From: Sasha Levin <sashal@kernel.org>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: Vincenzo Frascino <vincenzo.frascino@arm.com>,
Andrey Konovalov <andreyknvl@google.com>,
Andrey Ryabinin <aryabinin@virtuozzo.com>,
Alexander Potapenko <glider@google.com>,
Dmitry Vyukov <dvyukov@google.com>,
Leon Romanovsky <leonro@mellanox.com>,
Catalin Marinas <catalin.marinas@arm.com>,
Will Deacon <will@kernel.org>,
Mark Rutland <mark.rutland@arm.com>,
"Paul E . McKenney" <paulmck@kernel.org>,
Naresh Kamboju <naresh.kamboju@linaro.org>,
Andrew Morton <akpm@linux-foundation.org>,
Linus Torvalds <torvalds@linux-foundation.org>,
Sasha Levin <sashal@kernel.org>,
kasan-dev@googlegroups.com
Subject: [PATCH AUTOSEL 5.10 33/36] kasan: add explicit preconditions to kasan_report()
Date: Mon, 8 Feb 2021 12:58:03 -0500 [thread overview]
Message-ID: <20210208175806.2091668-33-sashal@kernel.org> (raw)
In-Reply-To: <20210208175806.2091668-1-sashal@kernel.org>
From: Vincenzo Frascino <vincenzo.frascino@arm.com>
[ Upstream commit 49c6631d3b4f61a7b5bb0453a885a12bfa06ffd8 ]
Patch series "kasan: Fix metadata detection for KASAN_HW_TAGS", v5.
With the introduction of KASAN_HW_TAGS, kasan_report() currently assumes
that every location in memory has valid metadata associated. This is
due to the fact that addr_has_metadata() returns always true.
As a consequence of this, an invalid address (e.g. NULL pointer
address) passed to kasan_report() when KASAN_HW_TAGS is enabled, leads
to a kernel panic.
Example below, based on arm64:
BUG: KASAN: invalid-access in 0x0
Read at addr 0000000000000000 by task swapper/0/1
Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000
Mem abort info:
ESR = 0x96000004
EC = 0x25: DABT (current EL), IL = 32 bits
SET = 0, FnV = 0
EA = 0, S1PTW = 0
Data abort info:
ISV = 0, ISS = 0x00000004
CM = 0, WnR = 0
...
Call trace:
mte_get_mem_tag+0x24/0x40
kasan_report+0x1a4/0x410
alsa_sound_last_init+0x8c/0xa4
do_one_initcall+0x50/0x1b0
kernel_init_freeable+0x1d4/0x23c
kernel_init+0x14/0x118
ret_from_fork+0x10/0x34
Code: d65f03c0 9000f021 f9428021 b6cfff61 (d9600000)
---[ end trace 377c8bb45bdd3a1a ]---
hrtimer: interrupt took 48694256 ns
note: swapper/0[1] exited with preempt_count 1
Kernel panic - not syncing: Attempted to kill init! exitcode=0x0000000b
SMP: stopping secondary CPUs
Kernel Offset: 0x35abaf140000 from 0xffff800010000000
PHYS_OFFSET: 0x40000000
CPU features: 0x0a7e0152,61c0a030
Memory Limit: none
---[ end Kernel panic - not syncing: Attempted to kill init! exitcode=0x0000000b ]---
This series fixes the behavior of addr_has_metadata() that now returns
true only when the address is valid.
This patch (of 2):
With the introduction of KASAN_HW_TAGS, kasan_report() accesses the
metadata only when addr_has_metadata() succeeds.
Add a comment to make sure that the preconditions to the function are
explicitly clarified.
Link: https://lkml.kernel.org/r/20210126134409.47894-1-vincenzo.frascino@arm.com
Link: https://lkml.kernel.org/r/20210126134409.47894-2-vincenzo.frascino@arm.com
Signed-off-by: Vincenzo Frascino <vincenzo.frascino@arm.com>
Reviewed-by: Andrey Konovalov <andreyknvl@google.com>
Cc: Andrey Ryabinin <aryabinin@virtuozzo.com>
Cc: Alexander Potapenko <glider@google.com>
Cc: Dmitry Vyukov <dvyukov@google.com>
Cc: Leon Romanovsky <leonro@mellanox.com>
Cc: Andrey Konovalov <andreyknvl@google.com>
Cc: Catalin Marinas <catalin.marinas@arm.com>
Cc: Will Deacon <will@kernel.org>
Cc: Mark Rutland <mark.rutland@arm.com>
Cc: "Paul E . McKenney" <paulmck@kernel.org>
Cc: Naresh Kamboju <naresh.kamboju@linaro.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
include/linux/kasan.h | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/include/linux/kasan.h b/include/linux/kasan.h
index 30d343b4a40a5..646fa165d2cce 100644
--- a/include/linux/kasan.h
+++ b/include/linux/kasan.h
@@ -196,6 +196,13 @@ void kasan_init_tags(void);
void *kasan_reset_tag(const void *addr);
+/**
+ * kasan_report - print a report about a bad memory access detected by KASAN
+ * @addr: address of the bad access
+ * @size: size of the bad access
+ * @is_write: whether the bad access is a write or a read
+ * @ip: instruction pointer for the accessibility check or the bad access itself
+ */
bool kasan_report(unsigned long addr, size_t size,
bool is_write, unsigned long ip);
--
2.27.0
next prev parent reply other threads:[~2021-02-08 18:06 UTC|newest]
Thread overview: 43+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-02-08 17:57 [PATCH AUTOSEL 5.10 01/36] soc: ti: omap-prm: Fix boot time errors for rst_map_012 bits 0 and 1 Sasha Levin
2021-02-08 17:57 ` [PATCH AUTOSEL 5.10 02/36] arm64: dts: rockchip: Fix PCIe DT properties on rk3399 Sasha Levin
2021-02-08 17:57 ` [PATCH AUTOSEL 5.10 03/36] Input: goodix - add support for Goodix GT9286 chip Sasha Levin
2021-02-08 17:57 ` [PATCH AUTOSEL 5.10 04/36] arm64: dts: qcom: sdm845: Reserve LPASS clocks in gcc Sasha Levin
2021-02-08 17:57 ` [PATCH AUTOSEL 5.10 05/36] ARM: OMAP2+: Fix suspcious RCU usage splats for omap_enter_idle_coupled Sasha Levin
2021-02-08 17:57 ` [PATCH AUTOSEL 5.10 06/36] arm64: dts: rockchip: remove interrupt-names property from rk3399 vdec node Sasha Levin
2021-02-08 17:57 ` [PATCH AUTOSEL 5.10 07/36] kbuild: simplify GCC_PLUGINS enablement in dummy-tools/gcc Sasha Levin
2021-02-08 17:57 ` [PATCH AUTOSEL 5.10 08/36] Input: xpad - sync supported devices with fork on GitHub Sasha Levin
2021-02-08 17:57 ` [PATCH AUTOSEL 5.10 09/36] platform/x86: hp-wmi: Disable tablet-mode reporting by default Sasha Levin
2021-02-10 23:22 ` mark gross
2021-02-08 17:57 ` [PATCH AUTOSEL 5.10 10/36] arm64: dts: rockchip: Disable display for NanoPi R2S Sasha Levin
2021-02-08 17:57 ` [PATCH AUTOSEL 5.10 11/36] ovl: perform vfs_getxattr() with mounter creds Sasha Levin
2021-02-08 17:57 ` [PATCH AUTOSEL 5.10 12/36] cap: fix conversions on getxattr Sasha Levin
2021-02-08 17:57 ` [PATCH AUTOSEL 5.10 13/36] ovl: skip getxattr of security labels Sasha Levin
2021-02-08 17:57 ` [PATCH AUTOSEL 5.10 14/36] media: rkisp1: uapi: change hist_bins array type from __u16 to __u32 Sasha Levin
2021-02-08 20:46 ` Hans Verkuil
2021-02-09 12:45 ` Dafna Hirschfeld
2021-02-09 13:02 ` Greg Kroah-Hartman
2021-02-09 13:39 ` Hans Verkuil
2021-02-09 13:44 ` Greg Kroah-Hartman
2021-02-10 15:33 ` Sasha Levin
2021-02-08 17:57 ` [PATCH AUTOSEL 5.10 15/36] media: rkisp1: stats: remove a wrong cast to u8 Sasha Levin
2021-02-08 17:57 ` [PATCH AUTOSEL 5.10 16/36] media: rkisp1: stats: mask the hist_bins values Sasha Levin
2021-02-08 17:57 ` [PATCH AUTOSEL 5.10 17/36] scsi: lpfc: Fix EEH encountering oops with NVMe traffic Sasha Levin
2021-02-08 17:57 ` [PATCH AUTOSEL 5.10 18/36] x86/split_lock: Enable the split lock feature on another Alder Lake CPU Sasha Levin
2021-02-08 17:57 ` [PATCH AUTOSEL 5.10 19/36] nvme-pci: ignore the subsysem NQN on Phison E16 Sasha Levin
2021-02-08 17:57 ` [PATCH AUTOSEL 5.10 20/36] drm/amd/display: Fix DPCD translation for LTTPR AUX_RD_INTERVAL Sasha Levin
2021-02-08 17:57 ` [PATCH AUTOSEL 5.10 21/36] drm/amd/display: Add more Clock Sources to DCN2.1 Sasha Levin
2021-02-08 17:57 ` [PATCH AUTOSEL 5.10 22/36] drm/amd/display: Release DSC before acquiring Sasha Levin
2021-02-08 17:57 ` [PATCH AUTOSEL 5.10 23/36] drm/amd/display: Fix dc_sink kref count in emulated_link_detect Sasha Levin
2021-02-08 17:57 ` [PATCH AUTOSEL 5.10 24/36] drm/amd/display: Free atomic state after drm_atomic_commit Sasha Levin
2021-02-08 17:57 ` [PATCH AUTOSEL 5.10 25/36] drm/amd/display: Decrement refcount of dc_sink before reassignment Sasha Levin
2021-02-08 17:57 ` [PATCH AUTOSEL 5.10 26/36] riscv: virt_addr_valid must check the address belongs to linear mapping Sasha Levin
2021-02-08 17:57 ` [PATCH AUTOSEL 5.10 27/36] bfq-iosched: Revert "bfq: Fix computation of shallow depth" Sasha Levin
2021-02-08 17:57 ` [PATCH AUTOSEL 5.10 28/36] ARM: dts: lpc32xx: Revert set default clock rate of HCLK PLL Sasha Levin
2021-02-08 17:57 ` [PATCH AUTOSEL 5.10 29/36] kallsyms: fix nonconverging kallsyms table with lld Sasha Levin
2021-02-08 17:58 ` [PATCH AUTOSEL 5.10 30/36] ARM: ensure the signal page contains defined contents Sasha Levin
2021-02-08 17:58 ` [PATCH AUTOSEL 5.10 31/36] ARM: kexec: fix oops after TLB are invalidated Sasha Levin
2021-02-08 17:58 ` [PATCH AUTOSEL 5.10 32/36] init/gcov: allow CONFIG_CONSTRUCTORS on UML to fix module gcov Sasha Levin
2021-02-08 17:58 ` Sasha Levin [this message]
2021-02-08 17:58 ` [PATCH AUTOSEL 5.10 34/36] ubsan: implement __ubsan_handle_alignment_assumption Sasha Levin
2021-02-08 17:58 ` [PATCH AUTOSEL 5.10 35/36] Revert "lib: Restrict cpumask_local_spread to houskeeping CPUs" Sasha Levin
2021-02-08 17:58 ` [PATCH AUTOSEL 5.10 36/36] x86/efi: Remove EFI PGD build time checks Sasha Levin
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20210208175806.2091668-33-sashal@kernel.org \
--to=sashal@kernel.org \
--cc=akpm@linux-foundation.org \
--cc=andreyknvl@google.com \
--cc=aryabinin@virtuozzo.com \
--cc=catalin.marinas@arm.com \
--cc=dvyukov@google.com \
--cc=glider@google.com \
--cc=kasan-dev@googlegroups.com \
--cc=leonro@mellanox.com \
--cc=linux-kernel@vger.kernel.org \
--cc=mark.rutland@arm.com \
--cc=naresh.kamboju@linaro.org \
--cc=paulmck@kernel.org \
--cc=stable@vger.kernel.org \
--cc=torvalds@linux-foundation.org \
--cc=vincenzo.frascino@arm.com \
--cc=will@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).