From: Andrey Konovalov <andreyknvl@google.com>
To: Kees Cook <keescook@chromium.org>
Cc: Andrew Morton <akpm@linux-foundation.org>,
Dmitry Vyukov <dvyukov@google.com>,
Andrey Ryabinin <aryabinin@virtuozzo.com>,
Elena Petrova <lenaptr@google.com>,
Alexander Potapenko <glider@google.com>,
Dan Carpenter <dan.carpenter@oracle.com>,
"Gustavo A. R. Silva" <gustavo@embeddedor.com>,
Arnd Bergmann <arnd@arndb.de>,
Ard Biesheuvel <ard.biesheuvel@linaro.org>,
kasan-dev <kasan-dev@googlegroups.com>,
Linux Memory Management List <linux-mm@kvack.org>,
LKML <linux-kernel@vger.kernel.org>,
kernel-hardening@lists.openwall.com,
syzkaller <syzkaller@googlegroups.com>
Subject: Re: [PATCH v3 6/6] ubsan: Include bug type in report header
Date: Thu, 16 Jan 2020 13:32:33 +0100 [thread overview]
Message-ID: <CAAeHK+x5pLce4Uig6O03YS6MrSJtu6FR9DbcTsjy29BbgEZM4A@mail.gmail.com> (raw)
In-Reply-To: <20200116012321.26254-7-keescook@chromium.org>
On Thu, Jan 16, 2020 at 2:24 AM Kees Cook <keescook@chromium.org> wrote:
>
> When syzbot tries to figure out how to deduplicate bug reports, it
> prefers seeing a hint about a specific bug type (we can do better than
> just "UBSAN"). This lifts the handler reason into the UBSAN report line
> that includes the file path that tripped a check. Unfortunately, UBSAN
> does not provide function names.
>
> Suggested-by: Dmitry Vyukov <dvyukov@google.com>
> Link: https://lore.kernel.org/lkml/CACT4Y+bsLJ-wFx_TaXqax3JByUOWB3uk787LsyMVcfW6JzzGvg@mail.gmail.com
> Signed-off-by: Kees Cook <keescook@chromium.org>
> ---
> lib/ubsan.c | 36 +++++++++++++++---------------------
> 1 file changed, 15 insertions(+), 21 deletions(-)
>
> diff --git a/lib/ubsan.c b/lib/ubsan.c
> index 429663eef6a7..057d5375bfc6 100644
> --- a/lib/ubsan.c
> +++ b/lib/ubsan.c
> @@ -45,13 +45,6 @@ static bool was_reported(struct source_location *location)
> return test_and_set_bit(REPORTED_BIT, &location->reported);
> }
>
> -static void print_source_location(const char *prefix,
> - struct source_location *loc)
> -{
> - pr_err("%s %s:%d:%d\n", prefix, loc->file_name,
> - loc->line & LINE_MASK, loc->column & COLUMN_MASK);
> -}
> -
> static bool suppress_report(struct source_location *loc)
> {
> return current->in_ubsan || was_reported(loc);
> @@ -140,13 +133,14 @@ static void val_to_string(char *str, size_t size, struct type_descriptor *type,
> }
> }
>
> -static void ubsan_prologue(struct source_location *location)
> +static void ubsan_prologue(struct source_location *loc, const char *reason)
> {
> current->in_ubsan++;
>
> pr_err("========================================"
> "========================================\n");
> - print_source_location("UBSAN: Undefined behaviour in", location);
> + pr_err("UBSAN: %s in %s:%d:%d\n", reason, loc->file_name,
> + loc->line & LINE_MASK, loc->column & COLUMN_MASK);
> }
>
> static void ubsan_epilogue(void)
> @@ -180,12 +174,12 @@ static void handle_overflow(struct overflow_data *data, void *lhs,
> if (suppress_report(&data->location))
> return;
>
> - ubsan_prologue(&data->location);
> + ubsan_prologue(&data->location, type_is_signed(type) ?
> + "signed integer overflow" :
> + "unsigned integer overflow");
>
> val_to_string(lhs_val_str, sizeof(lhs_val_str), type, lhs);
> val_to_string(rhs_val_str, sizeof(rhs_val_str), type, rhs);
> - pr_err("%s integer overflow:\n",
> - type_is_signed(type) ? "signed" : "unsigned");
> pr_err("%s %c %s cannot be represented in type %s\n",
> lhs_val_str,
> op,
> @@ -225,7 +219,7 @@ void __ubsan_handle_negate_overflow(struct overflow_data *data,
> if (suppress_report(&data->location))
> return;
>
> - ubsan_prologue(&data->location);
> + ubsan_prologue(&data->location, "negation overflow");
>
> val_to_string(old_val_str, sizeof(old_val_str), data->type, old_val);
>
> @@ -245,7 +239,7 @@ void __ubsan_handle_divrem_overflow(struct overflow_data *data,
> if (suppress_report(&data->location))
> return;
>
> - ubsan_prologue(&data->location);
> + ubsan_prologue(&data->location, "division overflow");
>
> val_to_string(rhs_val_str, sizeof(rhs_val_str), data->type, rhs);
>
> @@ -264,7 +258,7 @@ static void handle_null_ptr_deref(struct type_mismatch_data_common *data)
> if (suppress_report(data->location))
> return;
>
> - ubsan_prologue(data->location);
> + ubsan_prologue(data->location, "NULL pointer dereference");
Not crucially important, but I think it makes sense to use the
single-word-with-hyphens bug type format like in KASAN here, e.g.
null-ptr-deref, misaligned-access, etc.
>
> pr_err("%s null pointer of type %s\n",
> type_check_kinds[data->type_check_kind],
> @@ -279,7 +273,7 @@ static void handle_misaligned_access(struct type_mismatch_data_common *data,
> if (suppress_report(data->location))
> return;
>
> - ubsan_prologue(data->location);
> + ubsan_prologue(data->location, "misaligned access");
>
> pr_err("%s misaligned address %p for type %s\n",
> type_check_kinds[data->type_check_kind],
> @@ -295,7 +289,7 @@ static void handle_object_size_mismatch(struct type_mismatch_data_common *data,
> if (suppress_report(data->location))
> return;
>
> - ubsan_prologue(data->location);
> + ubsan_prologue(data->location, "object size mismatch");
> pr_err("%s address %p with insufficient space\n",
> type_check_kinds[data->type_check_kind],
> (void *) ptr);
> @@ -354,7 +348,7 @@ void __ubsan_handle_out_of_bounds(struct out_of_bounds_data *data, void *index)
> if (suppress_report(&data->location))
> return;
>
> - ubsan_prologue(&data->location);
> + ubsan_prologue(&data->location, "array index out of bounds");
>
> val_to_string(index_str, sizeof(index_str), data->index_type, index);
> pr_err("index %s is out of range for type %s\n", index_str,
> @@ -375,7 +369,7 @@ void __ubsan_handle_shift_out_of_bounds(struct shift_out_of_bounds_data *data,
> if (suppress_report(&data->location))
> goto out;
>
> - ubsan_prologue(&data->location);
> + ubsan_prologue(&data->location, "shift out of bounds");
>
> val_to_string(rhs_str, sizeof(rhs_str), rhs_type, rhs);
> val_to_string(lhs_str, sizeof(lhs_str), lhs_type, lhs);
> @@ -407,7 +401,7 @@ EXPORT_SYMBOL(__ubsan_handle_shift_out_of_bounds);
>
> void __ubsan_handle_builtin_unreachable(struct unreachable_data *data)
> {
> - ubsan_prologue(&data->location);
> + ubsan_prologue(&data->location, "unreachable");
> pr_err("calling __builtin_unreachable()\n");
> ubsan_epilogue();
> panic("can't return from __builtin_unreachable()");
> @@ -422,7 +416,7 @@ void __ubsan_handle_load_invalid_value(struct invalid_value_data *data,
> if (suppress_report(&data->location))
> return;
>
> - ubsan_prologue(&data->location);
> + ubsan_prologue(&data->location, "invalid load");
>
> val_to_string(val_str, sizeof(val_str), data->type, val);
>
> --
> 2.20.1
>
> --
> You received this message because you are subscribed to the Google Groups "syzkaller" group.
> To unsubscribe from this group and stop receiving emails from it, send an email to syzkaller+unsubscribe@googlegroups.com.
> To view this discussion on the web visit https://groups.google.com/d/msgid/syzkaller/20200116012321.26254-7-keescook%40chromium.org.
prev parent reply other threads:[~2020-01-16 13:02 UTC|newest]
Thread overview: 13+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-01-16 1:23 [PATCH v3 0/6] ubsan: Split out bounds checker Kees Cook
2020-01-16 1:23 ` [PATCH v3 1/6] ubsan: Add trap instrumentation option Kees Cook
2020-01-16 1:23 ` [PATCH v3 2/6] ubsan: Split "bounds" checker from other options Kees Cook
2020-01-16 1:23 ` [PATCH v3 3/6] lkdtm/bugs: Add arithmetic overflow and array bounds checks Kees Cook
2020-01-16 1:23 ` [PATCH v3 4/6] ubsan: Check panic_on_warn Kees Cook
2020-01-16 1:23 ` [PATCH v3 5/6] kasan: Unset panic_on_warn before calling panic() Kees Cook
2020-01-16 5:23 ` Dmitry Vyukov
2020-01-16 23:49 ` Kees Cook
2020-01-17 9:54 ` Dmitry Vyukov
2020-01-17 21:20 ` Kees Cook
2020-01-18 9:19 ` Dmitry Vyukov
2020-01-16 1:23 ` [PATCH v3 6/6] ubsan: Include bug type in report header Kees Cook
2020-01-16 12:32 ` Andrey Konovalov [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=CAAeHK+x5pLce4Uig6O03YS6MrSJtu6FR9DbcTsjy29BbgEZM4A@mail.gmail.com \
--to=andreyknvl@google.com \
--cc=akpm@linux-foundation.org \
--cc=ard.biesheuvel@linaro.org \
--cc=arnd@arndb.de \
--cc=aryabinin@virtuozzo.com \
--cc=dan.carpenter@oracle.com \
--cc=dvyukov@google.com \
--cc=glider@google.com \
--cc=gustavo@embeddedor.com \
--cc=kasan-dev@googlegroups.com \
--cc=keescook@chromium.org \
--cc=kernel-hardening@lists.openwall.com \
--cc=lenaptr@google.com \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-mm@kvack.org \
--cc=syzkaller@googlegroups.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).