From: Andrey Konovalov <andreyknvl@google.com>
To: Alexander Potapenko <glider@google.com>
Cc: Thomas Gleixner <tglx@linutronix.de>,
Andrew Morton <akpm@linux-foundation.org>,
Vegard Nossum <vegard.nossum@oracle.com>,
Dmitry Vyukov <dvyukov@google.com>,
Marco Elver <elver@google.com>,
Linux Memory Management List <linux-mm@kvack.org>,
Alexander Viro <viro@zeniv.linux.org.uk>,
Andreas Dilger <adilger.kernel@dilger.ca>,
Andrey Ryabinin <aryabinin@virtuozzo.com>,
Andy Lutomirski <luto@kernel.org>,
Ard Biesheuvel <ard.biesheuvel@linaro.org>,
Arnd Bergmann <arnd@arndb.de>,
Christoph Hellwig <hch@infradead.org>,
Christoph Hellwig <hch@lst.de>,
"Darrick J. Wong" <darrick.wong@oracle.com>,
"David S. Miller" <davem@davemloft.net>,
Dmitry Torokhov <dmitry.torokhov@gmail.com>,
Eric Biggers <ebiggers@google.com>,
Eric Dumazet <edumazet@google.com>,
Eric Van Hensbergen <ericvh@gmail.com>,
Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
Harry Wentland <harry.wentland@amd.com>,
Herbert Xu <herbert@gondor.apana.org.au>,
Ilya Leoshkevich <iii@linux.ibm.com>,
Ingo Molnar <mingo@elte.hu>, Jason Wang <jasowang@redhat.com>,
Jens Axboe <axboe@kernel.dk>,
Marek Szyprowski <m.szyprowski@samsung.com>,
Mark Rutland <mark.rutland@arm.com>,
"Martin K. Petersen" <martin.petersen@oracle.com>,
Martin Schwidefsky <schwidefsky@de.ibm.com>,
Matthew Wilcox <willy@infradead.org>,
"Michael S . Tsirkin" <mst@redhat.com>,
Michal Hocko <mhocko@suse.com>, Michal Simek <monstr@monstr.eu>,
Petr Mladek <pmladek@suse.com>, Qian Cai <cai@lca.pw>,
Randy Dunlap <rdunlap@infradead.org>,
Robin Murphy <robin.murphy@arm.com>,
Sergey Senozhatsky <sergey.senozhatsky@gmail.com>,
Steven Rostedt <rostedt@goodmis.org>,
Takashi Iwai <tiwai@suse.com>, "Theodore Ts'o" <tytso@mit.edu>,
Vasily Gorbik <gor@linux.ibm.com>,
Wolfram Sang <wsa@the-dreams.de>
Subject: Re: [PATCH v5 24/38] kmsan: disable instrumentation of certain functions
Date: Tue, 14 Apr 2020 17:04:26 +0200 [thread overview]
Message-ID: <CAAeHK+yZToxgChthLdN_VTJPfdu9oCm2ZXfHqwq6JUW+MXWR5g@mail.gmail.com> (raw)
In-Reply-To: <20200325161249.55095-25-glider@google.com>
On Wed, Mar 25, 2020 at 5:14 PM <glider@google.com> wrote:
>
> Some functions are called from handwritten assembly, and therefore don't
> have their arguments' metadata fully set up by the instrumentation code.
> Mark them with __no_sanitize_memory to avoid false positives from
> spreading further.
> Certain functions perform task switching, so that the value of |current|
> is different as they proceed. Because KMSAN state pointer is only read
> once at the beginning of the function, touching it after |current| has
> changed may be dangerous.
I think that whenever a patch touches some subsystem, we need to
mention that in the commit title. This patch touches mostly x86, so
"kmsan, x86: ..." or something like that. This will probably make x86
maintainers more involved.
>
> Signed-off-by: Alexander Potapenko <glider@google.com>
> To: Alexander Potapenko <glider@google.com>
> Cc: Thomas Gleixner <tglx@linutronix.de>
> Cc: Andrew Morton <akpm@linux-foundation.org>
> Cc: Vegard Nossum <vegard.nossum@oracle.com>
> Cc: Dmitry Vyukov <dvyukov@google.com>
> Cc: Marco Elver <elver@google.com>
> Cc: Andrey Konovalov <andreyknvl@google.com>
> Cc: linux-mm@kvack.org
> ---
> v3:
> - removed TODOs from comments
>
> v4:
> - updated the comments, dropped __no_sanitize_memory from idle_cpu(),
> sched_init(), profile_tick()
> - split away the uprobes part as requested by Andrey Konovalov
>
> Change-Id: I684d23dac5a22eb0a4cea71993cb934302b17cea
> ---
> arch/x86/entry/common.c | 2 ++
> arch/x86/include/asm/irq_regs.h | 2 ++
> arch/x86/include/asm/syscall_wrapper.h | 2 ++
> arch/x86/kernel/apic/apic.c | 3 +++
> arch/x86/kernel/dumpstack_64.c | 5 +++++
> arch/x86/kernel/process_64.c | 5 +++++
> arch/x86/kernel/traps.c | 13 +++++++++++--
> kernel/sched/core.c | 22 ++++++++++++++++++++++
> 8 files changed, 52 insertions(+), 2 deletions(-)
>
> diff --git a/arch/x86/entry/common.c b/arch/x86/entry/common.c
> index ec167d8c41cbd..5c3d0f3a14c37 100644
> --- a/arch/x86/entry/common.c
> +++ b/arch/x86/entry/common.c
> @@ -280,6 +280,8 @@ __visible inline void syscall_return_slowpath(struct pt_regs *regs)
> }
>
> #ifdef CONFIG_X86_64
> +/* Tell KMSAN to not instrument this function and to initialize |regs|. */
> +__no_sanitize_memory
> __visible void do_syscall_64(unsigned long nr, struct pt_regs *regs)
> {
> struct thread_info *ti;
> diff --git a/arch/x86/include/asm/irq_regs.h b/arch/x86/include/asm/irq_regs.h
> index 187ce59aea28e..a6fc1641e2861 100644
> --- a/arch/x86/include/asm/irq_regs.h
> +++ b/arch/x86/include/asm/irq_regs.h
> @@ -14,6 +14,8 @@
>
> DECLARE_PER_CPU(struct pt_regs *, irq_regs);
>
> +/* Tell KMSAN to return an initialized struct pt_regs. */
> +__no_sanitize_memory
> static inline struct pt_regs *get_irq_regs(void)
> {
> return __this_cpu_read(irq_regs);
> diff --git a/arch/x86/include/asm/syscall_wrapper.h b/arch/x86/include/asm/syscall_wrapper.h
> index e2389ce9bf58a..098b1a8d6bc41 100644
> --- a/arch/x86/include/asm/syscall_wrapper.h
> +++ b/arch/x86/include/asm/syscall_wrapper.h
> @@ -196,6 +196,8 @@ struct pt_regs;
> ALLOW_ERROR_INJECTION(__x64_sys##name, ERRNO); \
> static long __se_sys##name(__MAP(x,__SC_LONG,__VA_ARGS__)); \
> static inline long __do_sys##name(__MAP(x,__SC_DECL,__VA_ARGS__));\
> + /* Tell KMSAN to initialize |regs|. */ \
> + __no_sanitize_memory \
> asmlinkage long __x64_sys##name(const struct pt_regs *regs) \
> { \
> return __se_sys##name(SC_X86_64_REGS_TO_ARGS(x,__VA_ARGS__));\
> diff --git a/arch/x86/kernel/apic/apic.c b/arch/x86/kernel/apic/apic.c
> index 5f973fed3c9ff..1f0250f14e462 100644
> --- a/arch/x86/kernel/apic/apic.c
> +++ b/arch/x86/kernel/apic/apic.c
> @@ -1127,6 +1127,9 @@ static void local_apic_timer_interrupt(void)
> * [ if a single-CPU system runs an SMP kernel then we call the local
> * interrupt as well. Thus we cannot inline the local irq ... ]
> */
> +
> +/* Tell KMSAN to initialize |regs|. */
> +__no_sanitize_memory
> __visible void __irq_entry smp_apic_timer_interrupt(struct pt_regs *regs)
> {
> struct pt_regs *old_regs = set_irq_regs(regs);
> diff --git a/arch/x86/kernel/dumpstack_64.c b/arch/x86/kernel/dumpstack_64.c
> index 87b97897a8810..3d1691f81cada 100644
> --- a/arch/x86/kernel/dumpstack_64.c
> +++ b/arch/x86/kernel/dumpstack_64.c
> @@ -150,6 +150,11 @@ static bool in_irq_stack(unsigned long *stack, struct stack_info *info)
> return true;
> }
>
> +/*
> + * This function may touch stale uninitialized values on stack. Do not
> + * instrument it with KMSAN to avoid false positives.
> + */
> +__no_sanitize_memory
> int get_stack_info(unsigned long *stack, struct task_struct *task,
> struct stack_info *info, unsigned long *visit_mask)
> {
> diff --git a/arch/x86/kernel/process_64.c b/arch/x86/kernel/process_64.c
> index ffd497804dbc3..5e8c6767e9916 100644
> --- a/arch/x86/kernel/process_64.c
> +++ b/arch/x86/kernel/process_64.c
> @@ -424,6 +424,11 @@ void compat_start_thread(struct pt_regs *regs, u32 new_ip, u32 new_sp)
> * Kprobes not supported here. Set the probe on schedule instead.
> * Function graph tracer not supported too.
> */
> +/*
> + * Avoid touching KMSAN state or reporting anything here, as __switch_to() does
> + * weird things with tasks.
> + */
> +__no_sanitize_memory
> __visible __notrace_funcgraph struct task_struct *
> __switch_to(struct task_struct *prev_p, struct task_struct *next_p)
> {
> diff --git a/arch/x86/kernel/traps.c b/arch/x86/kernel/traps.c
> index d54cffdc7cac2..917268aee054e 100644
> --- a/arch/x86/kernel/traps.c
> +++ b/arch/x86/kernel/traps.c
> @@ -638,7 +638,11 @@ NOKPROBE_SYMBOL(do_int3);
> * Help handler running on a per-cpu (IST or entry trampoline) stack
> * to switch to the normal thread stack if the interrupted code was in
> * user mode. The actual stack switch is done in entry_64.S
> + *
> */
> +
> +/* This function switches the registers - don't instrument it with KMSAN. */
> +__no_sanitize_memory
> asmlinkage __visible notrace struct pt_regs *sync_regs(struct pt_regs *eregs)
> {
> struct pt_regs *regs = (struct pt_regs *)this_cpu_read(cpu_current_top_of_stack) - 1;
> @@ -654,6 +658,11 @@ struct bad_iret_stack {
> };
>
> asmlinkage __visible notrace
> +/*
> + * Dark magic happening here, let's not instrument this function.
> + * Also avoid copying any metadata by using raw __memmove().
> + */
> +__no_sanitize_memory
> struct bad_iret_stack *fixup_bad_iret(struct bad_iret_stack *s)
> {
> /*
> @@ -668,10 +677,10 @@ struct bad_iret_stack *fixup_bad_iret(struct bad_iret_stack *s)
> (struct bad_iret_stack *)this_cpu_read(cpu_tss_rw.x86_tss.sp0) - 1;
>
> /* Copy the IRET target to the new stack. */
> - memmove(&new_stack->regs.ip, (void *)s->regs.sp, 5*8);
> + __memmove(&new_stack->regs.ip, (void *)s->regs.sp, 5*8);
>
> /* Copy the remainder of the stack from the current stack. */
> - memmove(new_stack, s, offsetof(struct bad_iret_stack, regs.ip));
> + __memmove(new_stack, s, offsetof(struct bad_iret_stack, regs.ip));
>
> BUG_ON(!user_mode(&new_stack->regs));
> return new_stack;
> diff --git a/kernel/sched/core.c b/kernel/sched/core.c
> index 1a5937936ac75..bb1b659c12f6a 100644
> --- a/kernel/sched/core.c
> +++ b/kernel/sched/core.c
> @@ -471,6 +471,11 @@ void wake_q_add_safe(struct wake_q_head *head, struct task_struct *task)
> put_task_struct(task);
> }
>
> +/*
> + * Context switch here may lead to KMSAN task state corruption. Disable KMSAN
> + * instrumentation.
> + */
> +__no_sanitize_memory
> void wake_up_q(struct wake_q_head *head)
> {
> struct wake_q_node *node = head->first;
> @@ -3217,6 +3222,12 @@ prepare_task_switch(struct rq *rq, struct task_struct *prev,
> * past. prev == current is still correct but we need to recalculate this_rq
> * because prev may have moved to another CPU.
> */
> +
> +/*
> + * Context switch here may lead to KMSAN task state corruption. Disable KMSAN
> + * instrumentation.
> + */
> +__no_sanitize_memory
> static struct rq *finish_task_switch(struct task_struct *prev)
> __releases(rq->lock)
> {
> @@ -4052,6 +4063,12 @@ pick_next_task(struct rq *rq, struct task_struct *prev, struct rq_flags *rf)
> *
> * WARNING: must be called with preemption disabled!
> */
> +
> +/*
> + * Context switch here may lead to KMSAN task state corruption. Disable KMSAN
> + * instrumentation.
> + */
> +__no_sanitize_memory
> static void __sched notrace __schedule(bool preempt)
> {
> struct task_struct *prev, *next;
> @@ -6789,6 +6806,11 @@ static inline int preempt_count_equals(int preempt_offset)
> return (nested == preempt_offset);
> }
>
> +/*
> + * This function might be called from code that is not instrumented with KMSAN.
> + * Nevertheless, treat its arguments as initialized.
> + */
> +__no_sanitize_memory
> void __might_sleep(const char *file, int line, int preempt_offset)
> {
> /*
> --
> 2.25.1.696.g5e7596f4ac-goog
>
next prev parent reply other threads:[~2020-04-14 15:04 UTC|newest]
Thread overview: 94+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-03-25 16:12 [PATCH v5 00/38] Add KernelMemorySanitizer infrastructure glider
2020-03-25 16:12 ` [PATCH v5 01/38] stackdepot: reserve 5 extra bits in depot_stack_handle_t glider
2020-03-30 13:36 ` Andrey Konovalov
2020-03-25 16:12 ` [PATCH v5 02/38] kmsan: add ReST documentation glider
2020-03-30 14:32 ` Andrey Konovalov
2020-04-13 14:45 ` Alexander Potapenko
2020-03-25 16:12 ` [PATCH v5 03/38] kmsan: gfp: introduce __GFP_NO_KMSAN_SHADOW glider
2020-03-25 16:19 ` Michal Hocko
2020-03-25 17:26 ` Alexander Potapenko
2020-03-25 17:40 ` Alexander Potapenko
2020-03-25 17:49 ` Matthew Wilcox
2020-03-25 18:03 ` Alexander Potapenko
2020-03-25 18:09 ` Matthew Wilcox
2020-03-25 18:30 ` Alexander Potapenko
2020-03-25 18:43 ` Michal Hocko
2020-03-25 18:40 ` Michal Hocko
2020-03-25 18:38 ` Michal Hocko
2020-03-27 12:20 ` Alexander Potapenko
2020-04-25 9:45 ` Alexander Potapenko
2020-03-25 17:43 ` Michal Hocko
2020-03-25 16:12 ` [PATCH v5 04/38] kmsan: introduce __no_sanitize_memory and __SANITIZE_MEMORY__ glider
2020-03-30 13:37 ` Andrey Konovalov
2020-03-25 16:12 ` [PATCH v5 05/38] kmsan: reduce vmalloc space glider
2020-03-30 13:48 ` Andrey Konovalov
2020-04-14 14:21 ` Alexander Potapenko
2020-04-23 19:14 ` Andrey Konovalov
2020-03-25 16:12 ` [PATCH v5 06/38] kmsan: add KMSAN runtime core glider
2020-03-25 16:12 ` [PATCH v5 07/38] kmsan: KMSAN compiler API implementation glider
2020-03-25 16:12 ` [PATCH v5 08/38] kmsan: add KMSAN hooks for kernel subsystems glider
2020-03-25 16:12 ` [PATCH v5 09/38] kmsan: stackdepot: don't allocate KMSAN metadata for stackdepot glider
2020-04-23 19:22 ` Andrey Konovalov
2020-04-25 9:46 ` Alexander Potapenko
2020-03-25 16:12 ` [PATCH v5 10/38] kmsan: define READ_ONCE_NOCHECK() glider
2020-04-23 19:20 ` Andrey Konovalov
2020-03-25 16:12 ` [PATCH v5 11/38] kmsan: make READ_ONCE_TASK_STACK() return initialized values glider
2020-04-23 19:15 ` Andrey Konovalov
2020-04-23 19:18 ` Andrey Konovalov
2020-03-25 16:12 ` [PATCH v5 12/38] kmsan: x86: sync metadata pages on page fault glider
2020-04-23 19:15 ` Andrey Konovalov
2020-03-25 16:12 ` [PATCH v5 13/38] kmsan: add tests for KMSAN glider
2020-04-23 19:02 ` Andrey Konovalov
2020-03-25 16:12 ` [PATCH v5 14/38] crypto: kmsan: disable accelerated configs under KMSAN glider
2020-04-23 18:50 ` Andrey Konovalov
2020-03-25 16:12 ` [PATCH v5 15/38] kmsan: x86: disable UNWINDER_ORC " glider
2020-04-14 17:52 ` Andrey Konovalov
2020-03-25 16:12 ` [PATCH v5 16/38] kmsan: x86/asm: softirq: add KMSAN IRQ entry hooks glider
2020-04-14 17:54 ` Andrey Konovalov
2020-03-25 16:12 ` [PATCH v5 17/38] kmsan: disable KMSAN instrumentation for certain kernel parts glider
2020-04-14 17:56 ` Andrey Konovalov
2020-03-25 16:12 ` [PATCH v5 18/38] kmsan: mm: call KMSAN hooks from SLUB code glider
2020-03-25 16:12 ` [PATCH v5 19/38] kmsan: mm: maintain KMSAN metadata for page operations glider
2020-03-25 16:12 ` [PATCH v5 20/38] kmsan: handle memory sent to/from USB glider
2020-04-14 14:46 ` Andrey Konovalov
2020-04-14 15:50 ` Alan Stern
2020-04-14 17:48 ` Andrey Konovalov
2020-04-14 20:45 ` Alan Stern
2020-04-27 13:59 ` Alexander Potapenko
2020-03-25 16:12 ` [PATCH v5 21/38] kmsan: handle task creation and exiting glider
2020-03-25 16:12 ` [PATCH v5 22/38] kmsan: net: check the value of skb before sending it to the network glider
2020-04-27 14:02 ` Alexander Potapenko
2020-03-25 16:12 ` [PATCH v5 23/38] kmsan: printk: treat the result of vscnprintf() as initialized glider
2020-04-14 14:37 ` Andrey Konovalov
2020-03-25 16:12 ` [PATCH v5 24/38] kmsan: disable instrumentation of certain functions glider
2020-04-14 15:04 ` Andrey Konovalov [this message]
2020-03-25 16:12 ` [PATCH v5 25/38] kmsan: unpoison |tlb| in arch_tlb_gather_mmu() glider
2020-04-08 16:07 ` Andrey Konovalov
2020-03-25 16:12 ` [PATCH v5 26/38] kmsan: use __msan_ string functions where possible glider
2020-03-25 16:12 ` [PATCH v5 27/38] kmsan: hooks for copy_to_user() and friends glider
2020-03-25 16:12 ` [PATCH v5 28/38] kmsan: init: call KMSAN initialization routines glider
2020-04-08 16:04 ` Andrey Konovalov
2020-03-25 16:12 ` [PATCH v5 29/38] kmsan: enable KMSAN builds glider
2020-04-14 14:56 ` Andrey Konovalov
2020-03-25 16:12 ` [PATCH v5 30/38] kmsan: handle /dev/[u]random glider
2020-04-08 16:03 ` Andrey Konovalov
2020-03-25 16:12 ` [PATCH v5 31/38] kmsan: virtio: check/unpoison scatterlist in vring_map_one_sg() glider
2020-03-25 16:12 ` [PATCH v5 32/38] kmsan: disable strscpy() optimization under KMSAN glider
2020-04-08 16:00 ` Andrey Konovalov
2020-04-13 14:19 ` Alexander Potapenko
2020-04-13 15:32 ` Steven Rostedt
2020-04-13 16:16 ` Alexander Potapenko
2020-03-25 16:12 ` [PATCH v5 33/38] kmsan: add iomap support glider
2020-04-08 15:57 ` Andrey Konovalov
2020-03-25 16:12 ` [PATCH v5 34/38] kmsan: dma: unpoison memory mapped by dma_direct_map_page() glider
2020-03-25 16:19 ` Christoph Hellwig
2020-03-27 17:03 ` Alexander Potapenko
2020-03-27 17:06 ` Christoph Hellwig
2020-03-27 18:46 ` Alexander Potapenko
2020-03-28 8:52 ` Christoph Hellwig
2020-04-14 15:26 ` Alexander Potapenko
2020-03-25 16:12 ` [PATCH v5 35/38] kmsan: disable physical page merging in biovec glider
2020-03-25 16:12 ` [PATCH v5 36/38] x86: kasan: kmsan: support CONFIG_GENERIC_CSUM on x86, enable it for KASAN/KMSAN glider
2020-04-08 15:53 ` Andrey Konovalov
2020-03-25 16:12 ` [PATCH v5 37/38] kmsan: x86/uprobes: unpoison regs in arch_uprobe_exception_notify() glider
2020-03-25 16:12 ` [PATCH v5 38/38] kmsan: block: skip bio block merging logic for KMSAN glider
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=CAAeHK+yZToxgChthLdN_VTJPfdu9oCm2ZXfHqwq6JUW+MXWR5g@mail.gmail.com \
--to=andreyknvl@google.com \
--cc=adilger.kernel@dilger.ca \
--cc=akpm@linux-foundation.org \
--cc=ard.biesheuvel@linaro.org \
--cc=arnd@arndb.de \
--cc=aryabinin@virtuozzo.com \
--cc=axboe@kernel.dk \
--cc=cai@lca.pw \
--cc=darrick.wong@oracle.com \
--cc=davem@davemloft.net \
--cc=dmitry.torokhov@gmail.com \
--cc=dvyukov@google.com \
--cc=ebiggers@google.com \
--cc=edumazet@google.com \
--cc=elver@google.com \
--cc=ericvh@gmail.com \
--cc=glider@google.com \
--cc=gor@linux.ibm.com \
--cc=gregkh@linuxfoundation.org \
--cc=harry.wentland@amd.com \
--cc=hch@infradead.org \
--cc=hch@lst.de \
--cc=herbert@gondor.apana.org.au \
--cc=iii@linux.ibm.com \
--cc=jasowang@redhat.com \
--cc=linux-mm@kvack.org \
--cc=luto@kernel.org \
--cc=m.szyprowski@samsung.com \
--cc=mark.rutland@arm.com \
--cc=martin.petersen@oracle.com \
--cc=mhocko@suse.com \
--cc=mingo@elte.hu \
--cc=monstr@monstr.eu \
--cc=mst@redhat.com \
--cc=pmladek@suse.com \
--cc=rdunlap@infradead.org \
--cc=robin.murphy@arm.com \
--cc=rostedt@goodmis.org \
--cc=schwidefsky@de.ibm.com \
--cc=sergey.senozhatsky@gmail.com \
--cc=tglx@linutronix.de \
--cc=tiwai@suse.com \
--cc=tytso@mit.edu \
--cc=vegard.nossum@oracle.com \
--cc=viro@zeniv.linux.org.uk \
--cc=willy@infradead.org \
--cc=wsa@the-dreams.de \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).