From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-9.6 required=3.0 tests=DKIM_INVALID,DKIM_SIGNED, HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_PATCH,MAILING_LIST_MULTI,SIGNED_OFF_BY, SPF_HELO_NONE,SPF_PASS,USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 4A8E2C55191 for ; Fri, 24 Apr 2020 14:55:34 +0000 (UTC) Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by mail.kernel.org (Postfix) with ESMTP id F1EFC2071E for ; Fri, 24 Apr 2020 14:55:33 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=fail reason="signature verification failed" (1024-bit key) header.d=axtens.net header.i=@axtens.net header.b="f9J3gTCI" DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org F1EFC2071E Authentication-Results: mail.kernel.org; dmarc=none (p=none dis=none) header.from=axtens.net Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=owner-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix) id A3F658E0006; Fri, 24 Apr 2020 10:55:33 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id 9EFDC8E0003; Fri, 24 Apr 2020 10:55:33 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 904D38E0006; Fri, 24 Apr 2020 10:55:33 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from forelay.hostedemail.com (smtprelay0163.hostedemail.com [216.40.44.163]) by kanga.kvack.org (Postfix) with ESMTP id 7AE8E8E0003 for ; Fri, 24 Apr 2020 10:55:33 -0400 (EDT) Received: from smtpin25.hostedemail.com (10.5.19.251.rfc1918.com [10.5.19.251]) by forelay04.hostedemail.com (Postfix) with ESMTP id 3DA9F585F for ; Fri, 24 Apr 2020 14:55:33 +0000 (UTC) X-FDA: 76743047346.25.verse44_13557adbfcd5f X-HE-Tag: verse44_13557adbfcd5f X-Filterd-Recvd-Size: 8556 Received: from mail-pl1-f195.google.com (mail-pl1-f195.google.com [209.85.214.195]) by imf13.hostedemail.com (Postfix) with ESMTP for ; Fri, 24 Apr 2020 14:55:32 +0000 (UTC) Received: by mail-pl1-f195.google.com with SMTP id t4so3803740plq.12 for ; Fri, 24 Apr 2020 07:55:32 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=axtens.net; s=google; h=from:to:cc:subject:date:message-id:in-reply-to:references :mime-version:content-transfer-encoding; bh=qPgC2WAJzXEPrhZgAELaUlSrwS704anaXCh4Y7pEazI=; b=f9J3gTCIMeLayynOnvRWDqT6z8Ior8ocH0kNNu0sS9Hnc20nqieCLIySfvgbNCSC1Q urKi/qfsgrC0CxxXmVniTNknxk4RTHZhUxg1BwUsJdn4JyvKPoiKfqiRaKlHWeGnqzxb OL7Rz7F585ZqGweSUwJmHUvFtXpW09oYKxy8U= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=qPgC2WAJzXEPrhZgAELaUlSrwS704anaXCh4Y7pEazI=; b=d4A09C/1vz5ZuTA/FMomwIm6FeJv4bTNK+TZJWKaru/SRCvbvFCUPBiVMOXh6whXbo GPzXYdzIVwikLaRmJpxcChF0g/dl++tmUjwEOKcd6DMt96rPH5HC/FvlWpnQroq91krZ EYdTIGP+uG3XHCqX3ub2nW9/uxLpQ8/fZsfGH6942sHsmkLm75Ou/7OhRTU3WVeXro80 WQtw0nmvOsKJNWUIGPusyHGNJF63+LvYET11StAT78PoYHDrJXosL2akqKJa70NGj4wH kHrUYhGbrL/i9HnMJJ0c70n41lumZ6AFEOWtghSmDzGtWLA8CpdU/lV6WOcqJrO/aoiI yfbA== X-Gm-Message-State: AGi0PuYB+zAPxCxmYBubXuxP43SjI6DhPNs7xq6l88rLv6RKYyGEfHPY lh7ZVU2YPBYwt/bVLrTans1tmQ== X-Google-Smtp-Source: APiQypLwqZvK5rQCzP+j07zTgWcOBOddsMZ9l3lVaEQZ8LUnDI+S9URu5X8NXDudjahObNQtqyW8tw== X-Received: by 2002:a17:90a:246e:: with SMTP id h101mr6793515pje.83.1587740131771; Fri, 24 Apr 2020 07:55:31 -0700 (PDT) Received: from localhost (2001-44b8-1113-6700-fd06-aa7b-7508-4b8b.static.ipv6.internode.on.net. [2001:44b8:1113:6700:fd06:aa7b:7508:4b8b]) by smtp.gmail.com with ESMTPSA id o11sm5123020pgd.58.2020.04.24.07.55.29 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 24 Apr 2020 07:55:30 -0700 (PDT) From: Daniel Axtens To: linux-kernel@vger.kernel.org, linux-mm@kvack.org, akpm@linux-foundation.org, kasan-dev@googlegroups.com Cc: dvyukov@google.com, christophe.leroy@c-s.fr, Daniel Axtens , Daniel Micay , Andrey Ryabinin , Alexander Potapenko , David Gow Subject: [PATCH v4 1/2] kasan: stop tests being eliminated as dead code with FORTIFY_SOURCE Date: Sat, 25 Apr 2020 00:55:20 +1000 Message-Id: <20200424145521.8203-2-dja@axtens.net> X-Mailer: git-send-email 2.20.1 In-Reply-To: <20200424145521.8203-1-dja@axtens.net> References: <20200424145521.8203-1-dja@axtens.net> MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: 3 KASAN self-tests fail on a kernel with both KASAN and FORTIFY_SOURCE: memchr, memcmp and strlen. When FORTIFY_SOURCE is on, a number of functions are replaced with fortified versions, which attempt to check the sizes of the operands. However, these functions often directly invoke __builtin_foo() once they have performed the fortify check. The compiler can detect that the result= s of these functions are not used, and knows that they have no other side effects, and so can eliminate them as dead code. Why are only memchr, memcmp and strlen affected? =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D Of string and string-like functions, kasan_test tests: * strchr -> not affected, no fortified version * strrchr -> likewise * strcmp -> likewise * strncmp -> likewise * strnlen -> not affected, the fortify source implementation calls the underlying strnlen implementation which is instrumented, n= ot a builtin * strlen -> affected, the fortify souce implementation calls a __built= in version which the compiler can determine is dead. * memchr -> likewise * memcmp -> likewise * memset -> not affected, the compiler knows that memset writes to its first argument and therefore is not dead. Why does this not affect the functions normally? =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D In string.h, these functions are not marked as __pure, so the compiler cannot know that they do not have side effects. If relevant functions are marked as __pure in string.h, we see the following warnings and the functions are elided: lib/test_kasan.c: In function =E2=80=98kasan_memchr=E2=80=99: lib/test_kasan.c:606:2: warning: statement with no effect [-Wunused-value= ] memchr(ptr, '1', size + 1); ^~~~~~~~~~~~~~~~~~~~~~~~~~ lib/test_kasan.c: In function =E2=80=98kasan_memcmp=E2=80=99: lib/test_kasan.c:622:2: warning: statement with no effect [-Wunused-value= ] memcmp(ptr, arr, size+1); ^~~~~~~~~~~~~~~~~~~~~~~~ lib/test_kasan.c: In function =E2=80=98kasan_strings=E2=80=99: lib/test_kasan.c:645:2: warning: statement with no effect [-Wunused-value= ] strchr(ptr, '1'); ^~~~~~~~~~~~~~~~ ... This annotation would make sense to add and could be added at any point, = so the behaviour of test_kasan.c should change. The fix =3D=3D=3D=3D=3D=3D=3D Make all the functions that are pure write their results to a global, which makes them live. The strlen and memchr tests now pass. The memcmp test still fails to trigger, which is addressed in the next patch. Cc: Daniel Micay Cc: Andrey Ryabinin Cc: Alexander Potapenko Cc: Dmitry Vyukov Fixes: 0c96350a2d2f ("lib/test_kasan.c: add tests for several string/memo= ry API functions") Reviewed-by: Dmitry Vyukov Tested-by: David Gow Signed-off-by: Daniel Axtens --- v4: I accidentally dropped a memset from kasan_memcmp and then 'fixed' it= in patch 3. Just don't drop it. --- lib/test_kasan.c | 29 +++++++++++++++++++---------- 1 file changed, 19 insertions(+), 10 deletions(-) diff --git a/lib/test_kasan.c b/lib/test_kasan.c index e3087d90e00d..dc2c6a51d11a 100644 --- a/lib/test_kasan.c +++ b/lib/test_kasan.c @@ -23,6 +23,14 @@ =20 #include =20 +/* + * We assign some test results to these globals to make sure the tests + * are not eliminated as dead code. + */ + +int kasan_int_result; +void *kasan_ptr_result; + /* * Note: test functions are marked noinline so that their names appear i= n * reports. @@ -622,7 +630,7 @@ static noinline void __init kasan_memchr(void) if (!ptr) return; =20 - memchr(ptr, '1', size + 1); + kasan_ptr_result =3D memchr(ptr, '1', size + 1); kfree(ptr); } =20 @@ -638,7 +646,7 @@ static noinline void __init kasan_memcmp(void) return; =20 memset(arr, 0, sizeof(arr)); - memcmp(ptr, arr, size+1); + kasan_int_result =3D memcmp(ptr, arr, size + 1); kfree(ptr); } =20 @@ -661,22 +669,22 @@ static noinline void __init kasan_strings(void) * will likely point to zeroed byte. */ ptr +=3D 16; - strchr(ptr, '1'); + kasan_ptr_result =3D strchr(ptr, '1'); =20 pr_info("use-after-free in strrchr\n"); - strrchr(ptr, '1'); + kasan_ptr_result =3D strrchr(ptr, '1'); =20 pr_info("use-after-free in strcmp\n"); - strcmp(ptr, "2"); + kasan_int_result =3D strcmp(ptr, "2"); =20 pr_info("use-after-free in strncmp\n"); - strncmp(ptr, "2", 1); + kasan_int_result =3D strncmp(ptr, "2", 1); =20 pr_info("use-after-free in strlen\n"); - strlen(ptr); + kasan_int_result =3D strlen(ptr); =20 pr_info("use-after-free in strnlen\n"); - strnlen(ptr, 1); + kasan_int_result =3D strnlen(ptr, 1); } =20 static noinline void __init kasan_bitops(void) @@ -743,11 +751,12 @@ static noinline void __init kasan_bitops(void) __test_and_change_bit(BITS_PER_LONG + BITS_PER_BYTE, bits); =20 pr_info("out-of-bounds in test_bit\n"); - (void)test_bit(BITS_PER_LONG + BITS_PER_BYTE, bits); + kasan_int_result =3D test_bit(BITS_PER_LONG + BITS_PER_BYTE, bits); =20 #if defined(clear_bit_unlock_is_negative_byte) pr_info("out-of-bounds in clear_bit_unlock_is_negative_byte\n"); - clear_bit_unlock_is_negative_byte(BITS_PER_LONG + BITS_PER_BYTE, bits); + kasan_int_result =3D clear_bit_unlock_is_negative_byte(BITS_PER_LONG + + BITS_PER_BYTE, bits); #endif kfree(bits); } --=20 2.20.1