From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-9.6 required=3.0 tests=DKIM_INVALID,DKIM_SIGNED, HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_PATCH,MAILING_LIST_MULTI,SIGNED_OFF_BY, SPF_HELO_NONE,SPF_PASS,USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id CB867C55191 for ; Thu, 23 Apr 2020 15:45:16 +0000 (UTC) Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by mail.kernel.org (Postfix) with ESMTP id 7FCE82076C for ; Thu, 23 Apr 2020 15:45:16 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=fail reason="signature verification failed" (1024-bit key) header.d=axtens.net header.i=@axtens.net header.b="jPvZSIVR" DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org 7FCE82076C Authentication-Results: mail.kernel.org; dmarc=none (p=none dis=none) header.from=axtens.net Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=owner-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix) id 0BB958E0006; Thu, 23 Apr 2020 11:45:16 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id 06C578E0003; Thu, 23 Apr 2020 11:45:16 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id EC4818E0006; Thu, 23 Apr 2020 11:45:15 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from forelay.hostedemail.com (smtprelay0183.hostedemail.com [216.40.44.183]) by kanga.kvack.org (Postfix) with ESMTP id D63438E0003 for ; Thu, 23 Apr 2020 11:45:15 -0400 (EDT) Received: from smtpin03.hostedemail.com (10.5.19.251.rfc1918.com [10.5.19.251]) by forelay02.hostedemail.com (Postfix) with ESMTP id 9BDBBA2BD for ; Thu, 23 Apr 2020 15:45:15 +0000 (UTC) X-FDA: 76739543790.03.wren72_680f88dbde153 X-HE-Tag: wren72_680f88dbde153 X-Filterd-Recvd-Size: 8365 Received: from mail-pg1-f195.google.com (mail-pg1-f195.google.com [209.85.215.195]) by imf11.hostedemail.com (Postfix) with ESMTP for ; Thu, 23 Apr 2020 15:45:14 +0000 (UTC) Received: by mail-pg1-f195.google.com with SMTP id s18so407479pgl.12 for ; Thu, 23 Apr 2020 08:45:14 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=axtens.net; s=google; h=from:to:cc:subject:date:message-id:in-reply-to:references :mime-version:content-transfer-encoding; bh=Rm9KJcgesHnxEUAmWee/mQjOLa+QTtuSP9X5sIq0tgA=; b=jPvZSIVRZtIuE/ljLJ3/1SMhxZNEYVUDCJn9nhJ1b8Rl/QIVp+M4bzvcP3LLZPvbj+ Ep1FWxzMDYCy8ID1pym0moYcnagwj44Z0fGnTNV/px2InnO20wPoAGY2Lehuaau4EKhV MgAEZsw3rHya1t16HQL+3GnyKd8WKAqsljxmA= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=Rm9KJcgesHnxEUAmWee/mQjOLa+QTtuSP9X5sIq0tgA=; b=kNbNcxz7dB7wyfbBAHujS93iuqcdcWI7Glm/JrJ3sZRFEgBPWKF1Tf32pvRJDgQrHy Xg7i4vOmLfEtN3Ap0EbhNbgRc5V/+bdlbmME2dk5dtoY/eTeBbxb8PLAo7CGOjYQ8BFz j8pQolJO3FS6lY4iLYnoHiZ2nnyGX1ulqbbjZijeYDexRYDlhyj/Gd4mdGqSz5jdzrif ltEgYHRE2/j8ntpx8U9w1jdw2pHS+psb5w0WfAGIZ9pQTBKvjQj39wmU9cmqzzxFzN3n WVN/8ygdRTEaGmAbcFtP+qW0GUcu8qgwVlw75esKDxOb9IhkC9nkoUBMK2FkJCNyjqNk IbmA== X-Gm-Message-State: AGi0PuaHdYDlbb96hmDO89k9oewHvPMCBo5YCVdQZjI0eTvV63pGZVaX FxIxCwQKWfDh+BsRu/p8a8z18w== X-Google-Smtp-Source: APiQypJYVTiq1ojI2FxBtYaYdroS0cYv8IN+wrMRkcl61wXgxQMLYHKSmaDJF4pzqDaEJ9/oI6GZmg== X-Received: by 2002:a62:1d48:: with SMTP id d69mr4369984pfd.102.1587656714044; Thu, 23 Apr 2020 08:45:14 -0700 (PDT) Received: from localhost (2001-44b8-111e-5c00-7979-720a-9390-aec6.static.ipv6.internode.on.net. [2001:44b8:111e:5c00:7979:720a:9390:aec6]) by smtp.gmail.com with ESMTPSA id w125sm2435466pgw.22.2020.04.23.08.45.12 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 23 Apr 2020 08:45:13 -0700 (PDT) From: Daniel Axtens To: linux-kernel@vger.kernel.org, linux-mm@kvack.org, akpm@linux-foundation.org, kasan-dev@googlegroups.com Cc: dvyukov@google.com, christophe.leroy@c-s.fr, Daniel Axtens , Daniel Micay , Andrey Ryabinin , Alexander Potapenko Subject: [PATCH v3 1/3] kasan: stop tests being eliminated as dead code with FORTIFY_SOURCE Date: Fri, 24 Apr 2020 01:45:01 +1000 Message-Id: <20200423154503.5103-2-dja@axtens.net> X-Mailer: git-send-email 2.20.1 In-Reply-To: <20200423154503.5103-1-dja@axtens.net> References: <20200423154503.5103-1-dja@axtens.net> MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: 3 KASAN self-tests fail on a kernel with both KASAN and FORTIFY_SOURCE: memchr, memcmp and strlen. When FORTIFY_SOURCE is on, a number of functions are replaced with fortified versions, which attempt to check the sizes of the operands. However, these functions often directly invoke __builtin_foo() once they have performed the fortify check. The compiler can detect that the result= s of these functions are not used, and knows that they have no other side effects, and so can eliminate them as dead code. Why are only memchr, memcmp and strlen affected? =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D Of string and string-like functions, kasan_test tests: * strchr -> not affected, no fortified version * strrchr -> likewise * strcmp -> likewise * strncmp -> likewise * strnlen -> not affected, the fortify source implementation calls the underlying strnlen implementation which is instrumented, n= ot a builtin * strlen -> affected, the fortify souce implementation calls a __built= in version which the compiler can determine is dead. * memchr -> likewise * memcmp -> likewise * memset -> not affected, the compiler knows that memset writes to its first argument and therefore is not dead. Why does this not affect the functions normally? =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D In string.h, these functions are not marked as __pure, so the compiler cannot know that they do not have side effects. If relevant functions are marked as __pure in string.h, we see the following warnings and the functions are elided: lib/test_kasan.c: In function =E2=80=98kasan_memchr=E2=80=99: lib/test_kasan.c:606:2: warning: statement with no effect [-Wunused-value= ] memchr(ptr, '1', size + 1); ^~~~~~~~~~~~~~~~~~~~~~~~~~ lib/test_kasan.c: In function =E2=80=98kasan_memcmp=E2=80=99: lib/test_kasan.c:622:2: warning: statement with no effect [-Wunused-value= ] memcmp(ptr, arr, size+1); ^~~~~~~~~~~~~~~~~~~~~~~~ lib/test_kasan.c: In function =E2=80=98kasan_strings=E2=80=99: lib/test_kasan.c:645:2: warning: statement with no effect [-Wunused-value= ] strchr(ptr, '1'); ^~~~~~~~~~~~~~~~ ... This annotation would make sense to add and could be added at any point, = so the behaviour of test_kasan.c should change. The fix =3D=3D=3D=3D=3D=3D=3D Make all the functions that are pure write their results to a global, which makes them live. The strlen and memchr tests now pass. The memcmp test still fails to trigger, which is addressed in the next patch. Cc: Daniel Micay Cc: Andrey Ryabinin Cc: Alexander Potapenko Cc: Dmitry Vyukov Fixes: 0c96350a2d2f ("lib/test_kasan.c: add tests for several string/memo= ry API functions") Reviewed-by: Dmitry Vyukov Signed-off-by: Daniel Axtens --- lib/test_kasan.c | 30 +++++++++++++++++++----------- 1 file changed, 19 insertions(+), 11 deletions(-) diff --git a/lib/test_kasan.c b/lib/test_kasan.c index e3087d90e00d..939f395a5392 100644 --- a/lib/test_kasan.c +++ b/lib/test_kasan.c @@ -23,6 +23,14 @@ =20 #include =20 +/* + * We assign some test results to these globals to make sure the tests + * are not eliminated as dead code. + */ + +int kasan_int_result; +void *kasan_ptr_result; + /* * Note: test functions are marked noinline so that their names appear i= n * reports. @@ -622,7 +630,7 @@ static noinline void __init kasan_memchr(void) if (!ptr) return; =20 - memchr(ptr, '1', size + 1); + kasan_ptr_result =3D memchr(ptr, '1', size + 1); kfree(ptr); } =20 @@ -637,8 +645,7 @@ static noinline void __init kasan_memcmp(void) if (!ptr) return; =20 - memset(arr, 0, sizeof(arr)); - memcmp(ptr, arr, size+1); + kasan_int_result =3D memcmp(ptr, arr, size + 1); kfree(ptr); } =20 @@ -661,22 +668,22 @@ static noinline void __init kasan_strings(void) * will likely point to zeroed byte. */ ptr +=3D 16; - strchr(ptr, '1'); + kasan_ptr_result =3D strchr(ptr, '1'); =20 pr_info("use-after-free in strrchr\n"); - strrchr(ptr, '1'); + kasan_ptr_result =3D strrchr(ptr, '1'); =20 pr_info("use-after-free in strcmp\n"); - strcmp(ptr, "2"); + kasan_int_result =3D strcmp(ptr, "2"); =20 pr_info("use-after-free in strncmp\n"); - strncmp(ptr, "2", 1); + kasan_int_result =3D strncmp(ptr, "2", 1); =20 pr_info("use-after-free in strlen\n"); - strlen(ptr); + kasan_int_result =3D strlen(ptr); =20 pr_info("use-after-free in strnlen\n"); - strnlen(ptr, 1); + kasan_int_result =3D strnlen(ptr, 1); } =20 static noinline void __init kasan_bitops(void) @@ -743,11 +750,12 @@ static noinline void __init kasan_bitops(void) __test_and_change_bit(BITS_PER_LONG + BITS_PER_BYTE, bits); =20 pr_info("out-of-bounds in test_bit\n"); - (void)test_bit(BITS_PER_LONG + BITS_PER_BYTE, bits); + kasan_int_result =3D test_bit(BITS_PER_LONG + BITS_PER_BYTE, bits); =20 #if defined(clear_bit_unlock_is_negative_byte) pr_info("out-of-bounds in clear_bit_unlock_is_negative_byte\n"); - clear_bit_unlock_is_negative_byte(BITS_PER_LONG + BITS_PER_BYTE, bits); + kasan_int_result =3D clear_bit_unlock_is_negative_byte(BITS_PER_LONG + + BITS_PER_BYTE, bits); #endif kfree(bits); } --=20 2.20.1