From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-17.4 required=3.0 tests=DKIMWL_WL_MED,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_PATCH, MAILING_LIST_MULTI,SIGNED_OFF_BY,SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED, USER_AGENT_GIT,USER_IN_DEF_DKIM_WL autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 62D88CA9EC5 for ; Wed, 30 Oct 2019 14:24:06 +0000 (UTC) Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by mail.kernel.org (Postfix) with ESMTP id 0CFF32087E for ; Wed, 30 Oct 2019 14:24:06 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b="fByZ06Zd" DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org 0CFF32087E Authentication-Results: mail.kernel.org; dmarc=fail (p=reject dis=none) header.from=google.com Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=owner-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix) id 03AFB6B0286; Wed, 30 Oct 2019 10:23:59 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id F08A46B0288; Wed, 30 Oct 2019 10:23:58 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id D66546B0289; Wed, 30 Oct 2019 10:23:58 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from forelay.hostedemail.com (smtprelay0216.hostedemail.com [216.40.44.216]) by kanga.kvack.org (Postfix) with ESMTP id A50A76B0286 for ; Wed, 30 Oct 2019 10:23:58 -0400 (EDT) Received: from smtpin15.hostedemail.com (10.5.19.251.rfc1918.com [10.5.19.251]) by forelay04.hostedemail.com (Postfix) with SMTP id 54610282A for ; Wed, 30 Oct 2019 14:23:58 +0000 (UTC) X-FDA: 76100670156.15.name18_3fadffc48cb10 X-HE-Tag: name18_3fadffc48cb10 X-Filterd-Recvd-Size: 13623 Received: from mail-wr1-f73.google.com (mail-wr1-f73.google.com [209.85.221.73]) by imf49.hostedemail.com (Postfix) with ESMTP for ; Wed, 30 Oct 2019 14:23:57 +0000 (UTC) Received: by mail-wr1-f73.google.com with SMTP id c6so1423547wrp.3 for ; Wed, 30 Oct 2019 07:23:57 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=date:in-reply-to:message-id:mime-version:references:subject:from:to :cc; bh=SaCxedWrWmYuu3heks9wmzJiGaxK2x9+HevM/+wrMlg=; b=fByZ06ZdmpBPPyKDS93WRP7wtYRjCUF3BTLO0dUzzFfkSMt1/GTFclHIO1oxa5m8I0 xSzOVolux65lqa0hvUNqNC+Kh9lI3cdt33sII2hbYqaWMCd38qiWBO1d+g61YNr3x3Eq ps5ZPGIS5B8yFTbAQJcKsnPNpzcQdPFEleB1LCJi8pebnPnBq9p/A/L4q2CcwRM5G2kt WS3k+YgKe4g21JsKBxlqPN5FDqC2K2moIfgYZlzBfRxTlWcTRo8C9cW7gqMFENOtUIgf LrPDBCAKUAFvedFYw9IGPTgYnA56HTqiVJKq2Zx1FBOHcitedjNmzvDw1oySa65VHMeX bpcQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:date:in-reply-to:message-id:mime-version :references:subject:from:to:cc; bh=SaCxedWrWmYuu3heks9wmzJiGaxK2x9+HevM/+wrMlg=; b=JHo53m9Oftuu8m6+qOtmA+vQMZhShFBTawZAKiMSn87xYP6sPvZ9G6S9WdyGFXxW7A 4o8IXD2QKwQ+fhzo+dFTeify5olB/+F25MQznRY6rroATgWuBcXc2VFHqhIKRTyZCJu1 p5Hy57bC2NkuVltxGfYX4Xnan05DOmWl5KqXTypW8WVvtVlveF2NPs5M2+4W7SKp9DxY 6PJJyPps6mcGp40zyN3HOxMjE3BQSDEZKcqvyvETDu728eTtdf7f5FSg02TGJVoPbsK4 xMPriV8gV/7QBFjvDj8QKOR/x1zizBxOnSzxh7f67tIgFZi2jw9U6sdP4XhxbZI3VEV0 YZLg== X-Gm-Message-State: APjAAAWRnx15gtM2FS+jSKmeS2zgdUkDsa65TCKt8e5EOLxs3T/tTx1m 4cIuYJ7XMayjVRNly5pdfaQ5GpbIIwk= X-Google-Smtp-Source: APXvYqxCysyUV+v2+9MK8wdK9rrokFHhjaLVxCcPjJwbfYuuLvYgX1shJOL4CwRWAHZBO79i/X0CfPkwm10= X-Received: by 2002:adf:ea8d:: with SMTP id s13mr120277wrm.366.1572445436019; Wed, 30 Oct 2019 07:23:56 -0700 (PDT) Date: Wed, 30 Oct 2019 15:22:35 +0100 In-Reply-To: <20191030142237.249532-1-glider@google.com> Message-Id: <20191030142237.249532-24-glider@google.com> Mime-Version: 1.0 References: <20191030142237.249532-1-glider@google.com> X-Mailer: git-send-email 2.24.0.rc0.303.g954a862665-goog Subject: [PATCH RFC v2 23/25] kmsan: hooks for copy_to_user() and friends From: glider@google.com To: Alexander Viro , Vegard Nossum , Dmitry Vyukov , linux-mm@kvack.org Cc: akpm@linux-foundation.org, aryabinin@virtuozzo.com, luto@kernel.org, ard.biesheuvel@linaro.org, arnd@arndb.de, hch@lst.de, dmitry.torokhov@gmail.com, edumazet@google.com, ericvh@gmail.com, gregkh@linuxfoundation.org, harry.wentland@amd.com, herbert@gondor.apana.org.au, mingo@elte.hu, axboe@kernel.dk, martin.petersen@oracle.com, schwidefsky@de.ibm.com, mst@redhat.com, monstr@monstr.eu, pmladek@suse.com, sergey.senozhatsky@gmail.com, rostedt@goodmis.org, tiwai@suse.com, tytso@mit.edu, tglx@linutronix.de, wsa@the-dreams.de, gor@linux.ibm.com, iii@linux.ibm.com, mark.rutland@arm.com, willy@infradead.org, rdunlap@infradead.org, andreyknvl@google.com, elver@google.com, Alexander Potapenko Content-Type: text/plain; charset="UTF-8" X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: Memory that is copied from userspace must be unpoisoned. Before copying memory to userspace, check it and report an error if it contains uninitialized bits. Signed-off-by: Alexander Potapenko To: Alexander Potapenko Cc: Alexander Viro Cc: Vegard Nossum Cc: Dmitry Vyukov Cc: linux-mm@kvack.org --- Change-Id: I38428b9c7d1909b8441dcec1749b080494a7af99 --- arch/x86/include/asm/uaccess.h | 12 ++++++++++++ include/asm-generic/cacheflush.h | 7 ++++++- include/asm-generic/uaccess.h | 12 ++++++++++-- include/linux/uaccess.h | 32 +++++++++++++++++++++++++++----- lib/iov_iter.c | 6 ++++++ lib/usercopy.c | 6 +++++- 6 files changed, 66 insertions(+), 9 deletions(-) diff --git a/arch/x86/include/asm/uaccess.h b/arch/x86/include/asm/uaccess.h index 61d93f062a36..ac4b26583f7c 100644 --- a/arch/x86/include/asm/uaccess.h +++ b/arch/x86/include/asm/uaccess.h @@ -6,6 +6,7 @@ */ #include #include +#include #include #include #include @@ -174,6 +175,7 @@ __typeof__(__builtin_choose_expr(sizeof(x) > sizeof(0UL), 0ULL, 0UL)) ASM_CALL_CONSTRAINT \ : "0" (ptr), "i" (sizeof(*(ptr)))); \ (x) = (__force __typeof__(*(ptr))) __val_gu; \ + kmsan_unpoison_shadow(&(x), sizeof(*(ptr))); \ __builtin_expect(__ret_gu, 0); \ }) @@ -248,6 +250,7 @@ extern void __put_user_8(void); __chk_user_ptr(ptr); \ might_fault(); \ __pu_val = x; \ + kmsan_check_memory(&(__pu_val), sizeof(*(ptr))); \ switch (sizeof(*(ptr))) { \ case 1: \ __put_user_x(1, __pu_val, ptr, __ret_pu); \ @@ -270,7 +273,9 @@ extern void __put_user_8(void); #define __put_user_size(x, ptr, size, label) \ do { \ + __typeof__(*(ptr)) __pus_val = x; \ __chk_user_ptr(ptr); \ + kmsan_check_memory(&(__pus_val), size); \ switch (size) { \ case 1: \ __put_user_goto(x, ptr, "b", "b", "iq", label); \ @@ -295,7 +300,10 @@ do { \ */ #define __put_user_size_ex(x, ptr, size) \ do { \ + __typeof__(*(ptr)) __puse_val; \ __chk_user_ptr(ptr); \ + __puse_val = x; \ + kmsan_check_memory(&(__puse_val), size); \ switch (size) { \ case 1: \ __put_user_asm_ex(x, ptr, "b", "b", "iq"); \ @@ -363,6 +371,7 @@ do { \ default: \ (x) = __get_user_bad(); \ } \ + kmsan_unpoison_shadow(&(x), size); \ } while (0) #define __get_user_asm(x, addr, err, itype, rtype, ltype, errret) \ @@ -413,6 +422,7 @@ do { \ default: \ (x) = __get_user_bad(); \ } \ + kmsan_unpoison_shadow(&(x), size); \ } while (0) #define __get_user_asm_ex(x, addr, itype, rtype, ltype) \ @@ -428,11 +438,13 @@ do { \ #define __put_user_nocheck(x, ptr, size) \ ({ \ __label__ __pu_label; \ + __typeof__(*(ptr)) __pun_val = x; \ int __pu_err = -EFAULT; \ __typeof__(*(ptr)) __pu_val = (x); \ __typeof__(ptr) __pu_ptr = (ptr); \ __typeof__(size) __pu_size = (size); \ __uaccess_begin(); \ + kmsan_check_memory(&(__pun_val), size); \ __put_user_size(__pu_val, __pu_ptr, __pu_size, __pu_label); \ __pu_err = 0; \ __pu_label: \ diff --git a/include/asm-generic/cacheflush.h b/include/asm-generic/cacheflush.h index a950a22c4890..707531dccf5e 100644 --- a/include/asm-generic/cacheflush.h +++ b/include/asm-generic/cacheflush.h @@ -4,6 +4,7 @@ /* Keep includes the same across arches. */ #include +#include #define ARCH_IMPLEMENTS_FLUSH_DCACHE_PAGE 0 @@ -72,10 +73,14 @@ static inline void flush_cache_vunmap(unsigned long start, unsigned long end) #define copy_to_user_page(vma, page, vaddr, dst, src, len) \ do { \ + kmsan_check_memory(src, len); \ memcpy(dst, src, len); \ flush_icache_user_range(vma, page, vaddr, len); \ } while (0) #define copy_from_user_page(vma, page, vaddr, dst, src, len) \ - memcpy(dst, src, len) + do { \ + memcpy(dst, src, len); \ + kmsan_unpoison_shadow(dst, len); \ + } while (0) #endif /* __ASM_CACHEFLUSH_H */ diff --git a/include/asm-generic/uaccess.h b/include/asm-generic/uaccess.h index e935318804f8..18a50333ffc0 100644 --- a/include/asm-generic/uaccess.h +++ b/include/asm-generic/uaccess.h @@ -142,7 +142,11 @@ static inline int __access_ok(unsigned long addr, unsigned long size) static inline int __put_user_fn(size_t size, void __user *ptr, void *x) { - return unlikely(raw_copy_to_user(ptr, x, size)) ? -EFAULT : 0; + int n; + + n = raw_copy_to_user(ptr, x, size); + kmsan_copy_to_user(ptr, x, size, n); + return unlikely(n) ? -EFAULT : 0; } #define __put_user_fn(sz, u, k) __put_user_fn(sz, u, k) @@ -203,7 +207,11 @@ extern int __put_user_bad(void) __attribute__((noreturn)); #ifndef __get_user_fn static inline int __get_user_fn(size_t size, const void __user *ptr, void *x) { - return unlikely(raw_copy_from_user(x, ptr, size)) ? -EFAULT : 0; + int copied, to_copy = size; + + copied = raw_copy_from_user(x, ptr, size); + kmsan_unpoison_shadow(to, to_copy - res); + return unlikely(copied) ? -EFAULT : 0; } #define __get_user_fn(sz, u, k) __get_user_fn(sz, u, k) diff --git a/include/linux/uaccess.h b/include/linux/uaccess.h index d4ee6e942562..4257b5f80689 100644 --- a/include/linux/uaccess.h +++ b/include/linux/uaccess.h @@ -5,6 +5,7 @@ #include #include #include +#include #define uaccess_kernel() segment_eq(get_fs(), KERNEL_DS) @@ -58,18 +59,26 @@ static __always_inline __must_check unsigned long __copy_from_user_inatomic(void *to, const void __user *from, unsigned long n) { + unsigned long to_copy = n; + kasan_check_write(to, n); check_object_size(to, n, false); - return raw_copy_from_user(to, from, n); + n = raw_copy_from_user(to, from, n); + kmsan_unpoison_shadow(to, to_copy - n); + return n; } static __always_inline __must_check unsigned long __copy_from_user(void *to, const void __user *from, unsigned long n) { + unsigned long to_copy = n; + might_fault(); kasan_check_write(to, n); check_object_size(to, n, false); - return raw_copy_from_user(to, from, n); + n = raw_copy_from_user(to, from, n); + kmsan_unpoison_shadow(to, to_copy - n); + return n; } /** @@ -88,29 +97,39 @@ __copy_from_user(void *to, const void __user *from, unsigned long n) static __always_inline __must_check unsigned long __copy_to_user_inatomic(void __user *to, const void *from, unsigned long n) { + unsigned long to_copy = n; + kasan_check_read(from, n); check_object_size(from, n, true); - return raw_copy_to_user(to, from, n); + n = raw_copy_to_user(to, from, n); + kmsan_copy_to_user(to, from, to_copy, n); + return n; } static __always_inline __must_check unsigned long __copy_to_user(void __user *to, const void *from, unsigned long n) { + unsigned long to_copy = n; + might_fault(); kasan_check_read(from, n); check_object_size(from, n, true); - return raw_copy_to_user(to, from, n); + n = raw_copy_to_user(to, from, n); + kmsan_copy_to_user(to, from, to_copy, n); + return n; } #ifdef INLINE_COPY_FROM_USER static inline __must_check unsigned long _copy_from_user(void *to, const void __user *from, unsigned long n) { - unsigned long res = n; + unsigned long res = n, to_copy = n; + might_fault(); if (likely(access_ok(from, n))) { kasan_check_write(to, n); res = raw_copy_from_user(to, from, n); + kmsan_unpoison_shadow(to, to_copy - res); } if (unlikely(res)) memset(to + (n - res), 0, res); @@ -125,10 +144,13 @@ _copy_from_user(void *, const void __user *, unsigned long); static inline __must_check unsigned long _copy_to_user(void __user *to, const void *from, unsigned long n) { + unsigned long to_copy = n; + might_fault(); if (access_ok(to, n)) { kasan_check_read(from, n); n = raw_copy_to_user(to, from, n); + kmsan_copy_to_user(to, from, to_copy, n); } return n; } diff --git a/lib/iov_iter.c b/lib/iov_iter.c index 639d5e7014c1..f038676068b2 100644 --- a/lib/iov_iter.c +++ b/lib/iov_iter.c @@ -137,18 +137,24 @@ static int copyout(void __user *to, const void *from, size_t n) { + size_t to_copy = n; + if (access_ok(to, n)) { kasan_check_read(from, n); n = raw_copy_to_user(to, from, n); + kmsan_copy_to_user(to, from, to_copy, n); } return n; } static int copyin(void *to, const void __user *from, size_t n) { + size_t to_copy = n; + if (access_ok(from, n)) { kasan_check_write(to, n); n = raw_copy_from_user(to, from, n); + kmsan_unpoison_shadow(to, to_copy - n); } return n; } diff --git a/lib/usercopy.c b/lib/usercopy.c index cbb4d9ec00f2..abfd93edecba 100644 --- a/lib/usercopy.c +++ b/lib/usercopy.c @@ -1,4 +1,5 @@ // SPDX-License-Identifier: GPL-2.0 +#include #include #include @@ -7,11 +8,12 @@ #ifndef INLINE_COPY_FROM_USER unsigned long _copy_from_user(void *to, const void __user *from, unsigned long n) { - unsigned long res = n; + unsigned long res = n, to_copy = n; might_fault(); if (likely(access_ok(from, n))) { kasan_check_write(to, n); res = raw_copy_from_user(to, from, n); + kmsan_unpoison_shadow(to, to_copy - res); } if (unlikely(res)) memset(to + (n - res), 0, res); @@ -23,10 +25,12 @@ EXPORT_SYMBOL(_copy_from_user); #ifndef INLINE_COPY_TO_USER unsigned long _copy_to_user(void __user *to, const void *from, unsigned long n) { + unsigned long to_copy = n; might_fault(); if (likely(access_ok(to, n))) { kasan_check_read(from, n); n = raw_copy_to_user(to, from, n); + kmsan_copy_to_user(to, from, to_copy, n); } return n; } -- 2.24.0.rc0.303.g954a862665-goog