From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-19.4 required=3.0 tests=DKIMWL_WL_MED,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_PATCH, MAILING_LIST_MULTI,MENTIONS_GIT_HOSTING,SIGNED_OFF_BY,SPF_HELO_NONE,SPF_PASS, URIBL_BLOCKED,USER_IN_DEF_DKIM_WL autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 3BAE8C2BA19 for ; Tue, 14 Apr 2020 17:49:10 +0000 (UTC) Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by mail.kernel.org (Postfix) with ESMTP id F10FC2074D for ; Tue, 14 Apr 2020 17:49:09 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b="q3GBTfca" DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org F10FC2074D Authentication-Results: mail.kernel.org; dmarc=fail (p=reject dis=none) header.from=google.com Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=owner-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix) id 6C4B68E0037; Tue, 14 Apr 2020 13:49:09 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id 6243E8E0001; Tue, 14 Apr 2020 13:49:09 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 4EBCD8E0037; Tue, 14 Apr 2020 13:49:09 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from forelay.hostedemail.com (smtprelay0244.hostedemail.com [216.40.44.244]) by kanga.kvack.org (Postfix) with ESMTP id 333C28E0001 for ; Tue, 14 Apr 2020 13:49:09 -0400 (EDT) Received: from smtpin06.hostedemail.com (10.5.19.251.rfc1918.com [10.5.19.251]) by forelay05.hostedemail.com (Postfix) with ESMTP id D4377181AEF2A for ; Tue, 14 Apr 2020 17:49:08 +0000 (UTC) X-FDA: 76707196776.06.spot90_4fd09907b3025 X-HE-Tag: spot90_4fd09907b3025 X-Filterd-Recvd-Size: 8315 Received: from mail-pj1-f66.google.com (mail-pj1-f66.google.com [209.85.216.66]) by imf50.hostedemail.com (Postfix) with ESMTP for ; Tue, 14 Apr 2020 17:49:08 +0000 (UTC) Received: by mail-pj1-f66.google.com with SMTP id e16so5323735pjp.1 for ; Tue, 14 Apr 2020 10:49:08 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=JcwCp01PpJDrha5lK+lLo/O4JNtmnHl6+twMizsXB6o=; b=q3GBTfcaXM6OmyXj9EaGUofJFplVMDNWCaf3mPaVlAGe2zvbs6GjvXkN1XwaIpzf9n tiIOPWFv75JUjJQ9D1BcGJN96fNKEH62wQXipCFHJ6QMFWGjMW7leVnBnaTN7wVoF1QE 1ELwqQQm5ktkeY2CN8HJyl5FWTGzW86fThPsWKiPrA4/izUQfbVNT/ZuU962vnxYVPqs UEH/zz8MNKl0wd5TqxJbY9ww45eDj3b9VScaIvcUyWR9G+jebk/W7yd6dKhS+/r5lH/9 xGAc8nTLmVOTptYd8L8KvX/8H0OvvkKkiRGV6taqnWNOQ9tM2ezjX5gIIHq2ro2NlvQR dTdw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=JcwCp01PpJDrha5lK+lLo/O4JNtmnHl6+twMizsXB6o=; b=dv4gP7ETHLpmKWgctgzjEeh3g+waXkBAgPP9Rs5yIHbCAALjWdsnHjp18nVoQjuLna efOD5nPiYEX46/WRlAli6NSwrr1philLuX7GZPsXr/fRmC5ColxFIo2sJyJ97vsWqEDl pg8a2NGps1kne7DjhFRx9DQqokUmQGSGrWZacaG0MHWu1J5aPB4ssEm5yj0NboBe4Kaf PBHVennp/r4qu07k81i1HoWZy4+MJL8aEZ2QwIDElYQNG1dK2c1TgvfMZtAm+g1VUS/f VVVf8LvN/f9LqbFmf+wu8kc5q7tqUPbAChvi5x8qrOX7saFCiEbXB/fu7b31CScuWGUO xvpw== X-Gm-Message-State: AGi0PuYo1Bq/VZNXCVBDiNiUTUHxNcf7VcppkC7nm59imsPk/Hu8YNIz REPjFhVZbq9DugsXWwswP0BrgK/9Hhb+qZuUfrttIA== X-Google-Smtp-Source: APiQypLiGsyyrpdi4EolFbQ3eMt0Q+YzgWl8djz64N3AQ8mb9vF3wmLC4guUVIxDCWbyzoe/HKOZ/gahtEEI1VTXHUM= X-Received: by 2002:a17:902:9889:: with SMTP id s9mr965014plp.252.1586886547126; Tue, 14 Apr 2020 10:49:07 -0700 (PDT) MIME-Version: 1.0 References: In-Reply-To: From: Andrey Konovalov Date: Tue, 14 Apr 2020 19:48:55 +0200 Message-ID: Subject: Re: [PATCH v5 20/38] kmsan: handle memory sent to/from USB To: Alan Stern , Alexander Potapenko Cc: Andrew Morton , Greg Kroah-Hartman , Eric Dumazet , Wolfram Sang , Petr Mladek , Vegard Nossum , Dmitry Vyukov , Marco Elver , Linux Memory Management List , Alexander Viro , Andreas Dilger , Andrey Ryabinin , Andy Lutomirski , Ard Biesheuvel , Arnd Bergmann , Christoph Hellwig , Christoph Hellwig , "Darrick J. Wong" , "David S. Miller" , Dmitry Torokhov , Eric Biggers , Eric Van Hensbergen , Harry Wentland , Herbert Xu , Ilya Leoshkevich , Ingo Molnar , Jason Wang , Jens Axboe , Marek Szyprowski , Mark Rutland , "Martin K. Petersen" , Martin Schwidefsky , Matthew Wilcox , "Michael S . Tsirkin" , Michal Hocko , Michal Simek , Qian Cai , Randy Dunlap , Robin Murphy , Sergey Senozhatsky , Steven Rostedt , Takashi Iwai , "Theodore Ts'o" , Thomas Gleixner , Vasily Gorbik Content-Type: text/plain; charset="UTF-8" X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: On Tue, Apr 14, 2020 at 5:50 PM Alan Stern wrote: > > On Tue, 14 Apr 2020, Andrey Konovalov wrote: > > > On Wed, Mar 25, 2020 at 5:14 PM wrote: > > > > > > Depending on the value of is_out kmsan_handle_urb() KMSAN either > > > marks the data copied to the kernel from a USB device as initialized, > > > or checks the data sent to the device for being initialized. > > > > > > Signed-off-by: Alexander Potapenko > > > To: Alexander Potapenko > > > Cc: Andrew Morton > > > Cc: Greg Kroah-Hartman > > > Cc: Eric Dumazet > > > Cc: Wolfram Sang > > > Cc: Petr Mladek > > > Cc: Vegard Nossum > > > Cc: Dmitry Vyukov > > > Cc: Marco Elver > > > Cc: Andrey Konovalov > > > Cc: linux-mm@kvack.org > > > > > > --- > > > > > > This patch was previously called "kmsan: call KMSAN hooks where needed" > > > > > > v4: > > > - split this patch away > > > > > > Change-Id: Idd0f8ce858975112285706ffb7286f570bd3007b > > > --- > > > drivers/usb/core/urb.c | 2 ++ > > > 1 file changed, 2 insertions(+) > > > > > > diff --git a/drivers/usb/core/urb.c b/drivers/usb/core/urb.c > > > index da923ec176122..4a0b0ac0f52f9 100644 > > > --- a/drivers/usb/core/urb.c > > > +++ b/drivers/usb/core/urb.c > > > @@ -8,6 +8,7 @@ > > > #include > > > #include > > > #include > > > +#include > > > #include > > > #include > > > #include > > > @@ -402,6 +403,7 @@ int usb_submit_urb(struct urb *urb, gfp_t mem_flags) > > > URB_SETUP_MAP_SINGLE | URB_SETUP_MAP_LOCAL | > > > URB_DMA_SG_COMBINED); > > > urb->transfer_flags |= (is_out ? URB_DIR_OUT : URB_DIR_IN); > > > + kmsan_handle_urb(urb, is_out); > > > > I guess this could simply accept urb and then check > > urb->transfer_flags instead of also accepting is_out? > > > > Alan, do you think this is a good place for a call to > > kmsan_handle_urb(), which is supposed to check that the memory we pass > > to a USB device is initialized (so we don't leak uninitialized memory) > > and mark memory received from the device as initialized? You can find > > the implementation here: > > > > https://github.com/google/kmsan/commit/491a67cf03fa9e0f240fd6eb53a6074e4bfd1a2c#diff-020c941e2b8fc67f5ddca598cd954d57R322 > > This has got a couple of problems. > > Firstly, for control URBs it doesn't check urb->setup_packet, which > should always be initialized regardless of the direction because it > always gets sent to the device. Ah, yes, we actually had an info-leak report for a bug in the sound subsystem that was leaking data this way, which was misattributed to raw-gadget. This makes sense to add and seems quite easy. > Secondly, some URBs use scatter-gather transfers, and they don't always > store the buffer address in urb->transfer_buffer (indeed, sometimes the > buffer is located outside of the kernel's address map). Instead they > use urb->sg and urb->num_sgs. To get an idea for how it all works, > look at usb_hcd_map_urb_for_dma() in hcd.c. Oh, this is something we need to look into. > Thirdly, the information we get back from the device doesn't always > cover the entire transfer buffer; sometimes the device sends less data > than we asked for. Perhaps you don't care very much about this case. So you mean that we should look at actual_length rather than transfer_buffer_length when initializing memory that comes from the device? Thank you, Alan!