of-bounds write를 탐지하기 위해 pattern 기반 redzone도 사용합니다. 각 object page의 object가 아닌 모든 memory에 redzone을 설정합니다. 일반적인 alignment에서는 object의 guard가 없는 쪽에만 redzone이 필요합니다. KFENCE는 cache가 요청한 alignment를 지켜야 하므로 특수 alignment는 object 양쪽에 보호되지 않은 gap을 만들 수 있고 이 모두를 redzone으로 설정합니다.
다음 그림은 page layout을 보여 줍니다.
---+-----------+-----------+-----------+-----------+-----------+---
| xxxxxxxxx | O : | xxxxxxxxx | : O | xxxxxxxxx |
| xxxxxxxxx | B : | xxxxxxxxx | : B | xxxxxxxxx |
| x GUARD x | J : RED- | x GUARD x | RED- : J | x GUARD x |
| xxxxxxxxx | E : ZONE | xxxxxxxxx | ZONE : E | xxxxxxxxx |
| xxxxxxxxx | C : | xxxxxxxxx | : C | xxxxxxxxx |
| xxxxxxxxx | T : | xxxxxxxxx | : T | xxxxxxxxx |
---+-----------+-----------+-----------+-----------+-----------+---object가 page 경계 어느 쪽에 놓이든 guard page와 redzone이 양쪽 overflow를 감시합니다.
KFENCE object를 deallocation하면 object page를 다시 보호하고 object를 freed로 표시합니다. 이후 access는 fault를 일으키며 KFENCE가 use-after-free를 보고합니다. freed object는 KFENCE freelist tail에 삽입되어 가장 오래전에 free된 object부터 재사용합니다. 최근 free된 object의 use-after-free를 탐지할 가능성을 높입니다.
pool 사용률이 기본 75% 이상이면 pool이 할당된 object로 완전히 차는 위험을 줄이면서 다양한 allocation coverage를 유지하기 위해 같은 source에서 현재 다루는 allocation이 pool을 더 채우지 못하게 제한합니다. allocation source는 partial allocation stack trace를 기반으로 합니다.
부수적으로 pagecache처럼 같은 source의 빈번하고 오래 유지되는 allocation이 pool을 영구히 채우는 것도 제한합니다. 이는 pool이 가득 차 sample allocation rate가 0으로 떨어지는 가장 흔한 위험입니다. 제한을 시작할 threshold는 pool usage percentage인 `kfence.skip_covered_thresh` boot parameter로 구성할 수 있습니다.
allocator와 page fault interface
306-318Interface
다음은 allocator와 page handling code가 KFENCE allocation을 준비하고 처리할 때 사용하는 function을 설명합니다.
.. kernel-doc:: include/linux/kfence.h
:functions: is_kfence_address
kfence_shutdown_cache
kfence_alloc kfence_free __kfence_free
kfence_ksize kfence_object_start
kfence_handle_page_fault
요약과 해설
kfence.rst:1-340KFENCE는 일부 heap allocation만 고정 pool의 guard page 사이에 배치해 out-of-bounds, use-after-free, invalid-free를 낮은 overhead로 탐지합니다. 단일 실행의 정밀도보다 대규모 machine fleet의 누적 uptime을 이용한 희귀 code path 탐지에 초점을 둡니다.
sample interval, burst, pool object 수는 탐지 확률과 power·memory 비용을 결정합니다. guard page가 page 경계 밖 access를 즉시 잡고 object page 안의 redzone pattern이 반대쪽 overflow를 free 시점에 확인하므로 두 종류의 report와 allocation/free stack을 함께 해석해야 합니다.