* [PATCH v3 0/2] kasan: Fix metadata detection for KASAN_HW_TAGS
@ 2021-01-22 14:37 ` Vincenzo Frascino
0 siblings, 0 replies; 12+ messages in thread
From: Vincenzo Frascino @ 2021-01-22 14:37 UTC (permalink / raw)
To: linux-arm-kernel, linux-kernel, kasan-dev
Cc: Vincenzo Frascino, Andrey Ryabinin, Alexander Potapenko,
Dmitry Vyukov, Leon Romanovsky, Andrey Konovalov,
Catalin Marinas, Will Deacon, Mark Rutland, Paul E . McKenney,
Naresh Kamboju
With the introduction of KASAN_HW_TAGS, kasan_report() currently assumes
that every location in memory has valid metadata associated. This is due
to the fact that addr_has_metadata() returns always true.
As a consequence of this, an invalid address (e.g. NULL pointer address)
passed to kasan_report() when KASAN_HW_TAGS is enabled, leads to a
kernel panic.
Example below, based on arm64:
==================================================================
BUG: KASAN: invalid-access in 0x0
Read at addr 0000000000000000 by task swapper/0/1
Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000
Mem abort info:
ESR = 0x96000004
EC = 0x25: DABT (current EL), IL = 32 bits
SET = 0, FnV = 0
EA = 0, S1PTW = 0
Data abort info:
ISV = 0, ISS = 0x00000004
CM = 0, WnR = 0
...
Call trace:
mte_get_mem_tag+0x24/0x40
kasan_report+0x1a4/0x410
alsa_sound_last_init+0x8c/0xa4
do_one_initcall+0x50/0x1b0
kernel_init_freeable+0x1d4/0x23c
kernel_init+0x14/0x118
ret_from_fork+0x10/0x34
Code: d65f03c0 9000f021 f9428021 b6cfff61 (d9600000)
---[ end trace 377c8bb45bdd3a1a ]---
hrtimer: interrupt took 48694256 ns
note: swapper/0[1] exited with preempt_count 1
Kernel panic - not syncing: Attempted to kill init! exitcode=0x0000000b
SMP: stopping secondary CPUs
Kernel Offset: 0x35abaf140000 from 0xffff800010000000
PHYS_OFFSET: 0x40000000
CPU features: 0x0a7e0152,61c0a030
Memory Limit: none
---[ end Kernel panic - not syncing: Attempted to kill init! exitcode=0x0000000b ]---
This series fixes the behavior of addr_has_metadata() that now returns
true only when the address is valid.
Cc: Andrey Ryabinin <aryabinin@virtuozzo.com>
Cc: Alexander Potapenko <glider@google.com>
Cc: Dmitry Vyukov <dvyukov@google.com>
Cc: Leon Romanovsky <leonro@mellanox.com>
Cc: Andrey Konovalov <andreyknvl@google.com>
Cc: Catalin Marinas <catalin.marinas@arm.com>
Cc: Will Deacon <will@kernel.org>
Cc: Mark Rutland <mark.rutland@arm.com>
Cc: Paul E. McKenney <paulmck@kernel.org>
Cc: Naresh Kamboju <naresh.kamboju@linaro.org>
Signed-off-by: Vincenzo Frascino <vincenzo.frascino@arm.com>
Vincenzo Frascino (2):
arm64: Improve kernel address detection of __is_lm_address()
kasan: Add explicit preconditions to kasan_report()
arch/arm64/include/asm/memory.h | 6 ++++--
include/linux/kasan.h | 7 +++++++
mm/kasan/kasan.h | 2 +-
3 files changed, 12 insertions(+), 3 deletions(-)
--
2.30.0
^ permalink raw reply [flat|nested] 12+ messages in thread
* [PATCH v3 0/2] kasan: Fix metadata detection for KASAN_HW_TAGS
@ 2021-01-22 14:37 ` Vincenzo Frascino
0 siblings, 0 replies; 12+ messages in thread
From: Vincenzo Frascino @ 2021-01-22 14:37 UTC (permalink / raw)
To: linux-arm-kernel, linux-kernel, kasan-dev
Cc: Mark Rutland, Paul E . McKenney, Andrey Konovalov,
Naresh Kamboju, Leon Romanovsky, Alexander Potapenko,
Catalin Marinas, Andrey Ryabinin, Vincenzo Frascino, Will Deacon,
Dmitry Vyukov
With the introduction of KASAN_HW_TAGS, kasan_report() currently assumes
that every location in memory has valid metadata associated. This is due
to the fact that addr_has_metadata() returns always true.
As a consequence of this, an invalid address (e.g. NULL pointer address)
passed to kasan_report() when KASAN_HW_TAGS is enabled, leads to a
kernel panic.
Example below, based on arm64:
==================================================================
BUG: KASAN: invalid-access in 0x0
Read at addr 0000000000000000 by task swapper/0/1
Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000
Mem abort info:
ESR = 0x96000004
EC = 0x25: DABT (current EL), IL = 32 bits
SET = 0, FnV = 0
EA = 0, S1PTW = 0
Data abort info:
ISV = 0, ISS = 0x00000004
CM = 0, WnR = 0
...
Call trace:
mte_get_mem_tag+0x24/0x40
kasan_report+0x1a4/0x410
alsa_sound_last_init+0x8c/0xa4
do_one_initcall+0x50/0x1b0
kernel_init_freeable+0x1d4/0x23c
kernel_init+0x14/0x118
ret_from_fork+0x10/0x34
Code: d65f03c0 9000f021 f9428021 b6cfff61 (d9600000)
---[ end trace 377c8bb45bdd3a1a ]---
hrtimer: interrupt took 48694256 ns
note: swapper/0[1] exited with preempt_count 1
Kernel panic - not syncing: Attempted to kill init! exitcode=0x0000000b
SMP: stopping secondary CPUs
Kernel Offset: 0x35abaf140000 from 0xffff800010000000
PHYS_OFFSET: 0x40000000
CPU features: 0x0a7e0152,61c0a030
Memory Limit: none
---[ end Kernel panic - not syncing: Attempted to kill init! exitcode=0x0000000b ]---
This series fixes the behavior of addr_has_metadata() that now returns
true only when the address is valid.
Cc: Andrey Ryabinin <aryabinin@virtuozzo.com>
Cc: Alexander Potapenko <glider@google.com>
Cc: Dmitry Vyukov <dvyukov@google.com>
Cc: Leon Romanovsky <leonro@mellanox.com>
Cc: Andrey Konovalov <andreyknvl@google.com>
Cc: Catalin Marinas <catalin.marinas@arm.com>
Cc: Will Deacon <will@kernel.org>
Cc: Mark Rutland <mark.rutland@arm.com>
Cc: Paul E. McKenney <paulmck@kernel.org>
Cc: Naresh Kamboju <naresh.kamboju@linaro.org>
Signed-off-by: Vincenzo Frascino <vincenzo.frascino@arm.com>
Vincenzo Frascino (2):
arm64: Improve kernel address detection of __is_lm_address()
kasan: Add explicit preconditions to kasan_report()
arch/arm64/include/asm/memory.h | 6 ++++--
include/linux/kasan.h | 7 +++++++
mm/kasan/kasan.h | 2 +-
3 files changed, 12 insertions(+), 3 deletions(-)
--
2.30.0
_______________________________________________
linux-arm-kernel mailing list
linux-arm-kernel@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-arm-kernel
^ permalink raw reply [flat|nested] 12+ messages in thread
* [PATCH v3 1/2] arm64: Improve kernel address detection of __is_lm_address()
2021-01-22 14:37 ` Vincenzo Frascino
@ 2021-01-22 14:37 ` Vincenzo Frascino
-1 siblings, 0 replies; 12+ messages in thread
From: Vincenzo Frascino @ 2021-01-22 14:37 UTC (permalink / raw)
To: linux-arm-kernel, linux-kernel, kasan-dev
Cc: Vincenzo Frascino, Andrey Ryabinin, Alexander Potapenko,
Dmitry Vyukov, Leon Romanovsky, Andrey Konovalov,
Catalin Marinas, Will Deacon, Mark Rutland, Paul E . McKenney,
Naresh Kamboju
Currently, the __is_lm_address() check just masks out the top 12 bits
of the address, but if they are 0, it still yields a true result.
This has as a side effect that virt_addr_valid() returns true even for
invalid virtual addresses (e.g. 0x0).
Improve the detection checking that it's actually a kernel address
starting at PAGE_OFFSET.
Cc: Catalin Marinas <catalin.marinas@arm.com>
Cc: Will Deacon <will@kernel.org>
Suggested-by: Catalin Marinas <catalin.marinas@arm.com>
Signed-off-by: Vincenzo Frascino <vincenzo.frascino@arm.com>
---
arch/arm64/include/asm/memory.h | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/arch/arm64/include/asm/memory.h b/arch/arm64/include/asm/memory.h
index 18fce223b67b..99d7e1494aaa 100644
--- a/arch/arm64/include/asm/memory.h
+++ b/arch/arm64/include/asm/memory.h
@@ -247,9 +247,11 @@ static inline const void *__tag_set(const void *addr, u8 tag)
/*
- * The linear kernel range starts at the bottom of the virtual address space.
+ * Check whether an arbitrary address is within the linear map, which
+ * lives in the [PAGE_OFFSET, PAGE_END) interval at the bottom of the
+ * kernel's TTBR1 address range.
*/
-#define __is_lm_address(addr) (((u64)(addr) & ~PAGE_OFFSET) < (PAGE_END - PAGE_OFFSET))
+#define __is_lm_address(addr) (((u64)(addr) ^ PAGE_OFFSET) < (PAGE_END - PAGE_OFFSET))
#define __lm_to_phys(addr) (((addr) & ~PAGE_OFFSET) + PHYS_OFFSET)
#define __kimg_to_phys(addr) ((addr) - kimage_voffset)
--
2.30.0
^ permalink raw reply related [flat|nested] 12+ messages in thread
* [PATCH v3 1/2] arm64: Improve kernel address detection of __is_lm_address()
@ 2021-01-22 14:37 ` Vincenzo Frascino
0 siblings, 0 replies; 12+ messages in thread
From: Vincenzo Frascino @ 2021-01-22 14:37 UTC (permalink / raw)
To: linux-arm-kernel, linux-kernel, kasan-dev
Cc: Mark Rutland, Paul E . McKenney, Andrey Konovalov,
Naresh Kamboju, Leon Romanovsky, Alexander Potapenko,
Catalin Marinas, Andrey Ryabinin, Vincenzo Frascino, Will Deacon,
Dmitry Vyukov
Currently, the __is_lm_address() check just masks out the top 12 bits
of the address, but if they are 0, it still yields a true result.
This has as a side effect that virt_addr_valid() returns true even for
invalid virtual addresses (e.g. 0x0).
Improve the detection checking that it's actually a kernel address
starting at PAGE_OFFSET.
Cc: Catalin Marinas <catalin.marinas@arm.com>
Cc: Will Deacon <will@kernel.org>
Suggested-by: Catalin Marinas <catalin.marinas@arm.com>
Signed-off-by: Vincenzo Frascino <vincenzo.frascino@arm.com>
---
arch/arm64/include/asm/memory.h | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/arch/arm64/include/asm/memory.h b/arch/arm64/include/asm/memory.h
index 18fce223b67b..99d7e1494aaa 100644
--- a/arch/arm64/include/asm/memory.h
+++ b/arch/arm64/include/asm/memory.h
@@ -247,9 +247,11 @@ static inline const void *__tag_set(const void *addr, u8 tag)
/*
- * The linear kernel range starts at the bottom of the virtual address space.
+ * Check whether an arbitrary address is within the linear map, which
+ * lives in the [PAGE_OFFSET, PAGE_END) interval at the bottom of the
+ * kernel's TTBR1 address range.
*/
-#define __is_lm_address(addr) (((u64)(addr) & ~PAGE_OFFSET) < (PAGE_END - PAGE_OFFSET))
+#define __is_lm_address(addr) (((u64)(addr) ^ PAGE_OFFSET) < (PAGE_END - PAGE_OFFSET))
#define __lm_to_phys(addr) (((addr) & ~PAGE_OFFSET) + PHYS_OFFSET)
#define __kimg_to_phys(addr) ((addr) - kimage_voffset)
--
2.30.0
_______________________________________________
linux-arm-kernel mailing list
linux-arm-kernel@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-arm-kernel
^ permalink raw reply related [flat|nested] 12+ messages in thread
* [PATCH v3 2/2] kasan: Add explicit preconditions to kasan_report()
2021-01-22 14:37 ` Vincenzo Frascino
@ 2021-01-22 14:37 ` Vincenzo Frascino
-1 siblings, 0 replies; 12+ messages in thread
From: Vincenzo Frascino @ 2021-01-22 14:37 UTC (permalink / raw)
To: linux-arm-kernel, linux-kernel, kasan-dev
Cc: Vincenzo Frascino, Andrey Ryabinin, Alexander Potapenko,
Dmitry Vyukov, Leon Romanovsky, Andrey Konovalov,
Catalin Marinas, Will Deacon, Mark Rutland, Paul E . McKenney,
Naresh Kamboju
With the introduction of KASAN_HW_TAGS, kasan_report() dereferences
the address passed as a parameter.
Add a comment to make sure that the preconditions to the function are
explicitly clarified.
Note: An invalid address (e.g. NULL) passed to the function when,
KASAN_HW_TAGS is enabled, leads to a kernel panic.
Cc: Andrey Ryabinin <aryabinin@virtuozzo.com>
Cc: Alexander Potapenko <glider@google.com>
Cc: Dmitry Vyukov <dvyukov@google.com>
Cc: Leon Romanovsky <leonro@mellanox.com>
Cc: Andrey Konovalov <andreyknvl@google.com>
Signed-off-by: Vincenzo Frascino <vincenzo.frascino@arm.com>
---
include/linux/kasan.h | 7 +++++++
mm/kasan/kasan.h | 2 +-
2 files changed, 8 insertions(+), 1 deletion(-)
diff --git a/include/linux/kasan.h b/include/linux/kasan.h
index fe1ae73ff8b5..0aea9e2a2a01 100644
--- a/include/linux/kasan.h
+++ b/include/linux/kasan.h
@@ -333,6 +333,13 @@ static inline void *kasan_reset_tag(const void *addr)
return (void *)arch_kasan_reset_tag(addr);
}
+/**
+ * kasan_report - print a report about a bad memory access detected by KASAN
+ * @addr: address of the bad access
+ * @size: size of the bad access
+ * @is_write: whether the bad access is a write or a read
+ * @ip: instruction pointer for the accessibility check or the bad access itself
+ */
bool kasan_report(unsigned long addr, size_t size,
bool is_write, unsigned long ip);
diff --git a/mm/kasan/kasan.h b/mm/kasan/kasan.h
index cc4d9e1d49b1..8c706e7652f2 100644
--- a/mm/kasan/kasan.h
+++ b/mm/kasan/kasan.h
@@ -209,7 +209,7 @@ bool check_memory_region(unsigned long addr, size_t size, bool write,
static inline bool addr_has_metadata(const void *addr)
{
- return true;
+ return (is_vmalloc_addr(addr) || virt_addr_valid(addr));
}
#endif /* CONFIG_KASAN_GENERIC || CONFIG_KASAN_SW_TAGS */
--
2.30.0
^ permalink raw reply related [flat|nested] 12+ messages in thread
* [PATCH v3 2/2] kasan: Add explicit preconditions to kasan_report()
@ 2021-01-22 14:37 ` Vincenzo Frascino
0 siblings, 0 replies; 12+ messages in thread
From: Vincenzo Frascino @ 2021-01-22 14:37 UTC (permalink / raw)
To: linux-arm-kernel, linux-kernel, kasan-dev
Cc: Mark Rutland, Paul E . McKenney, Andrey Konovalov,
Naresh Kamboju, Leon Romanovsky, Alexander Potapenko,
Catalin Marinas, Andrey Ryabinin, Vincenzo Frascino, Will Deacon,
Dmitry Vyukov
With the introduction of KASAN_HW_TAGS, kasan_report() dereferences
the address passed as a parameter.
Add a comment to make sure that the preconditions to the function are
explicitly clarified.
Note: An invalid address (e.g. NULL) passed to the function when,
KASAN_HW_TAGS is enabled, leads to a kernel panic.
Cc: Andrey Ryabinin <aryabinin@virtuozzo.com>
Cc: Alexander Potapenko <glider@google.com>
Cc: Dmitry Vyukov <dvyukov@google.com>
Cc: Leon Romanovsky <leonro@mellanox.com>
Cc: Andrey Konovalov <andreyknvl@google.com>
Signed-off-by: Vincenzo Frascino <vincenzo.frascino@arm.com>
---
include/linux/kasan.h | 7 +++++++
mm/kasan/kasan.h | 2 +-
2 files changed, 8 insertions(+), 1 deletion(-)
diff --git a/include/linux/kasan.h b/include/linux/kasan.h
index fe1ae73ff8b5..0aea9e2a2a01 100644
--- a/include/linux/kasan.h
+++ b/include/linux/kasan.h
@@ -333,6 +333,13 @@ static inline void *kasan_reset_tag(const void *addr)
return (void *)arch_kasan_reset_tag(addr);
}
+/**
+ * kasan_report - print a report about a bad memory access detected by KASAN
+ * @addr: address of the bad access
+ * @size: size of the bad access
+ * @is_write: whether the bad access is a write or a read
+ * @ip: instruction pointer for the accessibility check or the bad access itself
+ */
bool kasan_report(unsigned long addr, size_t size,
bool is_write, unsigned long ip);
diff --git a/mm/kasan/kasan.h b/mm/kasan/kasan.h
index cc4d9e1d49b1..8c706e7652f2 100644
--- a/mm/kasan/kasan.h
+++ b/mm/kasan/kasan.h
@@ -209,7 +209,7 @@ bool check_memory_region(unsigned long addr, size_t size, bool write,
static inline bool addr_has_metadata(const void *addr)
{
- return true;
+ return (is_vmalloc_addr(addr) || virt_addr_valid(addr));
}
#endif /* CONFIG_KASAN_GENERIC || CONFIG_KASAN_SW_TAGS */
--
2.30.0
_______________________________________________
linux-arm-kernel mailing list
linux-arm-kernel@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-arm-kernel
^ permalink raw reply related [flat|nested] 12+ messages in thread
* Re: [PATCH v3 2/2] kasan: Add explicit preconditions to kasan_report()
2021-01-22 14:37 ` Vincenzo Frascino
@ 2021-01-22 14:46 ` Andrey Konovalov
-1 siblings, 0 replies; 12+ messages in thread
From: Andrey Konovalov @ 2021-01-22 14:46 UTC (permalink / raw)
To: Vincenzo Frascino
Cc: Linux ARM, LKML, kasan-dev, Andrey Ryabinin, Alexander Potapenko,
Dmitry Vyukov, Leon Romanovsky, Catalin Marinas, Will Deacon,
Mark Rutland, Paul E . McKenney, Naresh Kamboju
On Fri, Jan 22, 2021 at 3:38 PM Vincenzo Frascino
<vincenzo.frascino@arm.com> wrote:
>
> With the introduction of KASAN_HW_TAGS, kasan_report() dereferences
> the address passed as a parameter.
It doesn't dereference the address, it accesses the metadata. And only
when addr_has_metadata() succeeds.
>
> Add a comment to make sure that the preconditions to the function are
> explicitly clarified.
>
> Note: An invalid address (e.g. NULL) passed to the function when,
> KASAN_HW_TAGS is enabled, leads to a kernel panic.
This is no longer true, right? Commit description needs to be updated.
>
> Cc: Andrey Ryabinin <aryabinin@virtuozzo.com>
> Cc: Alexander Potapenko <glider@google.com>
> Cc: Dmitry Vyukov <dvyukov@google.com>
> Cc: Leon Romanovsky <leonro@mellanox.com>
> Cc: Andrey Konovalov <andreyknvl@google.com>
> Signed-off-by: Vincenzo Frascino <vincenzo.frascino@arm.com>
> ---
> include/linux/kasan.h | 7 +++++++
> mm/kasan/kasan.h | 2 +-
> 2 files changed, 8 insertions(+), 1 deletion(-)
>
> diff --git a/include/linux/kasan.h b/include/linux/kasan.h
> index fe1ae73ff8b5..0aea9e2a2a01 100644
> --- a/include/linux/kasan.h
> +++ b/include/linux/kasan.h
> @@ -333,6 +333,13 @@ static inline void *kasan_reset_tag(const void *addr)
> return (void *)arch_kasan_reset_tag(addr);
> }
>
> +/**
> + * kasan_report - print a report about a bad memory access detected by KASAN
> + * @addr: address of the bad access
> + * @size: size of the bad access
> + * @is_write: whether the bad access is a write or a read
> + * @ip: instruction pointer for the accessibility check or the bad access itself
> + */
Looks good, thanks!
> bool kasan_report(unsigned long addr, size_t size,
> bool is_write, unsigned long ip);
>
> diff --git a/mm/kasan/kasan.h b/mm/kasan/kasan.h
> index cc4d9e1d49b1..8c706e7652f2 100644
> --- a/mm/kasan/kasan.h
> +++ b/mm/kasan/kasan.h
> @@ -209,7 +209,7 @@ bool check_memory_region(unsigned long addr, size_t size, bool write,
>
> static inline bool addr_has_metadata(const void *addr)
> {
> - return true;
> + return (is_vmalloc_addr(addr) || virt_addr_valid(addr));
> }
Let's put this change into a separate patch.
>
> #endif /* CONFIG_KASAN_GENERIC || CONFIG_KASAN_SW_TAGS */
> --
> 2.30.0
>
^ permalink raw reply [flat|nested] 12+ messages in thread
* Re: [PATCH v3 2/2] kasan: Add explicit preconditions to kasan_report()
@ 2021-01-22 14:46 ` Andrey Konovalov
0 siblings, 0 replies; 12+ messages in thread
From: Andrey Konovalov @ 2021-01-22 14:46 UTC (permalink / raw)
To: Vincenzo Frascino
Cc: Mark Rutland, Paul E . McKenney, Catalin Marinas, Naresh Kamboju,
LKML, kasan-dev, Leon Romanovsky, Alexander Potapenko, Linux ARM,
Andrey Ryabinin, Will Deacon, Dmitry Vyukov
On Fri, Jan 22, 2021 at 3:38 PM Vincenzo Frascino
<vincenzo.frascino@arm.com> wrote:
>
> With the introduction of KASAN_HW_TAGS, kasan_report() dereferences
> the address passed as a parameter.
It doesn't dereference the address, it accesses the metadata. And only
when addr_has_metadata() succeeds.
>
> Add a comment to make sure that the preconditions to the function are
> explicitly clarified.
>
> Note: An invalid address (e.g. NULL) passed to the function when,
> KASAN_HW_TAGS is enabled, leads to a kernel panic.
This is no longer true, right? Commit description needs to be updated.
>
> Cc: Andrey Ryabinin <aryabinin@virtuozzo.com>
> Cc: Alexander Potapenko <glider@google.com>
> Cc: Dmitry Vyukov <dvyukov@google.com>
> Cc: Leon Romanovsky <leonro@mellanox.com>
> Cc: Andrey Konovalov <andreyknvl@google.com>
> Signed-off-by: Vincenzo Frascino <vincenzo.frascino@arm.com>
> ---
> include/linux/kasan.h | 7 +++++++
> mm/kasan/kasan.h | 2 +-
> 2 files changed, 8 insertions(+), 1 deletion(-)
>
> diff --git a/include/linux/kasan.h b/include/linux/kasan.h
> index fe1ae73ff8b5..0aea9e2a2a01 100644
> --- a/include/linux/kasan.h
> +++ b/include/linux/kasan.h
> @@ -333,6 +333,13 @@ static inline void *kasan_reset_tag(const void *addr)
> return (void *)arch_kasan_reset_tag(addr);
> }
>
> +/**
> + * kasan_report - print a report about a bad memory access detected by KASAN
> + * @addr: address of the bad access
> + * @size: size of the bad access
> + * @is_write: whether the bad access is a write or a read
> + * @ip: instruction pointer for the accessibility check or the bad access itself
> + */
Looks good, thanks!
> bool kasan_report(unsigned long addr, size_t size,
> bool is_write, unsigned long ip);
>
> diff --git a/mm/kasan/kasan.h b/mm/kasan/kasan.h
> index cc4d9e1d49b1..8c706e7652f2 100644
> --- a/mm/kasan/kasan.h
> +++ b/mm/kasan/kasan.h
> @@ -209,7 +209,7 @@ bool check_memory_region(unsigned long addr, size_t size, bool write,
>
> static inline bool addr_has_metadata(const void *addr)
> {
> - return true;
> + return (is_vmalloc_addr(addr) || virt_addr_valid(addr));
> }
Let's put this change into a separate patch.
>
> #endif /* CONFIG_KASAN_GENERIC || CONFIG_KASAN_SW_TAGS */
> --
> 2.30.0
>
_______________________________________________
linux-arm-kernel mailing list
linux-arm-kernel@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-arm-kernel
^ permalink raw reply [flat|nested] 12+ messages in thread
* Re: [PATCH v3 1/2] arm64: Improve kernel address detection of __is_lm_address()
2021-01-22 14:37 ` Vincenzo Frascino
@ 2021-01-22 14:49 ` Catalin Marinas
-1 siblings, 0 replies; 12+ messages in thread
From: Catalin Marinas @ 2021-01-22 14:49 UTC (permalink / raw)
To: Vincenzo Frascino
Cc: linux-arm-kernel, linux-kernel, kasan-dev, Andrey Ryabinin,
Alexander Potapenko, Dmitry Vyukov, Leon Romanovsky,
Andrey Konovalov, Will Deacon, Mark Rutland, Paul E . McKenney,
Naresh Kamboju
On Fri, Jan 22, 2021 at 02:37:47PM +0000, Vincenzo Frascino wrote:
> Currently, the __is_lm_address() check just masks out the top 12 bits
> of the address, but if they are 0, it still yields a true result.
> This has as a side effect that virt_addr_valid() returns true even for
> invalid virtual addresses (e.g. 0x0).
>
> Improve the detection checking that it's actually a kernel address
> starting at PAGE_OFFSET.
>
> Cc: Catalin Marinas <catalin.marinas@arm.com>
> Cc: Will Deacon <will@kernel.org>
> Suggested-by: Catalin Marinas <catalin.marinas@arm.com>
> Signed-off-by: Vincenzo Frascino <vincenzo.frascino@arm.com>
Reviewed-by: Catalin Marinas <catalin.marinas@arm.com>
The question is whether we leave this for 5.12 or we merge it earlier.
--
Catalin
^ permalink raw reply [flat|nested] 12+ messages in thread
* Re: [PATCH v3 1/2] arm64: Improve kernel address detection of __is_lm_address()
@ 2021-01-22 14:49 ` Catalin Marinas
0 siblings, 0 replies; 12+ messages in thread
From: Catalin Marinas @ 2021-01-22 14:49 UTC (permalink / raw)
To: Vincenzo Frascino
Cc: Mark Rutland, Paul E . McKenney, Andrey Konovalov,
Naresh Kamboju, linux-kernel, kasan-dev, Leon Romanovsky,
Alexander Potapenko, linux-arm-kernel, Andrey Ryabinin,
Will Deacon, Dmitry Vyukov
On Fri, Jan 22, 2021 at 02:37:47PM +0000, Vincenzo Frascino wrote:
> Currently, the __is_lm_address() check just masks out the top 12 bits
> of the address, but if they are 0, it still yields a true result.
> This has as a side effect that virt_addr_valid() returns true even for
> invalid virtual addresses (e.g. 0x0).
>
> Improve the detection checking that it's actually a kernel address
> starting at PAGE_OFFSET.
>
> Cc: Catalin Marinas <catalin.marinas@arm.com>
> Cc: Will Deacon <will@kernel.org>
> Suggested-by: Catalin Marinas <catalin.marinas@arm.com>
> Signed-off-by: Vincenzo Frascino <vincenzo.frascino@arm.com>
Reviewed-by: Catalin Marinas <catalin.marinas@arm.com>
The question is whether we leave this for 5.12 or we merge it earlier.
--
Catalin
_______________________________________________
linux-arm-kernel mailing list
linux-arm-kernel@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-arm-kernel
^ permalink raw reply [flat|nested] 12+ messages in thread
* Re: [PATCH v3 2/2] kasan: Add explicit preconditions to kasan_report()
2021-01-22 14:46 ` Andrey Konovalov
@ 2021-01-22 14:58 ` Vincenzo Frascino
-1 siblings, 0 replies; 12+ messages in thread
From: Vincenzo Frascino @ 2021-01-22 14:58 UTC (permalink / raw)
To: Andrey Konovalov
Cc: Linux ARM, LKML, kasan-dev, Andrey Ryabinin, Alexander Potapenko,
Dmitry Vyukov, Leon Romanovsky, Catalin Marinas, Will Deacon,
Mark Rutland, Paul E . McKenney, Naresh Kamboju
On 1/22/21 2:46 PM, Andrey Konovalov wrote:
> On Fri, Jan 22, 2021 at 3:38 PM Vincenzo Frascino
> <vincenzo.frascino@arm.com> wrote:
>>
>> With the introduction of KASAN_HW_TAGS, kasan_report() dereferences
>> the address passed as a parameter.
>
> It doesn't dereference the address, it accesses the metadata. And only
> when addr_has_metadata() succeeds.
>
Yes, this is correct. Seems I forgot again to unstash something. Will fix it in v4.
>>
>> Add a comment to make sure that the preconditions to the function are
>> explicitly clarified.
>>
>> Note: An invalid address (e.g. NULL) passed to the function when,
>> KASAN_HW_TAGS is enabled, leads to a kernel panic.
>
> This is no longer true, right? Commit description needs to be updated.
>
>>
>> Cc: Andrey Ryabinin <aryabinin@virtuozzo.com>
>> Cc: Alexander Potapenko <glider@google.com>
>> Cc: Dmitry Vyukov <dvyukov@google.com>
>> Cc: Leon Romanovsky <leonro@mellanox.com>
>> Cc: Andrey Konovalov <andreyknvl@google.com>
>> Signed-off-by: Vincenzo Frascino <vincenzo.frascino@arm.com>
>> ---
>> include/linux/kasan.h | 7 +++++++
>> mm/kasan/kasan.h | 2 +-
>> 2 files changed, 8 insertions(+), 1 deletion(-)
>>
>> diff --git a/include/linux/kasan.h b/include/linux/kasan.h
>> index fe1ae73ff8b5..0aea9e2a2a01 100644
>> --- a/include/linux/kasan.h
>> +++ b/include/linux/kasan.h
>> @@ -333,6 +333,13 @@ static inline void *kasan_reset_tag(const void *addr)
>> return (void *)arch_kasan_reset_tag(addr);
>> }
>>
>> +/**
>> + * kasan_report - print a report about a bad memory access detected by KASAN
>> + * @addr: address of the bad access
>> + * @size: size of the bad access
>> + * @is_write: whether the bad access is a write or a read
>> + * @ip: instruction pointer for the accessibility check or the bad access itself
>> + */
>
> Looks good, thanks!
>
>> bool kasan_report(unsigned long addr, size_t size,
>> bool is_write, unsigned long ip);
>>
>> diff --git a/mm/kasan/kasan.h b/mm/kasan/kasan.h
>> index cc4d9e1d49b1..8c706e7652f2 100644
>> --- a/mm/kasan/kasan.h
>> +++ b/mm/kasan/kasan.h
>> @@ -209,7 +209,7 @@ bool check_memory_region(unsigned long addr, size_t size, bool write,
>>
>> static inline bool addr_has_metadata(const void *addr)
>> {
>> - return true;
>> + return (is_vmalloc_addr(addr) || virt_addr_valid(addr));
>> }
>
> Let's put this change into a separate patch.
>
Ok, it will be done in v4.
>>
>> #endif /* CONFIG_KASAN_GENERIC || CONFIG_KASAN_SW_TAGS */
>> --
>> 2.30.0
>>
--
Regards,
Vincenzo
^ permalink raw reply [flat|nested] 12+ messages in thread
* Re: [PATCH v3 2/2] kasan: Add explicit preconditions to kasan_report()
@ 2021-01-22 14:58 ` Vincenzo Frascino
0 siblings, 0 replies; 12+ messages in thread
From: Vincenzo Frascino @ 2021-01-22 14:58 UTC (permalink / raw)
To: Andrey Konovalov
Cc: Mark Rutland, Paul E . McKenney, Catalin Marinas, Naresh Kamboju,
LKML, kasan-dev, Leon Romanovsky, Alexander Potapenko, Linux ARM,
Andrey Ryabinin, Will Deacon, Dmitry Vyukov
On 1/22/21 2:46 PM, Andrey Konovalov wrote:
> On Fri, Jan 22, 2021 at 3:38 PM Vincenzo Frascino
> <vincenzo.frascino@arm.com> wrote:
>>
>> With the introduction of KASAN_HW_TAGS, kasan_report() dereferences
>> the address passed as a parameter.
>
> It doesn't dereference the address, it accesses the metadata. And only
> when addr_has_metadata() succeeds.
>
Yes, this is correct. Seems I forgot again to unstash something. Will fix it in v4.
>>
>> Add a comment to make sure that the preconditions to the function are
>> explicitly clarified.
>>
>> Note: An invalid address (e.g. NULL) passed to the function when,
>> KASAN_HW_TAGS is enabled, leads to a kernel panic.
>
> This is no longer true, right? Commit description needs to be updated.
>
>>
>> Cc: Andrey Ryabinin <aryabinin@virtuozzo.com>
>> Cc: Alexander Potapenko <glider@google.com>
>> Cc: Dmitry Vyukov <dvyukov@google.com>
>> Cc: Leon Romanovsky <leonro@mellanox.com>
>> Cc: Andrey Konovalov <andreyknvl@google.com>
>> Signed-off-by: Vincenzo Frascino <vincenzo.frascino@arm.com>
>> ---
>> include/linux/kasan.h | 7 +++++++
>> mm/kasan/kasan.h | 2 +-
>> 2 files changed, 8 insertions(+), 1 deletion(-)
>>
>> diff --git a/include/linux/kasan.h b/include/linux/kasan.h
>> index fe1ae73ff8b5..0aea9e2a2a01 100644
>> --- a/include/linux/kasan.h
>> +++ b/include/linux/kasan.h
>> @@ -333,6 +333,13 @@ static inline void *kasan_reset_tag(const void *addr)
>> return (void *)arch_kasan_reset_tag(addr);
>> }
>>
>> +/**
>> + * kasan_report - print a report about a bad memory access detected by KASAN
>> + * @addr: address of the bad access
>> + * @size: size of the bad access
>> + * @is_write: whether the bad access is a write or a read
>> + * @ip: instruction pointer for the accessibility check or the bad access itself
>> + */
>
> Looks good, thanks!
>
>> bool kasan_report(unsigned long addr, size_t size,
>> bool is_write, unsigned long ip);
>>
>> diff --git a/mm/kasan/kasan.h b/mm/kasan/kasan.h
>> index cc4d9e1d49b1..8c706e7652f2 100644
>> --- a/mm/kasan/kasan.h
>> +++ b/mm/kasan/kasan.h
>> @@ -209,7 +209,7 @@ bool check_memory_region(unsigned long addr, size_t size, bool write,
>>
>> static inline bool addr_has_metadata(const void *addr)
>> {
>> - return true;
>> + return (is_vmalloc_addr(addr) || virt_addr_valid(addr));
>> }
>
> Let's put this change into a separate patch.
>
Ok, it will be done in v4.
>>
>> #endif /* CONFIG_KASAN_GENERIC || CONFIG_KASAN_SW_TAGS */
>> --
>> 2.30.0
>>
--
Regards,
Vincenzo
_______________________________________________
linux-arm-kernel mailing list
linux-arm-kernel@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-arm-kernel
^ permalink raw reply [flat|nested] 12+ messages in thread
end of thread, other threads:[~2021-01-22 15:02 UTC | newest]
Thread overview: 12+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2021-01-22 14:37 [PATCH v3 0/2] kasan: Fix metadata detection for KASAN_HW_TAGS Vincenzo Frascino
2021-01-22 14:37 ` Vincenzo Frascino
2021-01-22 14:37 ` [PATCH v3 1/2] arm64: Improve kernel address detection of __is_lm_address() Vincenzo Frascino
2021-01-22 14:37 ` Vincenzo Frascino
2021-01-22 14:49 ` Catalin Marinas
2021-01-22 14:49 ` Catalin Marinas
2021-01-22 14:37 ` [PATCH v3 2/2] kasan: Add explicit preconditions to kasan_report() Vincenzo Frascino
2021-01-22 14:37 ` Vincenzo Frascino
2021-01-22 14:46 ` Andrey Konovalov
2021-01-22 14:46 ` Andrey Konovalov
2021-01-22 14:58 ` Vincenzo Frascino
2021-01-22 14:58 ` Vincenzo Frascino
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.