From: Andrey Konovalov <andreyknvl@google.com> To: Catalin Marinas <catalin.marinas@arm.com>, Vincenzo Frascino <vincenzo.frascino@arm.com>, Dmitry Vyukov <dvyukov@google.com>, Alexander Potapenko <glider@google.com>, Marco Elver <elver@google.com> Cc: Andrew Morton <akpm@linux-foundation.org>, Will Deacon <will.deacon@arm.com>, Andrey Ryabinin <aryabinin@virtuozzo.com>, Peter Collingbourne <pcc@google.com>, Evgenii Stepanov <eugenis@google.com>, Branislav Rankov <Branislav.Rankov@arm.com>, Kevin Brodsky <kevin.brodsky@arm.com>, kasan-dev@googlegroups.com, linux-arm-kernel@lists.infradead.org, linux-mm@kvack.org, linux-kernel@vger.kernel.org, Andrey Konovalov <andreyknvl@google.com> Subject: [PATCH 07/12] kasan, mm: remove krealloc side-effect Date: Mon, 1 Feb 2021 20:43:31 +0100 [thread overview] Message-ID: <884e37ddff31b671725f4d83106111c7dcf8fb9b.1612208222.git.andreyknvl@google.com> (raw) In-Reply-To: <cover.1612208222.git.andreyknvl@google.com> Currently, if krealloc() is called on a freed object with KASAN enabled, it allocates and returns a new object, but doesn't copy any memory from the old one as ksize() returns 0. This makes a caller believe that krealloc() succeeded (KASAN report is printed though). This patch adds an accessibility check into __do_krealloc(). If the check fails, krealloc() returns NULL. This check duplicates the one in ksize(); this is fixed in the following patch. This patch also adds a KASAN-KUnit test to check krealloc() behaviour when it's called on a freed object. Signed-off-by: Andrey Konovalov <andreyknvl@google.com> --- lib/test_kasan.c | 20 ++++++++++++++++++++ mm/slab_common.c | 3 +++ 2 files changed, 23 insertions(+) diff --git a/lib/test_kasan.c b/lib/test_kasan.c index 2bb52853f341..61bc894d9f7e 100644 --- a/lib/test_kasan.c +++ b/lib/test_kasan.c @@ -359,6 +359,25 @@ static void krealloc_pagealloc_less_oob(struct kunit *test) KMALLOC_MAX_CACHE_SIZE + 201); } +/* + * Check that krealloc() detects a use-after-free, returns NULL, + * and doesn't unpoison the freed object. + */ +static void krealloc_uaf(struct kunit *test) +{ + char *ptr1, *ptr2; + int size1 = 201; + int size2 = 235; + + ptr1 = kmalloc(size1, GFP_KERNEL); + KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr1); + kfree(ptr1); + + KUNIT_EXPECT_KASAN_FAIL(test, ptr2 = krealloc(ptr1, size2, GFP_KERNEL)); + KUNIT_ASSERT_PTR_EQ(test, (void *)ptr2, NULL); + KUNIT_EXPECT_KASAN_FAIL(test, *(volatile char *)ptr1); +} + static void kmalloc_oob_16(struct kunit *test) { struct { @@ -1056,6 +1075,7 @@ static struct kunit_case kasan_kunit_test_cases[] = { KUNIT_CASE(krealloc_less_oob), KUNIT_CASE(krealloc_pagealloc_more_oob), KUNIT_CASE(krealloc_pagealloc_less_oob), + KUNIT_CASE(krealloc_uaf), KUNIT_CASE(kmalloc_oob_16), KUNIT_CASE(kmalloc_uaf_16), KUNIT_CASE(kmalloc_oob_in_memset), diff --git a/mm/slab_common.c b/mm/slab_common.c index 39d1a8ff9bb8..dad70239b54c 100644 --- a/mm/slab_common.c +++ b/mm/slab_common.c @@ -1140,6 +1140,9 @@ static __always_inline void *__do_krealloc(const void *p, size_t new_size, void *ret; size_t ks; + if (likely(!ZERO_OR_NULL_PTR(p)) && !kasan_check_byte(p)) + return NULL; + ks = ksize(p); if (ks >= new_size) { -- 2.30.0.365.g02bc693789-goog
WARNING: multiple messages have this Message-ID (diff)
From: Andrey Konovalov <andreyknvl@google.com> To: Catalin Marinas <catalin.marinas@arm.com>, Vincenzo Frascino <vincenzo.frascino@arm.com>, Dmitry Vyukov <dvyukov@google.com>, Alexander Potapenko <glider@google.com>, Marco Elver <elver@google.com> Cc: Branislav Rankov <Branislav.Rankov@arm.com>, Andrey Konovalov <andreyknvl@google.com>, Kevin Brodsky <kevin.brodsky@arm.com>, Will Deacon <will.deacon@arm.com>, linux-kernel@vger.kernel.org, kasan-dev@googlegroups.com, linux-mm@kvack.org, linux-arm-kernel@lists.infradead.org, Andrey Ryabinin <aryabinin@virtuozzo.com>, Andrew Morton <akpm@linux-foundation.org>, Peter Collingbourne <pcc@google.com>, Evgenii Stepanov <eugenis@google.com> Subject: [PATCH 07/12] kasan, mm: remove krealloc side-effect Date: Mon, 1 Feb 2021 20:43:31 +0100 [thread overview] Message-ID: <884e37ddff31b671725f4d83106111c7dcf8fb9b.1612208222.git.andreyknvl@google.com> (raw) In-Reply-To: <cover.1612208222.git.andreyknvl@google.com> Currently, if krealloc() is called on a freed object with KASAN enabled, it allocates and returns a new object, but doesn't copy any memory from the old one as ksize() returns 0. This makes a caller believe that krealloc() succeeded (KASAN report is printed though). This patch adds an accessibility check into __do_krealloc(). If the check fails, krealloc() returns NULL. This check duplicates the one in ksize(); this is fixed in the following patch. This patch also adds a KASAN-KUnit test to check krealloc() behaviour when it's called on a freed object. Signed-off-by: Andrey Konovalov <andreyknvl@google.com> --- lib/test_kasan.c | 20 ++++++++++++++++++++ mm/slab_common.c | 3 +++ 2 files changed, 23 insertions(+) diff --git a/lib/test_kasan.c b/lib/test_kasan.c index 2bb52853f341..61bc894d9f7e 100644 --- a/lib/test_kasan.c +++ b/lib/test_kasan.c @@ -359,6 +359,25 @@ static void krealloc_pagealloc_less_oob(struct kunit *test) KMALLOC_MAX_CACHE_SIZE + 201); } +/* + * Check that krealloc() detects a use-after-free, returns NULL, + * and doesn't unpoison the freed object. + */ +static void krealloc_uaf(struct kunit *test) +{ + char *ptr1, *ptr2; + int size1 = 201; + int size2 = 235; + + ptr1 = kmalloc(size1, GFP_KERNEL); + KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr1); + kfree(ptr1); + + KUNIT_EXPECT_KASAN_FAIL(test, ptr2 = krealloc(ptr1, size2, GFP_KERNEL)); + KUNIT_ASSERT_PTR_EQ(test, (void *)ptr2, NULL); + KUNIT_EXPECT_KASAN_FAIL(test, *(volatile char *)ptr1); +} + static void kmalloc_oob_16(struct kunit *test) { struct { @@ -1056,6 +1075,7 @@ static struct kunit_case kasan_kunit_test_cases[] = { KUNIT_CASE(krealloc_less_oob), KUNIT_CASE(krealloc_pagealloc_more_oob), KUNIT_CASE(krealloc_pagealloc_less_oob), + KUNIT_CASE(krealloc_uaf), KUNIT_CASE(kmalloc_oob_16), KUNIT_CASE(kmalloc_uaf_16), KUNIT_CASE(kmalloc_oob_in_memset), diff --git a/mm/slab_common.c b/mm/slab_common.c index 39d1a8ff9bb8..dad70239b54c 100644 --- a/mm/slab_common.c +++ b/mm/slab_common.c @@ -1140,6 +1140,9 @@ static __always_inline void *__do_krealloc(const void *p, size_t new_size, void *ret; size_t ks; + if (likely(!ZERO_OR_NULL_PTR(p)) && !kasan_check_byte(p)) + return NULL; + ks = ksize(p); if (ks >= new_size) { -- 2.30.0.365.g02bc693789-goog _______________________________________________ linux-arm-kernel mailing list linux-arm-kernel@lists.infradead.org http://lists.infradead.org/mailman/listinfo/linux-arm-kernel
next prev parent reply other threads:[~2021-02-01 19:46 UTC|newest] Thread overview: 89+ messages / expand[flat|nested] mbox.gz Atom feed top 2021-02-01 19:43 [PATCH 00/12] kasan: optimizations and fixes for HW_TAGS Andrey Konovalov 2021-02-01 19:43 ` Andrey Konovalov 2021-02-01 19:43 ` Andrey Konovalov 2021-02-01 19:43 ` [PATCH 01/12] kasan, mm: don't save alloc stacks twice Andrey Konovalov 2021-02-01 19:43 ` Andrey Konovalov 2021-02-01 19:43 ` Andrey Konovalov 2021-02-02 16:06 ` Marco Elver 2021-02-02 16:06 ` Marco Elver 2021-02-02 18:01 ` Andrey Konovalov 2021-02-02 18:01 ` Andrey Konovalov 2021-02-02 18:01 ` Andrey Konovalov 2021-02-02 18:40 ` Marco Elver 2021-02-02 18:40 ` Marco Elver 2021-02-02 18:40 ` Marco Elver 2021-02-01 19:43 ` [PATCH 02/12] kasan, mm: optimize kmalloc poisoning Andrey Konovalov 2021-02-01 19:43 ` Andrey Konovalov 2021-02-01 19:43 ` Andrey Konovalov 2021-02-02 16:25 ` Marco Elver 2021-02-02 16:25 ` Marco Elver 2021-02-02 17:15 ` Andrey Konovalov 2021-02-02 17:15 ` Andrey Konovalov 2021-02-02 17:15 ` Andrey Konovalov 2021-02-02 17:39 ` Marco Elver 2021-02-02 17:39 ` Marco Elver 2021-02-02 17:39 ` Marco Elver 2021-02-01 19:43 ` [PATCH 03/12] kasan: optimize large " Andrey Konovalov 2021-02-01 19:43 ` Andrey Konovalov 2021-02-01 19:43 ` Andrey Konovalov 2021-02-02 16:57 ` Marco Elver 2021-02-02 16:57 ` Marco Elver 2021-02-01 19:43 ` [PATCH 04/12] kasan: clean up setting free info in kasan_slab_free Andrey Konovalov 2021-02-01 19:43 ` Andrey Konovalov 2021-02-01 19:43 ` Andrey Konovalov 2021-02-02 17:03 ` Marco Elver 2021-02-02 17:03 ` Marco Elver 2021-02-01 19:43 ` [PATCH 05/12] kasan: unify large kfree checks Andrey Konovalov 2021-02-01 19:43 ` Andrey Konovalov 2021-02-01 19:43 ` Andrey Konovalov 2021-02-03 12:13 ` Marco Elver 2021-02-03 12:13 ` Marco Elver 2021-02-01 19:43 ` [PATCH 06/12] kasan: rework krealloc tests Andrey Konovalov 2021-02-01 19:43 ` Andrey Konovalov 2021-02-01 19:43 ` Andrey Konovalov 2021-02-03 14:48 ` Marco Elver 2021-02-03 14:48 ` Marco Elver 2021-02-01 19:43 ` Andrey Konovalov [this message] 2021-02-01 19:43 ` [PATCH 07/12] kasan, mm: remove krealloc side-effect Andrey Konovalov 2021-02-01 19:43 ` Andrey Konovalov 2021-02-03 15:10 ` Marco Elver 2021-02-03 15:10 ` Marco Elver 2021-02-01 19:43 ` [PATCH 08/12] kasan, mm: optimize krealloc poisoning Andrey Konovalov 2021-02-01 19:43 ` Andrey Konovalov 2021-02-01 19:43 ` Andrey Konovalov 2021-02-03 14:34 ` Marco Elver 2021-02-03 14:34 ` Marco Elver 2021-02-01 19:43 ` [PATCH 09/12] kasan: ensure poisoning size alignment Andrey Konovalov 2021-02-01 19:43 ` Andrey Konovalov 2021-02-01 19:43 ` Andrey Konovalov 2021-02-03 15:31 ` Marco Elver 2021-02-03 15:31 ` Marco Elver 2021-02-01 19:43 ` [PATCH 10/12] arm64: kasan: simplify and inline MTE functions Andrey Konovalov 2021-02-01 19:43 ` Andrey Konovalov 2021-02-01 19:43 ` Andrey Konovalov 2021-02-01 22:44 ` Andrew Morton 2021-02-01 22:44 ` Andrew Morton 2021-02-04 12:39 ` Vincenzo Frascino 2021-02-04 12:39 ` Vincenzo Frascino 2021-02-02 15:42 ` Catalin Marinas 2021-02-02 15:42 ` Catalin Marinas 2021-02-02 18:04 ` Andrey Konovalov 2021-02-02 18:04 ` Andrey Konovalov 2021-02-02 18:04 ` Andrey Konovalov 2021-02-04 12:37 ` Vincenzo Frascino 2021-02-04 12:37 ` Vincenzo Frascino 2021-02-01 19:43 ` [PATCH 11/12] kasan: always inline HW_TAGS helper functions Andrey Konovalov 2021-02-01 19:43 ` Andrey Konovalov 2021-02-01 19:43 ` Andrey Konovalov 2021-02-03 15:51 ` Marco Elver 2021-02-03 15:51 ` Marco Elver 2021-02-01 19:43 ` [PATCH 12/12] arm64: kasan: export MTE symbols for KASAN tests Andrey Konovalov 2021-02-01 19:43 ` Andrey Konovalov 2021-02-01 19:43 ` Andrey Konovalov 2021-02-02 10:46 ` Will Deacon 2021-02-02 10:46 ` Will Deacon 2021-02-02 13:42 ` Andrey Konovalov 2021-02-02 13:42 ` Andrey Konovalov 2021-02-02 13:42 ` Andrey Konovalov 2021-02-02 15:43 ` Catalin Marinas 2021-02-02 15:43 ` Catalin Marinas
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=884e37ddff31b671725f4d83106111c7dcf8fb9b.1612208222.git.andreyknvl@google.com \ --to=andreyknvl@google.com \ --cc=Branislav.Rankov@arm.com \ --cc=akpm@linux-foundation.org \ --cc=aryabinin@virtuozzo.com \ --cc=catalin.marinas@arm.com \ --cc=dvyukov@google.com \ --cc=elver@google.com \ --cc=eugenis@google.com \ --cc=glider@google.com \ --cc=kasan-dev@googlegroups.com \ --cc=kevin.brodsky@arm.com \ --cc=linux-arm-kernel@lists.infradead.org \ --cc=linux-kernel@vger.kernel.org \ --cc=linux-mm@kvack.org \ --cc=pcc@google.com \ --cc=vincenzo.frascino@arm.com \ --cc=will.deacon@arm.com \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: linkBe sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.