From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 48785C433F5 for ; Mon, 28 Mar 2022 11:58:17 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S242188AbiC1L74 (ORCPT ); Mon, 28 Mar 2022 07:59:56 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:41794 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S242153AbiC1L5t (ORCPT ); Mon, 28 Mar 2022 07:57:49 -0400 Received: from casper.infradead.org (casper.infradead.org [IPv6:2001:8b0:10b:1236::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 9BEA631DFB; Mon, 28 Mar 2022 04:54:42 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=infradead.org; s=casper.20170209; h=In-Reply-To:Content-Type:MIME-Version: References:Message-ID:Subject:Cc:To:From:Date:Sender:Reply-To: Content-Transfer-Encoding:Content-ID:Content-Description; bh=V8SPwDvoJviYgsUTGhN1PbWTTa7UH/mLN46SQAz/mHM=; b=LeSH7zKYa2ASEHhCVpTn2c0IRh 08dAntK5bJWlCZMV/6R+8Ea3GZNpADKzqX32Lheclvr5DzcF/cDB1PZosWLuoXBqxdUgdMZdpl8hP 2/AjAtRXaojXWOuAmg/RPcN7AbJXz9OK3QZrWwSAQ7eRize9TTenjXk4bh3cKAKyngJUWmL/uUj+F lafpZQHgS200OScp4Q7we+evlYQZg7Sfi1PUeWZf79TUtaR/PQ2f7SKohLGuYw67I0SK+c1587mDn 2J0NUCfDM5t+6vAGPs39FJofyDY7eVTyCsA/dSbszDaRg6U7C166QERGq93riN+uVPf6SH/DfVcyc /MhIntCg==; Received: from j217100.upc-j.chello.nl ([24.132.217.100] helo=worktop.programming.kicks-ass.net) by casper.infradead.org with esmtpsa (Exim 4.94.2 #2 (Red Hat Linux)) id 1nYnx7-00GsqX-2c; Mon, 28 Mar 2022 11:54:29 +0000 Received: by worktop.programming.kicks-ass.net (Postfix, from userid 1000) id F01849861E7; Mon, 28 Mar 2022 13:54:26 +0200 (CEST) Date: Mon, 28 Mar 2022 13:54:26 +0200 From: Peter Zijlstra To: Jakub Jelinek Cc: Mark Rutland , Segher Boessenkool , Nick Desaulniers , Borislav Petkov , Nathan Chancellor , x86-ml , lkml , llvm@lists.linux.dev, Josh Poimboeuf , linux-toolchains@vger.kernel.org Subject: Re: clang memcpy calls Message-ID: <20220328115426.GB8939@worktop.programming.kicks-ass.net> References: <20220325151238.GB614@gate.crashing.org> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Mon, Mar 28, 2022 at 12:20:39PM +0200, Jakub Jelinek wrote: > On Mon, Mar 28, 2022 at 10:52:54AM +0100, Mark Rutland wrote: > > I think we're talking past each other here, so let me be more precise. :) > > > > The key thing is that when the user passes `-fsantize=address`, instrumentation > > is added by (a part of) the compiler. That instrumentation is added under some > > assumptions as to how the compiler as a whole will behave. > > > > With that in mind, the question is how is __attribute__((no_sanitize_address)) > > intended to work when considering all the usual expectations around how the > > compiler can play with memcpy and similar? > > no_sanitize_address or lack thereof is whether the current function > shouldn't be or should be ASan instrumented, not on whether other functions > it calls are instrumented or not. memcpy/memmove/memset are just a tiny bit > special case because the compiler can add them on their own even if they > aren't present in the source (there are a few others the compiler can > pattern match too) and various builtins can be on the other side expanded > inline instead of called, so one then gets the sanitization status of the > function in which it is used rather than whether the out of line > implementation of the function is sanitized. > > If coexistence of instrumented and non-instrumented memcpy etc. was the goal > (it clearly wasn't), then the sanitizer libraries wouldn't be overriding > memcpy calls, but instead the compiler would redirect calls to memcpy in > instrumented functions to say __asan_memcpy which then would be > instrumented. This then leaves us holding the pieces because this behaviour is actively wrong. A non-instrumented function *MUST*NOT* call an instrumented function, ever. This very much violates how we use/expect __attribute__((no_sanitize_address)) to work. If we use that on a function, we expect/rely on that function (nor any compiler tranformation thereof) to *NOT* have instrumentation. This is a hard correctness requirement that cannot be argued with. So there's two options: A) compiler generates implicit mem*() calls with the knowledge that mem*() is not instrumentet, and as such will also emit instrumentation for it when so required (or calls mem*_asan() like functions. B) compiler knows mem*() are instrumented, at which point the implicit mem*() calls are no longer equivalent under __attribute__((no_sanitize_address)) and will no longer perform these substitutions. At some point this becomes a choice between being able to boot or having KASAN, choice is simple.