All of lore.kernel.org
 help / color / mirror / Atom feed
* [PATCH] arm64: disable kasan when accessing frame->fp in unwind_frame
@ 2016-02-05 23:04 ` Yang Shi
  0 siblings, 0 replies; 6+ messages in thread
From: Yang Shi @ 2016-02-05 23:04 UTC (permalink / raw)
  To: aryabinin, Will.Deacon, Catalin.Marinas
  Cc: linux-kernel, linux-arm-kernel, linaro-kernel, yang.shi

When boot arm64 kernel with KASAN enabled, the below error is reported by
kasan:

BUG: KASAN: out-of-bounds in unwind_frame+0xec/0x260 at addr ffffffc064d57ba0
Read of size 8 by task pidof/499
page:ffffffbdc39355c0 count:0 mapcount:0 mapping:          (null) index:0x0
flags: 0x0()
page dumped because: kasan: bad access detected
CPU: 2 PID: 499 Comm: pidof Not tainted 4.5.0-rc1 #119
Hardware name: Freescale Layerscape 2085a RDB Board (DT)
Call trace:
[<ffffffc00008d078>] dump_backtrace+0x0/0x290
[<ffffffc00008d32c>] show_stack+0x24/0x30
[<ffffffc0006a981c>] dump_stack+0x8c/0xd8
[<ffffffc0002e4400>] kasan_report_error+0x558/0x588
[<ffffffc0002e4958>] kasan_report+0x60/0x70
[<ffffffc0002e3188>] __asan_load8+0x60/0x78
[<ffffffc00008c92c>] unwind_frame+0xec/0x260
[<ffffffc000087e60>] get_wchan+0x110/0x160
[<ffffffc0003b647c>] do_task_stat+0xb44/0xb68
[<ffffffc0003b7730>] proc_tgid_stat+0x40/0x50
[<ffffffc0003ac840>] proc_single_show+0x88/0xd8
[<ffffffc000345be8>] seq_read+0x370/0x770
[<ffffffc00030aba0>] __vfs_read+0xc8/0x1d8
[<ffffffc00030c0ec>] vfs_read+0x94/0x168
[<ffffffc00030d458>] SyS_read+0xb8/0x128
[<ffffffc000086530>] el0_svc_naked+0x24/0x28
Memory state around the buggy address:
 ffffffc064d57a80: 00 00 00 00 00 00 00 00 f1 f1 f1 f1 00 00 f4 f4
 ffffffc064d57b00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
>ffffffc064d57b80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
                                  ^
 ffffffc064d57c00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 ffffffc064d57c80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Since the shadow byte pointed by the report is 0, so it may mean it is just hit
oob in non-current task. So, disable the instrumentation here.

Signed-off-by: Yang Shi <yang.shi@linaro.org>
---
 arch/arm64/kernel/stacktrace.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/arch/arm64/kernel/stacktrace.c b/arch/arm64/kernel/stacktrace.c
index 4fad978..88278c2 100644
--- a/arch/arm64/kernel/stacktrace.c
+++ b/arch/arm64/kernel/stacktrace.c
@@ -20,6 +20,7 @@
 #include <linux/ftrace.h>
 #include <linux/sched.h>
 #include <linux/stacktrace.h>
+#include <linux/kasan.h>
 
 #include <asm/irq.h>
 #include <asm/stacktrace.h>
@@ -64,7 +65,9 @@ int notrace unwind_frame(struct task_struct *tsk, struct stackframe *frame)
 		return -EINVAL;
 
 	frame->sp = fp + 0x10;
+	kasan_disable_current();
 	frame->fp = *(unsigned long *)(fp);
+	kasan_enable_current();
 	frame->pc = *(unsigned long *)(fp + 8);
 
 #ifdef CONFIG_FUNCTION_GRAPH_TRACER
-- 
2.0.2

^ permalink raw reply related	[flat|nested] 6+ messages in thread
* [PATCH] arm64: disable kasan when accessing frame->fp in unwind_frame
@ 2016-02-05 23:04 ` Yang Shi
  0 siblings, 0 replies; 6+ messages in thread
From: Yang Shi @ 2016-02-05 23:04 UTC (permalink / raw)
  To: linux-arm-kernel

When boot arm64 kernel with KASAN enabled, the below error is reported by
kasan:

BUG: KASAN: out-of-bounds in unwind_frame+0xec/0x260 at addr ffffffc064d57ba0
Read of size 8 by task pidof/499
page:ffffffbdc39355c0 count:0 mapcount:0 mapping:          (null) index:0x0
flags: 0x0()
page dumped because: kasan: bad access detected
CPU: 2 PID: 499 Comm: pidof Not tainted 4.5.0-rc1 #119
Hardware name: Freescale Layerscape 2085a RDB Board (DT)
Call trace:
[<ffffffc00008d078>] dump_backtrace+0x0/0x290
[<ffffffc00008d32c>] show_stack+0x24/0x30
[<ffffffc0006a981c>] dump_stack+0x8c/0xd8
[<ffffffc0002e4400>] kasan_report_error+0x558/0x588
[<ffffffc0002e4958>] kasan_report+0x60/0x70
[<ffffffc0002e3188>] __asan_load8+0x60/0x78
[<ffffffc00008c92c>] unwind_frame+0xec/0x260
[<ffffffc000087e60>] get_wchan+0x110/0x160
[<ffffffc0003b647c>] do_task_stat+0xb44/0xb68
[<ffffffc0003b7730>] proc_tgid_stat+0x40/0x50
[<ffffffc0003ac840>] proc_single_show+0x88/0xd8
[<ffffffc000345be8>] seq_read+0x370/0x770
[<ffffffc00030aba0>] __vfs_read+0xc8/0x1d8
[<ffffffc00030c0ec>] vfs_read+0x94/0x168
[<ffffffc00030d458>] SyS_read+0xb8/0x128
[<ffffffc000086530>] el0_svc_naked+0x24/0x28
Memory state around the buggy address:
 ffffffc064d57a80: 00 00 00 00 00 00 00 00 f1 f1 f1 f1 00 00 f4 f4
 ffffffc064d57b00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
>ffffffc064d57b80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
                                  ^
 ffffffc064d57c00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 ffffffc064d57c80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Since the shadow byte pointed by the report is 0, so it may mean it is just hit
oob in non-current task. So, disable the instrumentation here.

Signed-off-by: Yang Shi <yang.shi@linaro.org>
---
 arch/arm64/kernel/stacktrace.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/arch/arm64/kernel/stacktrace.c b/arch/arm64/kernel/stacktrace.c
index 4fad978..88278c2 100644
--- a/arch/arm64/kernel/stacktrace.c
+++ b/arch/arm64/kernel/stacktrace.c
@@ -20,6 +20,7 @@
 #include <linux/ftrace.h>
 #include <linux/sched.h>
 #include <linux/stacktrace.h>
+#include <linux/kasan.h>
 
 #include <asm/irq.h>
 #include <asm/stacktrace.h>
@@ -64,7 +65,9 @@ int notrace unwind_frame(struct task_struct *tsk, struct stackframe *frame)
 		return -EINVAL;
 
 	frame->sp = fp + 0x10;
+	kasan_disable_current();
 	frame->fp = *(unsigned long *)(fp);
+	kasan_enable_current();
 	frame->pc = *(unsigned long *)(fp + 8);
 
 #ifdef CONFIG_FUNCTION_GRAPH_TRACER
-- 
2.0.2

^ permalink raw reply related	[flat|nested] 6+ messages in thread
* Re: [PATCH] arm64: disable kasan when accessing frame->fp in unwind_frame
  2016-02-05 23:04 ` Yang Shi
@ 2016-02-08  8:51   ` Andrey Ryabinin
  -1 siblings, 0 replies; 6+ messages in thread
From: Andrey Ryabinin @ 2016-02-08  8:51 UTC (permalink / raw)
  To: Yang Shi, Will.Deacon, Catalin.Marinas
  Cc: linux-kernel, linux-arm-kernel, linaro-kernel



On 02/06/2016 02:04 AM, Yang Shi wrote:
>  
>  #include <asm/irq.h>
>  #include <asm/stacktrace.h>
> @@ -64,7 +65,9 @@ int notrace unwind_frame(struct task_struct *tsk, struct stackframe *frame)
>  		return -EINVAL;
>  
>  	frame->sp = fp + 0x10;
> +	kasan_disable_current();
>  	frame->fp = *(unsigned long *)(fp);

It would be better to use READ_ONCE_NOCHECK() here.
See f7d27c35ddff7 ("x86/mm, kasan: Silence KASAN warnings in get_wchan()") which solves the same problem for x86.

> +	kasan_enable_current();
>  	frame->pc = *(unsigned long *)(fp + 8);

Why you left frame->pc out of scope? This line could trigger kasan as well.

>  
>  #ifdef CONFIG_FUNCTION_GRAPH_TRACER
> 

^ permalink raw reply	[flat|nested] 6+ messages in thread
* [PATCH] arm64: disable kasan when accessing frame->fp in unwind_frame
@ 2016-02-08  8:51   ` Andrey Ryabinin
  0 siblings, 0 replies; 6+ messages in thread
From: Andrey Ryabinin @ 2016-02-08  8:51 UTC (permalink / raw)
  To: linux-arm-kernel



On 02/06/2016 02:04 AM, Yang Shi wrote:
>  
>  #include <asm/irq.h>
>  #include <asm/stacktrace.h>
> @@ -64,7 +65,9 @@ int notrace unwind_frame(struct task_struct *tsk, struct stackframe *frame)
>  		return -EINVAL;
>  
>  	frame->sp = fp + 0x10;
> +	kasan_disable_current();
>  	frame->fp = *(unsigned long *)(fp);

It would be better to use READ_ONCE_NOCHECK() here.
See f7d27c35ddff7 ("x86/mm, kasan: Silence KASAN warnings in get_wchan()") which solves the same problem for x86.

> +	kasan_enable_current();
>  	frame->pc = *(unsigned long *)(fp + 8);

Why you left frame->pc out of scope? This line could trigger kasan as well.

>  
>  #ifdef CONFIG_FUNCTION_GRAPH_TRACER
> 

^ permalink raw reply	[flat|nested] 6+ messages in thread
* Re: [PATCH] arm64: disable kasan when accessing frame->fp in unwind_frame
  2016-02-08  8:51   ` Andrey Ryabinin
@ 2016-02-08 17:12     ` Shi, Yang
  -1 siblings, 0 replies; 6+ messages in thread
From: Shi, Yang @ 2016-02-08 17:12 UTC (permalink / raw)
  To: Andrey Ryabinin, Will.Deacon, Catalin.Marinas
  Cc: linux-kernel, linux-arm-kernel, linaro-kernel

On 2/8/2016 12:51 AM, Andrey Ryabinin wrote:
>
>
> On 02/06/2016 02:04 AM, Yang Shi wrote:
>>
>>   #include <asm/irq.h>
>>   #include <asm/stacktrace.h>
>> @@ -64,7 +65,9 @@ int notrace unwind_frame(struct task_struct *tsk, struct stackframe *frame)
>>   		return -EINVAL;
>>
>>   	frame->sp = fp + 0x10;
>> +	kasan_disable_current();
>>   	frame->fp = *(unsigned long *)(fp);
>
> It would be better to use READ_ONCE_NOCHECK() here.
> See f7d27c35ddff7 ("x86/mm, kasan: Silence KASAN warnings in get_wchan()") which solves the same problem for x86.

Thanks for the suggestion, I'm going to try it soon.

>
>> +	kasan_enable_current();
>>   	frame->pc = *(unsigned long *)(fp + 8);
>
> Why you left frame->pc out of scope? This line could trigger kasan as well.

Actually, it was not reported as frequently as the first one. In my 
first a couple of boot test, it was not triggered before I came up with 
the patch. The first one is triggered every time.

It will be fixed in v2 too.

Thanks,
Yang

>
>>
>>   #ifdef CONFIG_FUNCTION_GRAPH_TRACER
>>

^ permalink raw reply	[flat|nested] 6+ messages in thread
* [PATCH] arm64: disable kasan when accessing frame->fp in unwind_frame
@ 2016-02-08 17:12     ` Shi, Yang
  0 siblings, 0 replies; 6+ messages in thread
From: Shi, Yang @ 2016-02-08 17:12 UTC (permalink / raw)
  To: linux-arm-kernel

On 2/8/2016 12:51 AM, Andrey Ryabinin wrote:
>
>
> On 02/06/2016 02:04 AM, Yang Shi wrote:
>>
>>   #include <asm/irq.h>
>>   #include <asm/stacktrace.h>
>> @@ -64,7 +65,9 @@ int notrace unwind_frame(struct task_struct *tsk, struct stackframe *frame)
>>   		return -EINVAL;
>>
>>   	frame->sp = fp + 0x10;
>> +	kasan_disable_current();
>>   	frame->fp = *(unsigned long *)(fp);
>
> It would be better to use READ_ONCE_NOCHECK() here.
> See f7d27c35ddff7 ("x86/mm, kasan: Silence KASAN warnings in get_wchan()") which solves the same problem for x86.

Thanks for the suggestion, I'm going to try it soon.

>
>> +	kasan_enable_current();
>>   	frame->pc = *(unsigned long *)(fp + 8);
>
> Why you left frame->pc out of scope? This line could trigger kasan as well.

Actually, it was not reported as frequently as the first one. In my 
first a couple of boot test, it was not triggered before I came up with 
the patch. The first one is triggered every time.

It will be fixed in v2 too.

Thanks,
Yang

>
>>
>>   #ifdef CONFIG_FUNCTION_GRAPH_TRACER
>>

^ permalink raw reply	[flat|nested] 6+ messages in thread
end of thread, other threads:[~2016-02-08 17:12 UTC | newest]

Thread overview: 6+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2016-02-05 23:04 [PATCH] arm64: disable kasan when accessing frame->fp in unwind_frame Yang Shi
2016-02-05 23:04 ` Yang Shi
2016-02-08  8:51 ` Andrey Ryabinin
2016-02-08  8:51   ` Andrey Ryabinin
2016-02-08 17:12   ` Shi, Yang
2016-02-08 17:12     ` Shi, Yang

This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.