From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S933074AbdCGQkJ (ORCPT ); Tue, 7 Mar 2017 11:40:09 -0500 Received: from mail-ve1eur01on0115.outbound.protection.outlook.com ([104.47.1.115]:39315 "EHLO EUR01-VE1-obe.outbound.protection.outlook.com" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S933034AbdCGQjY (ORCPT ); Tue, 7 Mar 2017 11:39:24 -0500 Authentication-Results: vger.kernel.org; dkim=none (message not signed) header.d=none;vger.kernel.org; dmarc=none action=none header.from=virtuozzo.com; Subject: Re: kasan behavior when built with unsupported compiler To: Nikolay Borisov References: <1eb0b1ba-3847-9bdc-8f4a-adcd34de3486@gmail.com> CC: , Dmitry Vyukov , LKML From: Andrey Ryabinin Message-ID: Date: Tue, 7 Mar 2017 19:23:12 +0300 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Thunderbird/45.7.0 MIME-Version: 1.0 In-Reply-To: <1eb0b1ba-3847-9bdc-8f4a-adcd34de3486@gmail.com> Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit X-Originating-IP: [195.214.232.6] X-ClientProxiedBy: HE1PR09CA0085.eurprd09.prod.outlook.com (10.174.50.157) To VI1PR0801MB2061.eurprd08.prod.outlook.com (10.173.74.146) X-MS-Office365-Filtering-Correlation-Id: 559e5688-306c-4092-2044-08d465761712 X-Microsoft-Antispam: UriScan:;BCL:0;PCL:0;RULEID:(22001);SRVR:VI1PR0801MB2061; X-Microsoft-Exchange-Diagnostics: 1;VI1PR0801MB2061;3:p2xB3qnFKm/Ekq/sHSbkmz94enF2is4tjOsHKnuc38iHApuB+xXKliP5RWcTErX8Y76ejiAxO3IDlI4RwVzOKRTRxe3b4n5fb2QmcwxDwZYBG4kinKdyE8fqEg73sXtvXLpT2WUdKPbdkzmbM6oTxvfDhvAmUT1mEHKjarPbyHZ8G1PXiHXXKE43WLB8NW64TSj/wUHa5+7xWX65GzAxtu/o7LO7LmOPcijq10rGYc5FwJV715r59ll57kWESKf0iErYnIDvsMAkn9O0RrxfDg==;25:ITMa23nagpDl89teUfX3rZlPNAVqseNetLODXYradaUK0PGcqZ5Gpq7QdvSHfd+4wVkXw6AoCUl9GdRsHDSkswBEX7cKTBJ46fSl71ms+DMtaVKruhJIzEmTQVdZbbQb1TdqLMUgv5FcuWL8PIVl4CXXLALKTSaBBgi8DOwJzAwTf6D9jWZVz73IrtEI3I7pHzP1qNGxw8mGNnS+ujkwuFYQyjLA8snnLH/4FGrVlYP6zhhf8gPR1H14EhYHrMhGrrPRgZFSxypjzzUXu2SqTMWssBKUwtj7qb4ZlXsrKdDl1EPvsPX9TuqN9SsY6Z2+0Qy+hYx/0aB/8LEUzQff6K+mO5hlFSGVAaYxkfhN3/fo+gfvPeDmtH/Z8y/0rcUCEHJ5qxCxjCGJ1sfeFzuHW8pClExXhESBz7OB/7CWXr7WnPEIyOS6sUgji3n3PSdRXouf2zoYfcvnBut9KPeU+Q== X-Microsoft-Exchange-Diagnostics: 1;VI1PR0801MB2061;31:7vjqyEJxCzNAcaJpNwwFdtLeFEO/sW8NjWISfFHPyBBOGp2fJ0nht4dDC0smogg3vXZjxcdFf16M18fLDzYKLQCeuyxzrLx9gzt+l4Nop3io1pJwJjrV0KNoXQ0Amk7+RpBD62EZdnVRusa0yG7iLkjnGlOokd6dz/74j+Tn1RCLBsJrrBD3nVdtdrCj3r1f+lKmTSjQHQ9vKyIqtYHL0P84rewqOcH33aFt5nuiF7S6BkTxE8OXcsICknhESJw98Qr+ZzlDUnuMBftQJVG2kNVyPCez79tiM0nW3nMhn9Q=;20:EV3BcaNfCSDM99l8+SZa5njjffT5ueC8whaM8vi/gEVfAGR/o9wanMT41O4ZYmfp9lMgDA/YNeshDHDojEsyl9/EFfgOBGu3TiDSRERlqOWu1E+QTrAH9tcZnjhKwD7Lgs2fM3q7158fUA1DNALjFRwT8cXOyXmBbtJb1p8iyBFzhXu+iLWBWt1zLn+0JSMmsJN7A2ftiwZ5jEbop5Q9wFEayorwdZ/+ri64yD7GhxkQJzcNsZjMLLb3dZ8KZBe56XpSrHntS04W9SRBt1soYim92wWs6LjspeUMJ+mbg4OYpDhR/0qBEkhZxs9FFB1ja/bo1+Y6OOyBCwC8VAqNRcOqN8FDkb30keh6dIdnERzpWZkvYUTgKbFidgZu80StwqMrXGkmtc6X3MWyprDDI59Pebv0nob8G4H6bCSEPq8= X-Microsoft-Antispam-PRVS: X-Exchange-Antispam-Report-Test: UriScan:; X-Exchange-Antispam-Report-CFA-Test: BCL:0;PCL:0;RULEID:(6040375)(601004)(2401047)(8121501046)(5005006)(3002001)(10201501046)(6041248)(20161123564025)(20161123555025)(20161123558025)(20161123560025)(20161123562025)(6072148);SRVR:VI1PR0801MB2061;BCL:0;PCL:0;RULEID:;SRVR:VI1PR0801MB2061; X-Microsoft-Exchange-Diagnostics: 1;VI1PR0801MB2061;4:DZE93sntfq1jUrRRBlm4t0I33wqpn6O+RwF3diyzJzH4hFUDkJS7dz8ZaVHT80GubxPPzGuhYOa7IDLI3GfLyCWwSdnuFUR8tRDKuDiNKhJNRmWkj2o4kMB1nXYYRAxRRZlY3Z+NALqTeIheOlwYHt75infECO7GvzWnrfBaTXyHY6iRYJaXCIOucYCbDMtL3TBwyU1UL4WhQGaJESm12SHbqnhpAuaTM4pJ6WLGsWKlpKSBhehM73aLUuJVOGCuQrDnqZfkxoeRSlJocq90qa2bvmZ5BcrsiFZmO25TgVJSfD9wi6kxVlVhHf5KTitefqkBwnkMVqZ4dfQOPba3jKQ55wP4Vx0c5sEoWR+A2HtcYWMyYeuaceuKZNUloaWyQQDmOOAu2PhS6k3UdrwUUSr3y4WD5O/P5fxj7PdiyOWJZ+FlYgtGmnmKoT5WK9nn3Z59OBTNyzrbVUNh2rM3Hn0wKAmtehW1wK9DIQlAK+mHdQ0abJZwoNpu0qj2B4X8Oe55u8gsKEOSW0drlqm11V7hRs7+fAcaRNmXoIxw8ngPjYVQbK99hb16++/L9fxbV/fUUCuoMO5ZT7LblTE4qHYxn+x+p2i36hKg9emt3PY= X-Forefront-PRVS: 0239D46DB6 X-Forefront-Antispam-Report: SFV:NSPM;SFS:(10019020)(4630300001)(6049001)(6009001)(7916002)(39450400003)(39830400002)(39410400002)(24454002)(377454003)(31696002)(54906002)(229853002)(6306002)(25786008)(6486002)(77096006)(4001350100001)(90366009)(33646002)(6666003)(230700001)(5660300001)(2950100002)(6916009)(4326008)(3846002)(189998001)(65826007)(83506001)(6116002)(64126003)(50986999)(7736002)(575784001)(47776003)(53546006)(54356999)(31686004)(66066001)(65956001)(305945005)(42186005)(76176999)(86362001)(6246003)(53936002)(65806001)(8676002)(81166006)(2906002)(110136004)(50466002)(36756003)(38730400002)(23676002);DIR:OUT;SFP:1102;SCL:1;SRVR:VI1PR0801MB2061;H:[172.16.25.12];FPR:;SPF:None;MLV:sfv;LANG:en; X-Microsoft-Exchange-Diagnostics: =?utf-8?B?MTtWSTFQUjA4MDFNQjIwNjE7MjM6Uks1NGRrTnZxVmkzNWhCaUdMNU5OUTZV?= =?utf-8?B?M01NcmNvaDZtalhwVEZNSS9kS2hScWkzcHZybmtzTjRxdktsRzJ5T3hpQW9K?= =?utf-8?B?QzBFa0ZaOHlxV3BKa0VyQjhZaVo1Uk1FYUNnOTFST1kyUnpWaDNtdTJQMlNP?= =?utf-8?B?dURpMUEvaGxqRnZFdTYxcFRLUzZXUE1ha1pSVHR2ZnRadDVNTVlLc2srYWRQ?= =?utf-8?B?cTE4bzllVi95Sjl3RWlucWhYQWdkZGJlOWEzL0lqTFdxYXdkWG80cFJQdjRW?= =?utf-8?B?UGE4b1NWN0R6WFlEQit5L3REekhHNEpBakd4UTREMmxnL2YzeFluc25KcWxQ?= =?utf-8?B?K0p3WUhpckV6MjlwNkdBVUMvYXp1WUdIWmZoQUJiZ2NIY2xmQ0M0bVRiWTdk?= =?utf-8?B?eEM5TkxXTm92OEpWY1J6VjdPRTc3VU9YR0ZNUDBJZzRrNFY4TitjY2EzNjQ5?= =?utf-8?B?NFpYa2U4T0FKWisxY2ZOd0E5N1FIQXRFWkRVMHROSk5CT21odDNmOHNUd29r?= =?utf-8?B?Z3U3WlNnM0lGeTVOZTdSbGtybFgyMk9HOEFWdWNVMzl0UmROY3FnOWdXTmht?= =?utf-8?B?akpId2QrWUlZNHZUTEpBSTFha1ZoSEQ4WlFwWExhQzh6dVN6b3prbURGSmkv?= =?utf-8?B?ODh1VldxbVppWTNOUzZoSytCM1BKbWI3ZHVpSzZkSXRCekM0Z0o0S1QxWS9D?= =?utf-8?B?WXQrdHRwYURGWjZEWWN4K29KTWk2MGxITHdmazVySThjS1d0V0l6MUtSc0Ns?= =?utf-8?B?UkF5bm1TMVljMnl6NzVyRnhUQ0hrUkthTDRzaVU0ZDlhbHR3VWVEQWd2d2Nw?= =?utf-8?B?eWt1eWFWeVBsNkwwNkxEQUhjdk42RTV1NHIzQWE1TWFKWERoa3lmYTRhZEtm?= =?utf-8?B?VDExN1FxNGVDellqdUFRSjZKQTVzdmpHTjRyTk5PUkRnbHB4dG1sOXY5cnF4?= =?utf-8?B?aWQ4aUlLME9KY0o3SWVQMEs3NFVreVVCVmRxa0lCT3lkZHllK1FFUkNlNk9C?= =?utf-8?B?YVN5YlkrT2tNZVBzS1ZKcHFZcEx6TkNiRzNGcUU2QVhWQm9GUGlkdTcwa2Zj?= =?utf-8?B?NzNNdnpQRFEvekFic0VQMUVZaE93N0xoNUxqbFdUYUJQRkp0K2JwMm1jR0Ru?= =?utf-8?B?TXIzVGw2TVhOM2syZC9SSmRxQjlob0VsWTVwUkRmRUZBSHk2d3ZCcklrV0g4?= =?utf-8?B?V21qTUgrU1NsRmVZSDIwd0NNVXcxV09sRGg0NGtSN2U4L09rclZ2dGk3dExp?= =?utf-8?B?MVMwYUVFL2NpckREZ0YycEtWeVNvOFVZWU5Bb2pUd1A2WjAzZkVwNkMxU0FN?= =?utf-8?B?c2lIcnZnclNJeDNzTlh2algyVTlVby8yWVd1SUNLaXV0dzdqeHkzVmxZR3JV?= =?utf-8?B?OHVBY1lBc1Z1ZytkNDZybjdYMWlYZk42cE1UZGh6Q3I2b0ZPWE5rOW0wdS95?= =?utf-8?B?U3dKSmJLZ09ZRkVxY3pzd090NG9SaEhnOFJubDdZMnp0ZUJ3MWVVVVZpTW5m?= =?utf-8?B?RkhYcjRPSE11M2Z4TWg1Slo1b2YwblpGbjZwUEZQSlBXcDVieHFSd1pDMlV5?= =?utf-8?B?bXFlT1FXTk1takwxeGNlTVpuT2hPNmtVaFMwSXlybHd2RXI4MCtrMHdqTFJ5?= =?utf-8?B?MHRPVEM0MnVtTjMreS9IYTkyK1FEMmhXd09FMHF3WWdTVm9CN1ZUSVZrWTRq?= =?utf-8?B?SmdSQWlKZHhTc2VWUGFqMHl0YWdVQnU5Q3dOR3JNUTJBaGhJK2l5VEtpVTZQ?= =?utf-8?B?bnoxR2JGY0JGb3VGYTZGSGQ4YTFka3pzT1JRUXFINHdUcDNYUFNUdks1MXFX?= =?utf-8?Q?Hvq8x2UTsRkOkPy?= X-Microsoft-Exchange-Diagnostics: 1;VI1PR0801MB2061;6:v3zpKAWJuQxHOOCk4Lq7fUVESKaPcJMPA8gw/bG46kmGUs+4Nnq2gXUBmxLxSEfCrds8xhOGH0BsNMIW4KA5I9JT92BAJdKTNiRassl+caDOKJARNYvxmlUrwSy7n5iqZh+uLFXK/GJ2M9rgVa4jnlYHf40ZWrxKgMP1nctnkFe03pWREuBpFFnsoZuRiflwIR+HI3iznBtU+Ypf8BHsS4RXwdBggL185kDCjoYqt140EBSNyt3OttphR/inWjMci+0B0l62S9WvSPr37O2eRHkCRZnXSD5F+XxmvuhZ0AZV5IMDwpJiM58UKStGcV7Pvj2FjLeCAk6P3CfDMM9BYAyGvj+iPCMVq2OwWTLcUZuicAww+wmU/guMoMNee7X+lx6XP/gBVrFzl5TZb2N4Pg==;5:lK293Zww9B1UxqJVhSaTFVOyxswGgF2r0r1IOO8TSRVLW8UFzKnL7iJEmlPOOHRmhD8U4Yp8N0lEBMIsvbcQrhUyD4LzXsNWlqYLIsCJUa8ACII9mOB8cFoqBN83JYIB4Fa/weKHhgdQt4Q1i6/oxSHb7FK+xUNiuViDlLJjKbI=;24:Smd/hVSgbFwSfK41J0Yarbx3T2UThUgq73UFFoaI53hWA5zAFuELXqhBFboOnag8lVA4ZIGdfVmikpJ6Z4uJ0dwzLYX2TMAaQC85OTasqTs= SpamDiagnosticOutput: 1:99 SpamDiagnosticMetadata: NSPM X-Microsoft-Exchange-Diagnostics: 1;VI1PR0801MB2061;7:n5SJ8uk/Z/+Dy/gSobhSDHjgfyQZ6+Bdj9Lz9068SzogD6U6j8F2QWCNICkvF9kWTH9JjwdGe5+46EIi/axduJ9VSCvDeLLmHP0RzQgc5DoRKZ8TgkOY15/uLBcT4YFEokvRXuipOeAi1ROvOEe07O2shaAir7j8cVhFXMQEukA2XpHmVyRCNyfrZieGoWXJdexzFSyr5JQhUX8g+ohDpN5B/ethkyTjS9e5AesRm2/03RKtSOdNWCJij8F/6MBPoLmgTu4Xq1HRR+Hepr2Qq5Mvh+nkEO8R7i9qgu6V4CNeue/CxxQouAFOzU6YXWhBsowLMC6huCl3Mr1tMO589g==;20:m6DrImlO47XYuexpK4fQfXY8S+Tw58DVOohI9GtiuFm/UpERIr9mAKeT1g681UNhMDyJNwle2/xoTvxFxhQXEnkVVO+Nyw4J8vACkbK2LbGP1uP6xiFgjr2l0eUzUN+ruxPQXtl6dsu022f/DnTMThfeQL+0bPrQ3Bmw6v0WV7Q= X-OriginatorOrg: virtuozzo.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 07 Mar 2017 16:22:02.9168 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-Transport-CrossTenantHeadersStamped: VI1PR0801MB2061 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On 03/07/2017 06:35 PM, Nikolay Borisov wrote: > Hello, > > I've been chasing a particular UAF as reported by kasan > (https://www.spinics.net/lists/kernel/msg2458136.html). AFAICS it's not use after free, it's out-of-bounds access. > However, one > thing which I took notice of rather lately is that I was building my > kernel with gcc 4.7.4 which is not supported by kasan as indicated by > the following string: > > scripts/Makefile.kasan:19: Cannot use CONFIG_KASAN: > -fsanitize=kernel-address is not supported by compiler > > > Nevertheless, the kernel compiles and when I boot it I see the kasan > splats as per the referenced thread. With gcc like 4.7.4 compiler will not instrument memory accesses in code, which means that kasan will not detect bugs. However, in your case, access is done via copy_to_user(). Compiler doesn't see accesses in copy_to_user() because it's written in assembly, thus we added manual check in commit 1771c6e1a567ea0ba2cccc0a4ffe68a1419fd8ef. Of course this manual check will work with any compiler version. > If, however, I build the kernel > with a newer compiler version 5.4.0 kasan no longer complains. > That's odd. Perhaps we have some tricky bug triggered by gcc 4.7.4 code generation or it might be some bug in gcc. But it's just a blind guess, it's hard to say anything for sure without further analysis. > > At this point I'm wondering whether the splats can be due to old > compiler being used e.g. false positives or are they genuine splats and > gcc 5 somehow obfuscates them ? Clearly despite the warning about not > being able to use CONFIG_KASAN it is still working since I'm seeing the > splats. Is this valid behavior ? > So with GCCs that doesn't support kasan we shouldn't have any false-positives, but it's expected to have a lot of false-negatives (missed bugs). > > Regards, > Nikolay >