From: Haibo Li <haibo.li@mediatek.com> To: <linux-kernel@vger.kernel.org> Cc: <xiaoming.yu@mediatek.com>, Andrey Ryabinin <ryabinin.a.a@gmail.com>, Alexander Potapenko <glider@google.com>, Andrey Konovalov <andreyknvl@gmail.com>, Dmitry Vyukov <dvyukov@google.com>, Vincenzo Frascino <vincenzo.frascino@arm.com>, Andrew Morton <akpm@linux-foundation.org>, Matthias Brugger <matthias.bgg@gmail.com>, AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>, <kasan-dev@googlegroups.com>, <linux-mm@kvack.org>, <linux-arm-kernel@lists.infradead.org>, <linux-mediatek@lists.infradead.org>, Haibo Li <haibo.li@mediatek.com> Subject: [PATCH] kasan:fix access invalid shadow address when input is illegal Date: Thu, 14 Sep 2023 16:08:33 +0800 [thread overview] Message-ID: <20230914080833.50026-1-haibo.li@mediatek.com> (raw) when the input address is illegal,the corresponding shadow address from kasan_mem_to_shadow may have no mapping in mmu table. Access such shadow address causes kernel oops. Here is a sample about oops on arm64(VA 39bit) with KASAN_SW_TAGS on: [ffffffb80aaaaaaa] pgd=000000005d3ce003, p4d=000000005d3ce003, pud=000000005d3ce003, pmd=0000000000000000 Internal error: Oops: 0000000096000006 [#1] PREEMPT SMP Modules linked in: CPU: 3 PID: 100 Comm: sh Not tainted 6.6.0-rc1-dirty #43 Hardware name: linux,dummy-virt (DT) pstate: 80000005 (Nzcv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : __hwasan_load8_noabort+0x5c/0x90 lr : do_ib_ob+0xf4/0x110 ffffffb80aaaaaaa is the shadow address for efffff80aaaaaaaa. The problem is reading invalid shadow in kasan_check_range. The generic kasan also has similar oops. To fix it,check shadow address by reading it with no fault. After this patch,KASAN is able to report invalid memory access for this case. Signed-off-by: Haibo Li <haibo.li@mediatek.com> --- mm/kasan/kasan.h | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-) diff --git a/mm/kasan/kasan.h b/mm/kasan/kasan.h index f70e3d7a602e..bd30f35e18b2 100644 --- a/mm/kasan/kasan.h +++ b/mm/kasan/kasan.h @@ -304,8 +304,17 @@ static __always_inline bool addr_has_metadata(const void *addr) #ifdef __HAVE_ARCH_SHADOW_MAP return (kasan_mem_to_shadow((void *)addr) != NULL); #else - return (kasan_reset_tag(addr) >= - kasan_shadow_to_mem((void *)KASAN_SHADOW_START)); + u8 *shadow, shadow_val; + + if (kasan_reset_tag(addr) < + kasan_shadow_to_mem((void *)KASAN_SHADOW_START)) + return false; + /* use read with nofault to check whether the shadow is accessible */ + shadow = kasan_mem_to_shadow((void *)addr); + __get_kernel_nofault(&shadow_val, shadow, u8, fault); + return true; +fault: + return false; #endif } -- 2.25.1
WARNING: multiple messages have this Message-ID (diff)
From: Haibo Li <haibo.li@mediatek.com> To: <linux-kernel@vger.kernel.org> Cc: <xiaoming.yu@mediatek.com>, Andrey Ryabinin <ryabinin.a.a@gmail.com>, Alexander Potapenko <glider@google.com>, Andrey Konovalov <andreyknvl@gmail.com>, Dmitry Vyukov <dvyukov@google.com>, Vincenzo Frascino <vincenzo.frascino@arm.com>, Andrew Morton <akpm@linux-foundation.org>, Matthias Brugger <matthias.bgg@gmail.com>, AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>, <kasan-dev@googlegroups.com>, <linux-mm@kvack.org>, <linux-arm-kernel@lists.infradead.org>, <linux-mediatek@lists.infradead.org>, Haibo Li <haibo.li@mediatek.com> Subject: [PATCH] kasan:fix access invalid shadow address when input is illegal Date: Thu, 14 Sep 2023 16:08:33 +0800 [thread overview] Message-ID: <20230914080833.50026-1-haibo.li@mediatek.com> (raw) when the input address is illegal,the corresponding shadow address from kasan_mem_to_shadow may have no mapping in mmu table. Access such shadow address causes kernel oops. Here is a sample about oops on arm64(VA 39bit) with KASAN_SW_TAGS on: [ffffffb80aaaaaaa] pgd=000000005d3ce003, p4d=000000005d3ce003, pud=000000005d3ce003, pmd=0000000000000000 Internal error: Oops: 0000000096000006 [#1] PREEMPT SMP Modules linked in: CPU: 3 PID: 100 Comm: sh Not tainted 6.6.0-rc1-dirty #43 Hardware name: linux,dummy-virt (DT) pstate: 80000005 (Nzcv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : __hwasan_load8_noabort+0x5c/0x90 lr : do_ib_ob+0xf4/0x110 ffffffb80aaaaaaa is the shadow address for efffff80aaaaaaaa. The problem is reading invalid shadow in kasan_check_range. The generic kasan also has similar oops. To fix it,check shadow address by reading it with no fault. After this patch,KASAN is able to report invalid memory access for this case. Signed-off-by: Haibo Li <haibo.li@mediatek.com> --- mm/kasan/kasan.h | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-) diff --git a/mm/kasan/kasan.h b/mm/kasan/kasan.h index f70e3d7a602e..bd30f35e18b2 100644 --- a/mm/kasan/kasan.h +++ b/mm/kasan/kasan.h @@ -304,8 +304,17 @@ static __always_inline bool addr_has_metadata(const void *addr) #ifdef __HAVE_ARCH_SHADOW_MAP return (kasan_mem_to_shadow((void *)addr) != NULL); #else - return (kasan_reset_tag(addr) >= - kasan_shadow_to_mem((void *)KASAN_SHADOW_START)); + u8 *shadow, shadow_val; + + if (kasan_reset_tag(addr) < + kasan_shadow_to_mem((void *)KASAN_SHADOW_START)) + return false; + /* use read with nofault to check whether the shadow is accessible */ + shadow = kasan_mem_to_shadow((void *)addr); + __get_kernel_nofault(&shadow_val, shadow, u8, fault); + return true; +fault: + return false; #endif } -- 2.25.1 _______________________________________________ linux-arm-kernel mailing list linux-arm-kernel@lists.infradead.org http://lists.infradead.org/mailman/listinfo/linux-arm-kernel
next reply other threads:[~2023-09-14 8:08 UTC|newest] Thread overview: 26+ messages / expand[flat|nested] mbox.gz Atom feed top 2023-09-14 8:08 Haibo Li [this message] 2023-09-14 8:08 ` [PATCH] kasan:fix access invalid shadow address when input is illegal Haibo Li 2023-09-14 17:46 ` Andrey Konovalov 2023-09-14 17:46 ` Andrey Konovalov 2023-09-14 18:29 ` Andrew Morton 2023-09-14 18:29 ` Andrew Morton 2023-09-14 20:34 ` Andrey Konovalov 2023-09-14 20:34 ` Andrey Konovalov 2023-09-14 20:40 ` Jann Horn 2023-09-14 20:40 ` Jann Horn 2023-09-15 1:51 ` Andrey Konovalov 2023-09-15 1:51 ` Andrey Konovalov 2023-09-15 2:45 ` Haibo Li 2023-09-15 2:45 ` Haibo Li 2023-09-15 9:40 ` Haibo Li 2023-09-15 9:40 ` Haibo Li 2023-09-15 16:53 ` Andrey Konovalov 2023-09-15 16:53 ` Andrey Konovalov 2023-09-15 16:50 ` Andrey Konovalov 2023-09-15 16:50 ` Andrey Konovalov 2023-09-15 17:04 ` Jann Horn 2023-09-15 17:04 ` Jann Horn 2023-09-18 8:12 ` Haibo Li 2023-09-18 8:12 ` Haibo Li 2023-09-18 7:25 ` Haibo Li 2023-09-18 7:25 ` Haibo Li
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=20230914080833.50026-1-haibo.li@mediatek.com \ --to=haibo.li@mediatek.com \ --cc=akpm@linux-foundation.org \ --cc=andreyknvl@gmail.com \ --cc=angelogioacchino.delregno@collabora.com \ --cc=dvyukov@google.com \ --cc=glider@google.com \ --cc=kasan-dev@googlegroups.com \ --cc=linux-arm-kernel@lists.infradead.org \ --cc=linux-kernel@vger.kernel.org \ --cc=linux-mediatek@lists.infradead.org \ --cc=linux-mm@kvack.org \ --cc=matthias.bgg@gmail.com \ --cc=ryabinin.a.a@gmail.com \ --cc=vincenzo.frascino@arm.com \ --cc=xiaoming.yu@mediatek.com \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: linkBe sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.