From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-14.3 required=3.0 tests=DKIMWL_WL_MED,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_PATCH, MAILING_LIST_MULTI,SIGNED_OFF_BY,SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED, USER_IN_DEF_DKIM_WL autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id B9714C433E8 for ; Mon, 6 Jul 2020 06:19:48 +0000 (UTC) Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by mail.kernel.org (Postfix) with ESMTP id 4A3BE20708 for ; Mon, 6 Jul 2020 06:19:48 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b="Kb5GyZA+" DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org 4A3BE20708 Authentication-Results: mail.kernel.org; dmarc=fail (p=reject dis=none) header.from=google.com Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=owner-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix) id 7FF5C6B0003; Mon, 6 Jul 2020 02:19:47 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id 789056B0005; Mon, 6 Jul 2020 02:19:47 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 601FC6B0006; Mon, 6 Jul 2020 02:19:47 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from forelay.hostedemail.com (smtprelay0148.hostedemail.com [216.40.44.148]) by kanga.kvack.org (Postfix) with ESMTP id 47A096B0003 for ; Mon, 6 Jul 2020 02:19:47 -0400 (EDT) Received: from smtpin30.hostedemail.com (10.5.19.251.rfc1918.com [10.5.19.251]) by forelay03.hostedemail.com (Postfix) with ESMTP id C04678248047 for ; Mon, 6 Jul 2020 06:19:46 +0000 (UTC) X-FDA: 77006649972.30.night31_531714526ea9 Received: from filter.hostedemail.com (10.5.16.251.rfc1918.com [10.5.16.251]) by smtpin30.hostedemail.com (Postfix) with ESMTP id 9CA3F180B3C8B for ; Mon, 6 Jul 2020 06:19:46 +0000 (UTC) X-HE-Tag: night31_531714526ea9 X-Filterd-Recvd-Size: 10551 Received: from mail-qk1-f194.google.com (mail-qk1-f194.google.com [209.85.222.194]) by imf03.hostedemail.com (Postfix) with ESMTP for ; Mon, 6 Jul 2020 06:19:46 +0000 (UTC) Received: by mail-qk1-f194.google.com with SMTP id 145so31348444qke.9 for ; Sun, 05 Jul 2020 23:19:46 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=p8GSicWISxuLf8SI+byIF+xMxTNvfdYQixlttIglDVo=; b=Kb5GyZA+RJu/iVN8HUtF7SZb/AesZh0MC1s2Up/L6gZO8CAX69QBX/18QLSEWJcaQm bV7234iQyfobwViOUP11+RW17wTqDvAX9lQ/LE2y9YLRWlcKoAPKQW+h3hPzjnGF9F9L VGT8cnzbQIlczAjUu/gpZE6GJbtQ1c9wnxnnXylraSfK67Kz3CRTdLE/6cWI1PJBO2m3 0dnqBtOtUuC0f6DT2TRVMuZKkS2IdppDH3Okra7WpEYhKJYB3HuNs0o4Y3Mftwob2M/D T4pZRiMkxbGZ8tMKR9UxafTx4d/K3TR2NsxGH67l2E09lNBJ2FgKwvW0py2Uii2yttD7 Uxdg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=p8GSicWISxuLf8SI+byIF+xMxTNvfdYQixlttIglDVo=; b=Jhe3lH+AWx81A5JZcVSV0opUiSN4jq3Yzw4WL5HPEQrozP7lM5exJgOl4jRfwU+vr2 yaC6faRA3uYM8BxEYRRBKLigXEiOFPJInuqU690YmQ7P2orRXXa2eAnZYpGX5cHlv2xY veTEnLHMeffQSbDurgpf+IIcJl4On7mu7cvLlATLdDyvRj/nod5wg3gX/wA1WLVEmvP+ boFwX1R9bN9kGFim9nEwOwHWjHzSDv5pvpTji5C/nRI6iCLDDuro0lPCXA88f4kUdfej j0GpQnGcns9PdZnHDXgkSmEHTxaP/i5Hn9lYBJOOUIhfJcvtU/67e2fbSOTkZVkC49ow a/+A== X-Gm-Message-State: AOAM531XRkrpTCma+kmGHfGohJoIE72FhW5IRRyOosn1GPWsnQkRmaFl 4w4iarEixHNlBuPAy970+iJC/x631gzl817fetZiug== X-Google-Smtp-Source: ABdhPJxlC97uRvdNje6Yxi/b5Fq8p0PnY4Y6DnkuEjMt/sh0vf2nWbgdvCADjv0hclufOA80J/fDvD6J6xJwxhe0Nqo= X-Received: by 2002:a37:67d4:: with SMTP id b203mr19900712qkc.407.1594016385214; Sun, 05 Jul 2020 23:19:45 -0700 (PDT) MIME-Version: 1.0 References: <20200706022150.20848-1-walter-zh.wu@mediatek.com> In-Reply-To: <20200706022150.20848-1-walter-zh.wu@mediatek.com> From: Dmitry Vyukov Date: Mon, 6 Jul 2020 08:19:33 +0200 Message-ID: Subject: Re: [PATCH v2] kasan: fix KASAN unit tests for tag-based KASAN To: Walter Wu Cc: Andrey Ryabinin , Alexander Potapenko , Matthias Brugger , kasan-dev , Linux-MM , LKML , Linux ARM , wsd_upstream , linux-mediatek@lists.infradead.org, Andrey Konovalov , Andrew Morton Content-Type: text/plain; charset="UTF-8" X-Rspamd-Queue-Id: 9CA3F180B3C8B X-Spamd-Result: default: False [0.00 / 100.00] X-Rspamd-Server: rspam03 X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: On Mon, Jul 6, 2020 at 4:21 AM Walter Wu wrote: > > We use tag-based KASAN, then KASAN unit tests don't detect out-of-bounds > memory access. They need to be fixed. > > With tag-based KASAN, the state of each 16 aligned bytes of memory is > encoded in one shadow byte and the shadow value is tag of pointer, so > we need to read next shadow byte, the shadow value is not equal to tag > value of pointer, so that tag-based KASAN will detect out-of-bounds > memory access. > > Signed-off-by: Walter Wu > Cc: Andrey Ryabinin > Cc: Dmitry Vyukov > Cc: Alexander Potapenko > Cc: Matthias Brugger > Cc: Andrey Konovalov > Cc: Andrew Morton > --- > > changes since v1: > - Reduce amount of non-compiled code. > - KUnit-KASAN Integration patchset are not merged yet. My patch should > have conflict with it, if needed, we can continue to wait it. > > --- > > lib/test_kasan.c | 81 ++++++++++++++++++++++++++++++++++++++---------- > 1 file changed, 64 insertions(+), 17 deletions(-) > > diff --git a/lib/test_kasan.c b/lib/test_kasan.c > index e3087d90e00d..660664439d52 100644 > --- a/lib/test_kasan.c > +++ b/lib/test_kasan.c > @@ -40,7 +40,11 @@ static noinline void __init kmalloc_oob_right(void) > return; > } > > - ptr[size] = 'x'; > + if (IS_ENABLED(CONFIG_KASAN_GENERIC)) > + ptr[size] = 'x'; > + else > + ptr[size + 5] = 'x'; > + Hi Walter, Would if be possible to introduce something like: #define OOB_TAG_OFF (IS_ENABLED(CONFIG_KASAN_GENERIC) ? 0 : 8) and then add it throughout as ptr[size + OOB_TAG_OFF] = 'x'; ? The current version results in quite some amount of additional code that needs to be read, extended and maintained in the future. So I am thinking if it's possible to minimize it somehow... > kfree(ptr); > } > > @@ -92,7 +96,11 @@ static noinline void __init kmalloc_pagealloc_oob_right(void) > return; > } > > - ptr[size] = 0; > + if (IS_ENABLED(CONFIG_KASAN_GENERIC)) > + ptr[size] = 0; > + else > + ptr[size + 6] = 0; > + > kfree(ptr); > } > > @@ -162,7 +170,11 @@ static noinline void __init kmalloc_oob_krealloc_more(void) > return; > } > > - ptr2[size2] = 'x'; > + if (IS_ENABLED(CONFIG_KASAN_GENERIC)) > + ptr2[size2] = 'x'; > + else > + ptr2[size2 + 13] = 'x'; > + > kfree(ptr2); > } > > @@ -180,7 +192,12 @@ static noinline void __init kmalloc_oob_krealloc_less(void) > kfree(ptr1); > return; > } > - ptr2[size2] = 'x'; > + > + if (IS_ENABLED(CONFIG_KASAN_GENERIC)) > + ptr2[size2] = 'x'; > + else > + ptr2[size2 + 2] = 'x'; > + > kfree(ptr2); > } > > @@ -216,7 +233,11 @@ static noinline void __init kmalloc_oob_memset_2(void) > return; > } > > - memset(ptr+7, 0, 2); > + if (IS_ENABLED(CONFIG_KASAN_GENERIC)) > + memset(ptr+7, 0, 2); > + else > + memset(ptr+15, 0, 2); > + > kfree(ptr); > } > > @@ -232,7 +253,11 @@ static noinline void __init kmalloc_oob_memset_4(void) > return; > } > > - memset(ptr+5, 0, 4); > + if (IS_ENABLED(CONFIG_KASAN_GENERIC)) > + memset(ptr+5, 0, 4); > + else > + memset(ptr+15, 0, 4); > + > kfree(ptr); > } > > @@ -249,7 +274,11 @@ static noinline void __init kmalloc_oob_memset_8(void) > return; > } > > - memset(ptr+1, 0, 8); > + if (IS_ENABLED(CONFIG_KASAN_GENERIC)) > + memset(ptr+1, 0, 8); > + else > + memset(ptr+15, 0, 8); > + > kfree(ptr); > } > > @@ -265,7 +294,11 @@ static noinline void __init kmalloc_oob_memset_16(void) > return; > } > > - memset(ptr+1, 0, 16); > + if (IS_ENABLED(CONFIG_KASAN_GENERIC)) > + memset(ptr+1, 0, 16); > + else > + memset(ptr+15, 0, 16); > + > kfree(ptr); > } > > @@ -281,7 +314,11 @@ static noinline void __init kmalloc_oob_in_memset(void) > return; > } > > - memset(ptr, 0, size+5); > + if (IS_ENABLED(CONFIG_KASAN_GENERIC)) > + memset(ptr, 0, size+5); > + else > + memset(ptr, 0, size+7); > + > kfree(ptr); > } > > @@ -415,7 +452,11 @@ static noinline void __init kmem_cache_oob(void) > return; > } > > - *p = p[size]; > + if (IS_ENABLED(CONFIG_KASAN_GENERIC)) > + *p = p[size]; > + else > + *p = p[size + 8]; > + > kmem_cache_free(cache, p); > kmem_cache_destroy(cache); > } > @@ -497,6 +538,7 @@ static noinline void __init copy_user_test(void) > char __user *usermem; > size_t size = 10; > int unused; > + size_t oob_size; > > kmem = kmalloc(size, GFP_KERNEL); > if (!kmem) > @@ -511,26 +553,31 @@ static noinline void __init copy_user_test(void) > return; > } > > + if (IS_ENABLED(CONFIG_KASAN_GENERIC)) > + oob_size = 1; > + else > + oob_size = 7; > + > pr_info("out-of-bounds in copy_from_user()\n"); > - unused = copy_from_user(kmem, usermem, size + 1); > + unused = copy_from_user(kmem, usermem, size + oob_size); > > pr_info("out-of-bounds in copy_to_user()\n"); > - unused = copy_to_user(usermem, kmem, size + 1); > + unused = copy_to_user(usermem, kmem, size + oob_size); > > pr_info("out-of-bounds in __copy_from_user()\n"); > - unused = __copy_from_user(kmem, usermem, size + 1); > + unused = __copy_from_user(kmem, usermem, size + oob_size); > > pr_info("out-of-bounds in __copy_to_user()\n"); > - unused = __copy_to_user(usermem, kmem, size + 1); > + unused = __copy_to_user(usermem, kmem, size + oob_size); > > pr_info("out-of-bounds in __copy_from_user_inatomic()\n"); > - unused = __copy_from_user_inatomic(kmem, usermem, size + 1); > + unused = __copy_from_user_inatomic(kmem, usermem, size + oob_size); > > pr_info("out-of-bounds in __copy_to_user_inatomic()\n"); > - unused = __copy_to_user_inatomic(usermem, kmem, size + 1); > + unused = __copy_to_user_inatomic(usermem, kmem, size + oob_size); > > pr_info("out-of-bounds in strncpy_from_user()\n"); > - unused = strncpy_from_user(kmem, usermem, size + 1); > + unused = strncpy_from_user(kmem, usermem, size + oob_size); > > vm_munmap((unsigned long)usermem, PAGE_SIZE); > kfree(kmem); > -- > 2.18.0 > > -- > You received this message because you are subscribed to the Google Groups "kasan-dev" group. > To unsubscribe from this group and stop receiving emails from it, send an email to kasan-dev+unsubscribe@googlegroups.com. > To view this discussion on the web visit https://groups.google.com/d/msgid/kasan-dev/20200706022150.20848-1-walter-zh.wu%40mediatek.com.