From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-14.4 required=3.0 tests=DKIMWL_WL_MED,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_PATCH, MAILING_LIST_MULTI,SIGNED_OFF_BY,SPF_HELO_NONE,SPF_PASS,USER_IN_DEF_DKIM_WL autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 3FF8DC433E0 for ; Mon, 6 Jul 2020 12:14:31 +0000 (UTC) Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by mail.kernel.org (Postfix) with ESMTP id E0CF82070C for ; Mon, 6 Jul 2020 12:14:30 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b="nko1XfT+" DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org E0CF82070C Authentication-Results: mail.kernel.org; dmarc=fail (p=reject dis=none) header.from=google.com Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=owner-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix) id 61D386B002E; Mon, 6 Jul 2020 08:14:30 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id 5CC746B0030; Mon, 6 Jul 2020 08:14:30 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 493286B0031; Mon, 6 Jul 2020 08:14:30 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from forelay.hostedemail.com (smtprelay0128.hostedemail.com [216.40.44.128]) by kanga.kvack.org (Postfix) with ESMTP id 2FC556B002E for ; Mon, 6 Jul 2020 08:14:30 -0400 (EDT) Received: from smtpin20.hostedemail.com (10.5.19.251.rfc1918.com [10.5.19.251]) by forelay04.hostedemail.com (Postfix) with ESMTP id ACAC61EF1 for ; Mon, 6 Jul 2020 12:14:29 +0000 (UTC) X-FDA: 77007543858.20.grade22_1015b9a26eab Received: from filter.hostedemail.com (10.5.16.251.rfc1918.com [10.5.16.251]) by smtpin20.hostedemail.com (Postfix) with ESMTP id 8735B180C07AF for ; Mon, 6 Jul 2020 12:14:29 +0000 (UTC) X-HE-Tag: grade22_1015b9a26eab X-Filterd-Recvd-Size: 9215 Received: from mail-qk1-f194.google.com (mail-qk1-f194.google.com [209.85.222.194]) by imf29.hostedemail.com (Postfix) with ESMTP for ; Mon, 6 Jul 2020 12:14:28 +0000 (UTC) Received: by mail-qk1-f194.google.com with SMTP id j80so34471420qke.0 for ; Mon, 06 Jul 2020 05:14:28 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=JMy1NuuvAJma8T47+ZbalKDZNjVJ2jnk0BZDVxqbCwQ=; b=nko1XfT+397vBzoTAuvb/NwaOO/bEhQhOka5qoSo1wHHzsAjJ2qSBtbij0FSm97MZf gCqkokoYGz2WZosQmEAkbDOLBldBqgRmDOlpDpSg+2GOFiU5ymPt3ZtUR/xERhVOl3C7 GfdO2bazIo5PNN2Aifia9bbkm4Nh0qnrDsQlyqJ1R1shAnHIyYiL7Xke/QTt/b5q7ybP 2N78dlx3kuyI8sjTUCluaJAIt6OxqMWQhdQoy3L/BOu4+0oLz9NDePMS6dZxtnxG1Tme 2SKE26QVvPzTnGSOjruh7dOOUCuFdOLq+/CNQz6Dywj3At2lpCXglqHrpgVJ+5c2FovB P3Qg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=JMy1NuuvAJma8T47+ZbalKDZNjVJ2jnk0BZDVxqbCwQ=; b=QmQsdgc5Gv+AFMWabqjpimFCNhGsCLibeVCcVVzmHD1XSIQyr75PjG2X9fOMQqGcJl /SfGPtfTz27MwKaV0qqAXmTG5Jrg4aYpvmCSXya7r0hu2EUPQ27UTDKcWbgqZ76qjvU1 UMa203kf8jlPLwBQsYbWy2Frcys+gSBQmrXE0yxJi7TqfcmEgRZz7fRYAMYU9qqnHGiM Pvm02Kwq7OHcH81F2UTFH1nHpudnUuovmzbYWmahcMtaPNgjJUrcM9kDoL6BrWUrI5Pl RduY09PI2uYveg5VpHoXP/5RaE9H46UjdYYpOQmDqwzwt0M1fJZqCbwkCtj2Z8ehsBHo eNIw== X-Gm-Message-State: AOAM533Ys5/4MioblRGPpbX5x0GZr5GwYNAhhJOCCm6IY1P9v5bdY6hG jvn11LnMb23TiYHCXXpTNHD1rcy60DFYlzAyf1kexg== X-Google-Smtp-Source: ABdhPJytNrgl7FBFfSK7uSG3r5AU0HOh9svUb+5HtbAWZdETRhq9lyeEea9WqHFvOoMbwo6BBpVko93H+ejfps4iN1Q= X-Received: by 2002:a05:620a:4ca:: with SMTP id 10mr47782458qks.250.1594037668024; Mon, 06 Jul 2020 05:14:28 -0700 (PDT) MIME-Version: 1.0 References: <20200706115039.16750-1-walter-zh.wu@mediatek.com> In-Reply-To: <20200706115039.16750-1-walter-zh.wu@mediatek.com> From: Dmitry Vyukov Date: Mon, 6 Jul 2020 14:14:16 +0200 Message-ID: Subject: Re: [PATCH v3] kasan: fix KASAN unit tests for tag-based KASAN To: Walter Wu Cc: Andrey Ryabinin , Alexander Potapenko , Matthias Brugger , kasan-dev , Linux-MM , LKML , Linux ARM , wsd_upstream , linux-mediatek@lists.infradead.org, Andrey Konovalov , Andrew Morton Content-Type: text/plain; charset="UTF-8" X-Rspamd-Queue-Id: 8735B180C07AF X-Spamd-Result: default: False [0.00 / 100.00] X-Rspamd-Server: rspam04 X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: On Mon, Jul 6, 2020 at 1:50 PM Walter Wu wrote: > > We use tag-based KASAN, then KASAN unit tests don't detect out-of-bounds > memory access. They need to be fixed. > > With tag-based KASAN, the state of each 16 aligned bytes of memory is > encoded in one shadow byte and the shadow value is tag of pointer, so > we need to read next shadow byte, the shadow value is not equal to tag > value of pointer, so that tag-based KASAN will detect out-of-bounds > memory access. > > Signed-off-by: Walter Wu > Suggested-by: Dmitry Vyukov > Cc: Andrey Ryabinin > Cc: Dmitry Vyukov > Cc: Alexander Potapenko > Cc: Matthias Brugger > Cc: Andrey Konovalov > Cc: Andrew Morton Acked-by: Dmitry Vyukov Thanks for fixing these tests! > --- > > changes since v1: > - Reduce amount of non-compiled code. > - KUnit-KASAN Integration patchset is not merged yet. My patch should > have conflict with it, if needed, we can continue to wait it. > > changes since v2: > - Add one marco to make unit tests more readability. > > --- > lib/test_kasan.c | 47 ++++++++++++++++++++++++++++++----------------- > 1 file changed, 30 insertions(+), 17 deletions(-) > > diff --git a/lib/test_kasan.c b/lib/test_kasan.c > index e3087d90e00d..b5049a807e25 100644 > --- a/lib/test_kasan.c > +++ b/lib/test_kasan.c > @@ -23,6 +23,8 @@ > > #include > > +#define OOB_TAG_OFF (IS_ENABLED(CONFIG_KASAN_GENERIC) ? 0 : 13) > + > /* > * Note: test functions are marked noinline so that their names appear in > * reports. > @@ -40,7 +42,8 @@ static noinline void __init kmalloc_oob_right(void) > return; > } > > - ptr[size] = 'x'; > + ptr[size + OOB_TAG_OFF] = 'x'; > + > kfree(ptr); > } > > @@ -92,7 +95,8 @@ static noinline void __init kmalloc_pagealloc_oob_right(void) > return; > } > > - ptr[size] = 0; > + ptr[size + OOB_TAG_OFF] = 0; > + > kfree(ptr); > } > > @@ -162,7 +166,8 @@ static noinline void __init kmalloc_oob_krealloc_more(void) > return; > } > > - ptr2[size2] = 'x'; > + ptr2[size2 + OOB_TAG_OFF] = 'x'; > + > kfree(ptr2); > } > > @@ -180,7 +185,9 @@ static noinline void __init kmalloc_oob_krealloc_less(void) > kfree(ptr1); > return; > } > - ptr2[size2] = 'x'; > + > + ptr2[size2 + OOB_TAG_OFF] = 'x'; > + > kfree(ptr2); > } > > @@ -216,7 +223,8 @@ static noinline void __init kmalloc_oob_memset_2(void) > return; > } > > - memset(ptr+7, 0, 2); > + memset(ptr + 7 + OOB_TAG_OFF, 0, 2); > + > kfree(ptr); > } > > @@ -232,7 +240,8 @@ static noinline void __init kmalloc_oob_memset_4(void) > return; > } > > - memset(ptr+5, 0, 4); > + memset(ptr + 5 + OOB_TAG_OFF, 0, 4); > + > kfree(ptr); > } > > @@ -249,7 +258,8 @@ static noinline void __init kmalloc_oob_memset_8(void) > return; > } > > - memset(ptr+1, 0, 8); > + memset(ptr + 1 + OOB_TAG_OFF, 0, 8); > + > kfree(ptr); > } > > @@ -265,7 +275,8 @@ static noinline void __init kmalloc_oob_memset_16(void) > return; > } > > - memset(ptr+1, 0, 16); > + memset(ptr + 1 + OOB_TAG_OFF, 0, 16); > + > kfree(ptr); > } > > @@ -281,7 +292,8 @@ static noinline void __init kmalloc_oob_in_memset(void) > return; > } > > - memset(ptr, 0, size+5); > + memset(ptr, 0, size + 5 + OOB_TAG_OFF); > + > kfree(ptr); > } > > @@ -415,7 +427,8 @@ static noinline void __init kmem_cache_oob(void) > return; > } > > - *p = p[size]; > + *p = p[size + OOB_TAG_OFF]; > + > kmem_cache_free(cache, p); > kmem_cache_destroy(cache); > } > @@ -512,25 +525,25 @@ static noinline void __init copy_user_test(void) > } > > pr_info("out-of-bounds in copy_from_user()\n"); > - unused = copy_from_user(kmem, usermem, size + 1); > + unused = copy_from_user(kmem, usermem, size + 1 + OOB_TAG_OFF); > > pr_info("out-of-bounds in copy_to_user()\n"); > - unused = copy_to_user(usermem, kmem, size + 1); > + unused = copy_to_user(usermem, kmem, size + 1 + OOB_TAG_OFF); > > pr_info("out-of-bounds in __copy_from_user()\n"); > - unused = __copy_from_user(kmem, usermem, size + 1); > + unused = __copy_from_user(kmem, usermem, size + 1 + OOB_TAG_OFF); > > pr_info("out-of-bounds in __copy_to_user()\n"); > - unused = __copy_to_user(usermem, kmem, size + 1); > + unused = __copy_to_user(usermem, kmem, size + 1 + OOB_TAG_OFF); > > pr_info("out-of-bounds in __copy_from_user_inatomic()\n"); > - unused = __copy_from_user_inatomic(kmem, usermem, size + 1); > + unused = __copy_from_user_inatomic(kmem, usermem, size + 1 + OOB_TAG_OFF); > > pr_info("out-of-bounds in __copy_to_user_inatomic()\n"); > - unused = __copy_to_user_inatomic(usermem, kmem, size + 1); > + unused = __copy_to_user_inatomic(usermem, kmem, size + 1 + OOB_TAG_OFF); > > pr_info("out-of-bounds in strncpy_from_user()\n"); > - unused = strncpy_from_user(kmem, usermem, size + 1); > + unused = strncpy_from_user(kmem, usermem, size + 1 + OOB_TAG_OFF); > > vm_munmap((unsigned long)usermem, PAGE_SIZE); > kfree(kmem); > -- > 2.18.0 > > -- > You received this message because you are subscribed to the Google Groups "kasan-dev" group. > To unsubscribe from this group and stop receiving emails from it, send an email to kasan-dev+unsubscribe@googlegroups.com. > To view this discussion on the web visit https://groups.google.com/d/msgid/kasan-dev/20200706115039.16750-1-walter-zh.wu%40mediatek.com.