* [PATCH] mm/kasan: Fix false positive invalid-free reports with CONFIG_KASAN_SW_TAGS=y
@ 2019-08-19 17:25 Andrey Ryabinin
2019-08-20 18:23 ` Andrey Konovalov
0 siblings, 1 reply; 2+ messages in thread
From: Andrey Ryabinin @ 2019-08-19 17:25 UTC (permalink / raw)
To: Andrew Morton
Cc: Walter Wu, Alexander Potapenko, Dmitry Vyukov, Catalin Marinas,
Will Deacon, Andrey Konovalov, linux-kernel, kasan-dev,
Mark Rutland, Andrey Ryabinin, stable
The code like this:
ptr = kmalloc(size, GFP_KERNEL);
page = virt_to_page(ptr);
offset = offset_in_page(ptr);
kfree(page_address(page) + offset);
may produce false-positive invalid-free reports on the kernel with
CONFIG_KASAN_SW_TAGS=y.
In the example above we loose the original tag assigned to 'ptr',
so kfree() gets the pointer with 0xFF tag. In kfree() we check that
0xFF tag is different from the tag in shadow hence print false report.
Instead of just comparing tags, do the following:
1) Check that shadow doesn't contain KASAN_TAG_INVALID. Otherwise it's
double-free and it doesn't matter what tag the pointer have.
2) If pointer tag is different from 0xFF, make sure that tag in the shadow
is the same as in the pointer.
Fixes: 7f94ffbc4c6a ("kasan: add hooks implementation for tag-based mode")
Signed-off-by: Andrey Ryabinin <aryabinin@virtuozzo.com>
Reported-by: Walter Wu <walter-zh.wu@mediatek.com>
Reported-by: Mark Rutland <mark.rutland@arm.com>
Cc: <stable@vger.kernel.org>
---
mm/kasan/common.c | 10 ++++++++--
1 file changed, 8 insertions(+), 2 deletions(-)
diff --git a/mm/kasan/common.c b/mm/kasan/common.c
index 895dc5e2b3d5..3b8cde0cb5b2 100644
--- a/mm/kasan/common.c
+++ b/mm/kasan/common.c
@@ -406,8 +406,14 @@ static inline bool shadow_invalid(u8 tag, s8 shadow_byte)
if (IS_ENABLED(CONFIG_KASAN_GENERIC))
return shadow_byte < 0 ||
shadow_byte >= KASAN_SHADOW_SCALE_SIZE;
- else
- return tag != (u8)shadow_byte;
+
+ /* else CONFIG_KASAN_SW_TAGS: */
+ if ((u8)shadow_byte == KASAN_TAG_INVALID)
+ return true;
+ if ((tag != KASAN_TAG_KERNEL) && (tag != (u8)shadow_byte))
+ return true;
+
+ return false;
}
static bool __kasan_slab_free(struct kmem_cache *cache, void *object,
--
2.21.0
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [PATCH] mm/kasan: Fix false positive invalid-free reports with CONFIG_KASAN_SW_TAGS=y
2019-08-19 17:25 [PATCH] mm/kasan: Fix false positive invalid-free reports with CONFIG_KASAN_SW_TAGS=y Andrey Ryabinin
@ 2019-08-20 18:23 ` Andrey Konovalov
0 siblings, 0 replies; 2+ messages in thread
From: Andrey Konovalov @ 2019-08-20 18:23 UTC (permalink / raw)
To: Andrey Ryabinin
Cc: Andrew Morton, Walter Wu, Alexander Potapenko, Dmitry Vyukov,
Catalin Marinas, Will Deacon, LKML, kasan-dev, Mark Rutland,
stable
On Mon, Aug 19, 2019 at 7:26 PM Andrey Ryabinin <aryabinin@virtuozzo.com> wrote:
>
> The code like this:
>
> ptr = kmalloc(size, GFP_KERNEL);
> page = virt_to_page(ptr);
> offset = offset_in_page(ptr);
> kfree(page_address(page) + offset);
>
> may produce false-positive invalid-free reports on the kernel with
> CONFIG_KASAN_SW_TAGS=y.
>
> In the example above we loose the original tag assigned to 'ptr',
> so kfree() gets the pointer with 0xFF tag. In kfree() we check that
> 0xFF tag is different from the tag in shadow hence print false report.
>
> Instead of just comparing tags, do the following:
> 1) Check that shadow doesn't contain KASAN_TAG_INVALID. Otherwise it's
> double-free and it doesn't matter what tag the pointer have.
>
> 2) If pointer tag is different from 0xFF, make sure that tag in the shadow
> is the same as in the pointer.
>
> Fixes: 7f94ffbc4c6a ("kasan: add hooks implementation for tag-based mode")
> Signed-off-by: Andrey Ryabinin <aryabinin@virtuozzo.com>
> Reported-by: Walter Wu <walter-zh.wu@mediatek.com>
> Reported-by: Mark Rutland <mark.rutland@arm.com>
> Cc: <stable@vger.kernel.org>
Reviewed-by: Andrey Konovalov <andreyknvl@google.com>
> ---
> mm/kasan/common.c | 10 ++++++++--
> 1 file changed, 8 insertions(+), 2 deletions(-)
>
> diff --git a/mm/kasan/common.c b/mm/kasan/common.c
> index 895dc5e2b3d5..3b8cde0cb5b2 100644
> --- a/mm/kasan/common.c
> +++ b/mm/kasan/common.c
> @@ -406,8 +406,14 @@ static inline bool shadow_invalid(u8 tag, s8 shadow_byte)
> if (IS_ENABLED(CONFIG_KASAN_GENERIC))
> return shadow_byte < 0 ||
> shadow_byte >= KASAN_SHADOW_SCALE_SIZE;
> - else
> - return tag != (u8)shadow_byte;
> +
> + /* else CONFIG_KASAN_SW_TAGS: */
> + if ((u8)shadow_byte == KASAN_TAG_INVALID)
> + return true;
> + if ((tag != KASAN_TAG_KERNEL) && (tag != (u8)shadow_byte))
> + return true;
> +
> + return false;
> }
>
> static bool __kasan_slab_free(struct kmem_cache *cache, void *object,
> --
> 2.21.0
>
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2019-08-20 18:23 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2019-08-19 17:25 [PATCH] mm/kasan: Fix false positive invalid-free reports with CONFIG_KASAN_SW_TAGS=y Andrey Ryabinin
2019-08-20 18:23 ` Andrey Konovalov
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).