From: Ard Biesheuvel <ardb@kernel.org>
To: Florian Fainelli <f.fainelli@gmail.com>
Cc: linux-arm-kernel <linux-arm-kernel@lists.infradead.org>,
Andrey Ryabinin <ryabinin@virtuozzo.com>,
Abbott Liu <liuwenliang@huawei.com>,
bcm-kernel-feedback-list@broadcom.com,
Alexander Potapenko <glider@google.com>,
Dmitry Vyukov <dvyukov@google.com>,
Jonathan Corbet <corbet@lwn.net>,
Russell King <linux@armlinux.org.uk>,
Christoffer Dall <christoffer.dall@arm.com>,
Marc Zyngier <marc.zyngier@arm.com>,
Arnd Bergmann <arnd@arndb.de>, Nicolas Pitre <nico@fluxnic.net>,
Vladimir Murzin <vladimir.murzin@arm.com>,
Kees Cook <keescook@chromium.org>,
Jinbum Park <jinb.park7@gmail.com>,
Alexandre Belloni <alexandre.belloni@bootlin.com>,
Daniel Lezcano <daniel.lezcano@linaro.org>,
Philippe Ombredanne <pombredanne@nexb.com>,
Rob Landley <rob@landley.net>,
Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
Andrew Morton <akpm@linux-foundation.org>,
Mark Rutland <mark.rutland@arm.com>,
Catalin Marinas <catalin.marinas@arm.com>,
Masahiro Yamada <yamada.masahiro@socionext.com>,
Thomas Gleixner <tglx@linutronix.de>,
Thomas Garnier <thgarnie@google.com>,
David Howells <dhowells@redhat.com>,
Geert Uytterhoeven <geert@linux-m68k.org>,
Andre Przywara <andre.przywara@arm.com>,
Julien Thierry <julien.thierry@arm.com>,
Andrew Jones <drjones@redhat.com>,
Philip Derrin <philip@cog.systems>,
Michal Hocko <mhocko@suse.com>,
"Kirill A. Shutemov" <kirill.shutemov@linux.intel.com>,
kasan-dev <kasan-dev@googlegroups.com>,
Linux Doc Mailing List <linux-doc@vger.kernel.org>,
Linux Kernel Mailing List <linux-kernel@vger.kernel.org>,
kvmarm <kvmarm@lists.cs.columbia.edu>,
Andrey Ryabinin <ryabinin.a.a@gmail.com>
Subject: Re: [PATCH v7 7/7] ARM: Enable KASan for ARM
Date: Fri, 10 Apr 2020 12:45:34 +0200 [thread overview]
Message-ID: <CAKv+Gu_6wWhi418=GpMjfMpE2E+XHbL-DYKT8MJ1jE3+VybrAg@mail.gmail.com> (raw)
In-Reply-To: <20200117224839.23531-8-f.fainelli@gmail.com>
On Fri, 17 Jan 2020 at 23:52, Florian Fainelli <f.fainelli@gmail.com> wrote:
>
> From: Andrey Ryabinin <ryabinin@virtuozzo.com>
>
> This patch enables the kernel address sanitizer for ARM. XIP_KERNEL has
> not been tested and is therefore not allowed.
>
> Acked-by: Dmitry Vyukov <dvyukov@google.com>
> Tested-by: Linus Walleij <linus.walleij@linaro.org>
> Signed-off-by: Abbott Liu <liuwenliang@huawei.com>
> Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
> ---
> Documentation/dev-tools/kasan.rst | 4 ++--
> arch/arm/Kconfig | 9 +++++++++
> arch/arm/boot/compressed/Makefile | 1 +
> drivers/firmware/efi/libstub/Makefile | 3 ++-
> 4 files changed, 14 insertions(+), 3 deletions(-)
>
> diff --git a/Documentation/dev-tools/kasan.rst b/Documentation/dev-tools/kasan.rst
> index e4d66e7c50de..6acd949989c3 100644
> --- a/Documentation/dev-tools/kasan.rst
> +++ b/Documentation/dev-tools/kasan.rst
> @@ -21,8 +21,8 @@ global variables yet.
>
> Tag-based KASAN is only supported in Clang and requires version 7.0.0 or later.
>
> -Currently generic KASAN is supported for the x86_64, arm64, xtensa and s390
> -architectures, and tag-based KASAN is supported only for arm64.
> +Currently generic KASAN is supported for the x86_64, arm, arm64, xtensa and
> +s390 architectures, and tag-based KASAN is supported only for arm64.
>
> Usage
> -----
> diff --git a/arch/arm/Kconfig b/arch/arm/Kconfig
> index 96dab76da3b3..70a7eb50984e 100644
> --- a/arch/arm/Kconfig
> +++ b/arch/arm/Kconfig
> @@ -65,6 +65,7 @@ config ARM
> select HAVE_ARCH_BITREVERSE if (CPU_32v7M || CPU_32v7) && !CPU_32v6
> select HAVE_ARCH_JUMP_LABEL if !XIP_KERNEL && !CPU_ENDIAN_BE32 && MMU
> select HAVE_ARCH_KGDB if !CPU_ENDIAN_BE32 && MMU
> + select HAVE_ARCH_KASAN if MMU && !XIP_KERNEL
> select HAVE_ARCH_MMAP_RND_BITS if MMU
> select HAVE_ARCH_SECCOMP_FILTER if AEABI && !OABI_COMPAT
> select HAVE_ARCH_THREAD_STRUCT_WHITELIST
> @@ -212,6 +213,14 @@ config ARCH_MAY_HAVE_PC_FDC
> config ZONE_DMA
> bool
>
> +config KASAN_SHADOW_OFFSET
> + hex
> + depends on KASAN
> + default 0x1f000000 if PAGE_OFFSET=0x40000000
> + default 0x5f000000 if PAGE_OFFSET=0x80000000
> + default 0x9f000000 if PAGE_OFFSET=0xC0000000
> + default 0xffffffff
> +
> config ARCH_SUPPORTS_UPROBES
> def_bool y
>
> diff --git a/arch/arm/boot/compressed/Makefile b/arch/arm/boot/compressed/Makefile
> index 83991a0447fa..efda24b00a44 100644
> --- a/arch/arm/boot/compressed/Makefile
> +++ b/arch/arm/boot/compressed/Makefile
> @@ -25,6 +25,7 @@ endif
>
> GCOV_PROFILE := n
> KASAN_SANITIZE := n
> +CFLAGS_KERNEL += -D__SANITIZE_ADDRESS__
>
> # Prevents link failures: __sanitizer_cov_trace_pc() is not linked in.
> KCOV_INSTRUMENT := n
> diff --git a/drivers/firmware/efi/libstub/Makefile b/drivers/firmware/efi/libstub/Makefile
> index c35f893897e1..c8b36824189b 100644
> --- a/drivers/firmware/efi/libstub/Makefile
> +++ b/drivers/firmware/efi/libstub/Makefile
> @@ -20,7 +20,8 @@ cflags-$(CONFIG_ARM64) := $(subst $(CC_FLAGS_FTRACE),,$(KBUILD_CFLAGS)) \
> -fpie $(DISABLE_STACKLEAK_PLUGIN)
> cflags-$(CONFIG_ARM) := $(subst $(CC_FLAGS_FTRACE),,$(KBUILD_CFLAGS)) \
> -fno-builtin -fpic \
> - $(call cc-option,-mno-single-pic-base)
> + $(call cc-option,-mno-single-pic-base) \
> + -D__SANITIZE_ADDRESS__
>
I am not too crazy about this need to unconditionally 'enable' KASAN
on the command line like this, in order to be able to disable it again
when CONFIG_KASAN=y.
Could we instead add something like this at the top of
arch/arm/boot/compressed/string.c?
#ifdef CONFIG_KASAN
#undef memcpy
#undef memmove
#undef memset
void *__memcpy(void *__dest, __const void *__src, size_t __n) __alias(memcpy);
void *__memmove(void *__dest, __const void *__src, size_t count)
__alias(memmove);
void *__memset(void *s, int c, size_t count) __alias(memset);
#endif
next prev parent reply other threads:[~2020-04-10 10:45 UTC|newest]
Thread overview: 11+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-01-17 22:48 [PATCH v7 0/7] KASan for arm Florian Fainelli
2020-01-17 22:48 ` [PATCH v7 1/7] ARM: Moved CP15 definitions from kvm_hyp.h to cp15.h Florian Fainelli
2020-01-17 22:48 ` [PATCH v7 2/7] ARM: Add TTBR operator for kasan_init Florian Fainelli
2020-01-17 22:48 ` [PATCH v7 3/7] ARM: Disable instrumentation for some code Florian Fainelli
2020-01-17 22:48 ` [PATCH v7 4/7] ARM: Replace memory function for kasan Florian Fainelli
2020-01-17 22:48 ` [PATCH v7 5/7] ARM: Define the virtual space of KASan's shadow region Florian Fainelli
2020-01-17 22:48 ` [PATCH v7 6/7] ARM: Initialize the mapping of KASan shadow memory Florian Fainelli
2020-01-17 22:48 ` [PATCH v7 7/7] ARM: Enable KASan for ARM Florian Fainelli
2020-04-10 10:45 ` Ard Biesheuvel [this message]
2020-04-10 10:47 ` Ard Biesheuvel
2020-04-12 0:33 ` Linus Walleij
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to='CAKv+Gu_6wWhi418=GpMjfMpE2E+XHbL-DYKT8MJ1jE3+VybrAg@mail.gmail.com' \
--to=ardb@kernel.org \
--cc=akpm@linux-foundation.org \
--cc=alexandre.belloni@bootlin.com \
--cc=andre.przywara@arm.com \
--cc=arnd@arndb.de \
--cc=bcm-kernel-feedback-list@broadcom.com \
--cc=catalin.marinas@arm.com \
--cc=christoffer.dall@arm.com \
--cc=corbet@lwn.net \
--cc=daniel.lezcano@linaro.org \
--cc=dhowells@redhat.com \
--cc=drjones@redhat.com \
--cc=dvyukov@google.com \
--cc=f.fainelli@gmail.com \
--cc=geert@linux-m68k.org \
--cc=glider@google.com \
--cc=gregkh@linuxfoundation.org \
--cc=jinb.park7@gmail.com \
--cc=julien.thierry@arm.com \
--cc=kasan-dev@googlegroups.com \
--cc=keescook@chromium.org \
--cc=kirill.shutemov@linux.intel.com \
--cc=kvmarm@lists.cs.columbia.edu \
--cc=linux-arm-kernel@lists.infradead.org \
--cc=linux-doc@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux@armlinux.org.uk \
--cc=liuwenliang@huawei.com \
--cc=marc.zyngier@arm.com \
--cc=mark.rutland@arm.com \
--cc=mhocko@suse.com \
--cc=nico@fluxnic.net \
--cc=philip@cog.systems \
--cc=pombredanne@nexb.com \
--cc=rob@landley.net \
--cc=ryabinin.a.a@gmail.com \
--cc=ryabinin@virtuozzo.com \
--cc=tglx@linutronix.de \
--cc=thgarnie@google.com \
--cc=vladimir.murzin@arm.com \
--cc=yamada.masahiro@socionext.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).