From: Andrey Konovalov <andreyknvl@google.com>
To: Luc Van Oostenryck <luc.vanoostenryck@gmail.com>
Cc: Dave Martin <Dave.Martin@arm.com>,
Mark Rutland <mark.rutland@arm.com>,
Kate Stewart <kstewart@linuxfoundation.org>,
linux-doc@vger.kernel.org,
Catalin Marinas <catalin.marinas@arm.com>,
Will Deacon <will.deacon@arm.com>,
Paul Lawrence <paullawrence@google.com>,
Linux Memory Management List <linux-mm@kvack.org>,
Alexander Potapenko <glider@google.com>,
Chintan Pandya <cpandya@codeaurora.org>,
Christoph Lameter <cl@linux.com>, Ingo Molnar <mingo@kernel.org>,
Jacob Bramley <Jacob.Bramley@arm.com>,
Jann Horn <jannh@google.com>, Mark Brand <markbrand@google.com>,
kasan-dev <kasan-dev@googlegroups.com>,
linux-sparse@vger.kernel.org,
Geert Uytterhoeven <geert@linux-m68k.org>,
Linux ARM <linux-arm-kernel@lists.infradead.org>,
Andrey Ryabinin <aryabinin@virtuozzo.com>,
Evgeniy Stepanov <eugenis@google.com>,
Arnd Bergmann <arnd@arndb.de>,
Linux Kbuild mailing list <linux-kbuild@vger.kernel.org>,
Marc Zyngier <marc.zyngier@arm.com>,
Ramana Radhakrishnan <Ramana.Radhakrishnan@arm.com>,
Ruben Ayrapetyan <Ruben.Ayrapetyan@arm.com>,
Mike Rapoport <rppt@linux.vnet.ibm.com>,
Dmitry Vyukov <dvyukov@google.com>,
Kostya Serebryany <kcc@google.com>,
Ard Biesheuvel <ard.biesheuvel@linaro.org>,
Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
Nick Desaulniers <ndesaulniers@google.com>,
LKML <linux-kernel@vger.kernel.org>,
"Eric W . Biederman" <ebiederm@xmission.com>,
Lee Smith <Lee.Smith@arm.com>,
Andrew Morton <akpm@linux-foundation.org>,
"Kirill A . Shutemov" <kirill.shutemov@linux.intel.com>,
smatch@vger.kernel.org, Dan Carpenter <dan.carpenter@oracle.com>
Subject: Re: [PATCH v4 00/17] khwasan: kernel hardware assisted address sanitizer
Date: Fri, 29 Jun 2018 15:18:31 +0200 [thread overview]
Message-ID: <CAAeHK+zXzTEo_DJ5a7KaVDQa06Gx98Oj2O3jMFJo_tNgkq822g@mail.gmail.com> (raw)
In-Reply-To: <20180629112613.7i4xesjyxolc63gu@ltop.local>
On Fri, Jun 29, 2018 at 1:26 PM, Luc Van Oostenryck
<luc.vanoostenryck@gmail.com> wrote:
> On Fri, Jun 29, 2018 at 12:04:22PM +0100, Dave Martin wrote:
>>
>> Can sparse be hacked to identify pointer subtractions where the pointers
>> are cannot be statically proved to point into the same allocation?
Re all the comments about finding all the places where we do pointer
subtraction/comparison:
I might be wrong, but I doubt you can easily do that with static analysis.
What we could do is to try to detect all such subtractions/comparisons
dynamically. The idea is to instrument all pointer/ulong
subtraction/comparison instructions and try to detect tags mismatch.
And then run some workload (e.g. syzkaller) to trigger more kernel
code. The question is how much false positives we would get, since I
imagine there would be a number of cases when we compare some random
ulongs.
next prev parent reply other threads:[~2018-06-29 13:18 UTC|newest]
Thread overview: 68+ messages / expand[flat|nested] mbox.gz Atom feed top
2018-06-26 13:15 [PATCH v4 00/17] khwasan: kernel hardware assisted address sanitizer Andrey Konovalov
2018-06-26 13:15 ` [PATCH v4 01/17] khwasan, mm: change kasan hooks signatures Andrey Konovalov
2018-06-26 13:15 ` [PATCH v4 02/17] khwasan: move common kasan and khwasan code to common.c Andrey Konovalov
2018-06-26 13:15 ` [PATCH v4 03/17] khwasan: add CONFIG_KASAN_GENERIC and CONFIG_KASAN_HW Andrey Konovalov
2018-06-26 13:15 ` [PATCH v4 04/17] khwasan, arm64: adjust shadow size for CONFIG_KASAN_HW Andrey Konovalov
2018-06-26 13:15 ` [PATCH v4 05/17] khwasan: initialize shadow to 0xff Andrey Konovalov
2018-06-26 13:15 ` [PATCH v4 06/17] khwasan, arm64: untag virt address in __kimg_to_phys and _virt_addr_is_linear Andrey Konovalov
2018-06-26 13:15 ` [PATCH v4 07/17] khwasan: add tag related helper functions Andrey Konovalov
2018-06-26 13:15 ` [PATCH v4 08/17] khwasan, arm64: fix up fault handling logic Andrey Konovalov
2018-06-26 13:15 ` [PATCH v4 09/17] khwasan, arm64: enable top byte ignore for the kernel Andrey Konovalov
2018-06-26 13:15 ` [PATCH v4 10/17] khwasan, mm: perform untagged pointers comparison in krealloc Andrey Konovalov
2018-06-26 13:15 ` [PATCH v4 11/17] khwasan: split out kasan_report.c from report.c Andrey Konovalov
2018-06-26 13:15 ` [PATCH v4 12/17] khwasan: add bug reporting routines Andrey Konovalov
2018-06-26 13:15 ` [PATCH v4 13/17] khwasan: add hooks implementation Andrey Konovalov
2018-07-25 13:44 ` Vincenzo Frascino@Foss
2018-07-31 13:05 ` Andrey Konovalov
2018-07-31 14:50 ` Andrey Ryabinin
2018-07-31 15:03 ` Dmitry Vyukov
2018-07-31 15:38 ` Christopher Lameter
2018-07-31 16:03 ` Dmitry Vyukov
2018-07-31 16:04 ` Andrey Ryabinin
2018-07-31 16:08 ` Dmitry Vyukov
2018-07-31 16:18 ` Andrey Ryabinin
2018-07-31 15:21 ` Andrey Konovalov
2018-06-26 13:15 ` [PATCH v4 14/17] khwasan, arm64: add brk handler for inline instrumentation Andrey Konovalov
2018-06-26 13:15 ` [PATCH v4 15/17] khwasan, mm, arm64: tag non slab memory allocated via pagealloc Andrey Konovalov
2018-06-26 13:15 ` [PATCH v4 16/17] khwasan: update kasan documentation Andrey Konovalov
2018-06-26 13:15 ` [PATCH v4 17/17] kasan: add SPDX-License-Identifier mark to source files Andrey Konovalov
2018-06-27 23:08 ` [PATCH v4 00/17] khwasan: kernel hardware assisted address sanitizer Andrew Morton
2018-06-28 0:04 ` Kostya Serebryany
[not found] ` <CAEZpscCcP6=O_OCqSwW8Y6u9Ee99SzWN+hRcgpP2tK=OEBFnNw@mail.gmail.com>
2018-06-28 1:11 ` Andrew Morton
2018-06-28 18:26 ` Andrey Konovalov
2018-06-28 7:01 ` Geert Uytterhoeven
2018-07-02 20:33 ` Matthew Wilcox
2018-07-02 23:39 ` Evgenii Stepanov
2018-06-28 18:29 ` Andrey Konovalov
2018-06-28 19:40 ` Andrew Morton
2018-06-29 12:45 ` Andrey Konovalov
2018-06-29 13:01 ` Mark Rutland
2018-06-29 14:40 ` Andrey Konovalov
2018-06-30 2:41 ` Andrew Morton
2018-07-02 19:16 ` Evgenii Stepanov
2018-07-02 19:21 ` Andrew Morton
2018-07-02 20:22 ` Evgenii Stepanov
2018-07-02 20:30 ` Andrew Morton
2018-06-28 10:51 ` Dave Martin
2018-06-28 18:56 ` Andrey Konovalov
2018-06-29 10:14 ` Mark Rutland
2018-06-29 11:04 ` Dave Martin
2018-06-29 11:26 ` Luc Van Oostenryck
2018-06-29 13:18 ` Andrey Konovalov [this message]
2018-06-29 13:42 ` Dan Carpenter
2018-06-29 11:07 ` Catalin Marinas
2018-06-29 11:07 ` Will Deacon
2018-06-29 16:36 ` Andrey Konovalov
2018-07-03 17:36 ` Will Deacon
2018-07-18 17:16 ` Andrey Konovalov
2018-07-31 13:22 ` Andrey Konovalov
2018-08-01 16:35 ` Will Deacon
2018-08-01 16:52 ` Dmitry Vyukov
2018-08-02 11:10 ` Catalin Marinas
2018-08-02 11:36 ` Dmitry Vyukov
2018-08-02 13:52 ` Catalin Marinas
2018-08-02 14:11 ` Andrey Ryabinin
2018-08-03 9:23 ` Will Deacon
2018-08-03 9:42 ` Dmitry Vyukov
2018-08-08 16:27 ` Will Deacon
2018-08-08 16:53 ` Dmitry Vyukov
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=CAAeHK+zXzTEo_DJ5a7KaVDQa06Gx98Oj2O3jMFJo_tNgkq822g@mail.gmail.com \
--to=andreyknvl@google.com \
--cc=Dave.Martin@arm.com \
--cc=Jacob.Bramley@arm.com \
--cc=Lee.Smith@arm.com \
--cc=Ramana.Radhakrishnan@arm.com \
--cc=Ruben.Ayrapetyan@arm.com \
--cc=akpm@linux-foundation.org \
--cc=ard.biesheuvel@linaro.org \
--cc=arnd@arndb.de \
--cc=aryabinin@virtuozzo.com \
--cc=catalin.marinas@arm.com \
--cc=cl@linux.com \
--cc=cpandya@codeaurora.org \
--cc=dan.carpenter@oracle.com \
--cc=dvyukov@google.com \
--cc=ebiederm@xmission.com \
--cc=eugenis@google.com \
--cc=geert@linux-m68k.org \
--cc=glider@google.com \
--cc=gregkh@linuxfoundation.org \
--cc=jannh@google.com \
--cc=kasan-dev@googlegroups.com \
--cc=kcc@google.com \
--cc=kirill.shutemov@linux.intel.com \
--cc=kstewart@linuxfoundation.org \
--cc=linux-arm-kernel@lists.infradead.org \
--cc=linux-doc@vger.kernel.org \
--cc=linux-kbuild@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-mm@kvack.org \
--cc=linux-sparse@vger.kernel.org \
--cc=luc.vanoostenryck@gmail.com \
--cc=marc.zyngier@arm.com \
--cc=mark.rutland@arm.com \
--cc=markbrand@google.com \
--cc=mingo@kernel.org \
--cc=ndesaulniers@google.com \
--cc=paullawrence@google.com \
--cc=rppt@linux.vnet.ibm.com \
--cc=smatch@vger.kernel.org \
--cc=will.deacon@arm.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).