From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-19.0 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,INCLUDES_CR_TRAILER,INCLUDES_PATCH, MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id CF0BEC433E9 for ; Wed, 3 Mar 2021 00:35:55 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 9BA5F64FB8 for ; Wed, 3 Mar 2021 00:35:55 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S234401AbhCCAQ1 (ORCPT ); Tue, 2 Mar 2021 19:16:27 -0500 Received: from mail.kernel.org ([198.145.29.99]:46400 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1350238AbhCBMOU (ORCPT ); Tue, 2 Mar 2021 07:14:20 -0500 Received: by mail.kernel.org (Postfix) with ESMTPSA id 7A69664F76; Tue, 2 Mar 2021 11:57:34 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1614686256; bh=8hNSsqe/SGjVZ2NUpKhIVVKqIQFRp6iiBY2+/KEVuC8=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=FXH2kBGAX/mvY+x2Jmv45H0lc5mcSBBQPlig79l4Uf+Qoon9xyAdkpTQdJcJ53J22 MU+CODerQ71gQnGdPAyi6/jpsQ8M1dAE5W/yBU1876cHqFxRDx+2qI1b3pFuNmZ3cX G4+jcplOz8WQ+3MQXkrcROF+wJoFs/PMqhmtW1F77pYM9ARoJ+NnjqzaRe9iWKC1TP Fxj/lFKJXYQu7SXcrlIcXL+lgMfX69wCUqtGlgasLnpcBp9td6eZe2D0rIFgyzZKLz ArduWx41DmXOTyOkgGaeP/Ev1nRWena7VhtSW2g50zqkRmOSknJ61Nz2KRpOBA4De5 ABOnFOIfh65fA== From: Sasha Levin To: linux-kernel@vger.kernel.org, stable@vger.kernel.org Cc: Andrey Konovalov , Marco Elver , Alexander Potapenko , Andrey Ryabinin , Branislav Rankov , Catalin Marinas , Dmitry Vyukov , Evgenii Stepanov , Kevin Brodsky , Peter Collingbourne , Vincenzo Frascino , Will Deacon , Andrew Morton , Linus Torvalds , Sasha Levin Subject: [PATCH AUTOSEL 5.10 39/47] kasan: fix memory corruption in kasan_bitops_tags test Date: Tue, 2 Mar 2021 06:56:38 -0500 Message-Id: <20210302115646.62291-39-sashal@kernel.org> X-Mailer: git-send-email 2.30.1 In-Reply-To: <20210302115646.62291-1-sashal@kernel.org> References: <20210302115646.62291-1-sashal@kernel.org> MIME-Version: 1.0 X-stable: review X-Patchwork-Hint: Ignore Content-Transfer-Encoding: 8bit Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Andrey Konovalov [ Upstream commit e66e1799a76621003e5b04c9c057826a2152e103 ] Since the hardware tag-based KASAN mode might not have a redzone that comes after an allocated object (when kasan.mode=prod is enabled), the kasan_bitops_tags() test ends up corrupting the next object in memory. Change the test so it always accesses the redzone that lies within the allocated object's boundaries. Link: https://linux-review.googlesource.com/id/I67f51d1ee48f0a8d0fe2658c2a39e4879fe0832a Link: https://lkml.kernel.org/r/7d452ce4ae35bb1988d2c9244dfea56cf2cc9315.1610733117.git.andreyknvl@google.com Signed-off-by: Andrey Konovalov Reviewed-by: Marco Elver Reviewed-by: Alexander Potapenko Cc: Andrey Ryabinin Cc: Branislav Rankov Cc: Catalin Marinas Cc: Dmitry Vyukov Cc: Evgenii Stepanov Cc: Kevin Brodsky Cc: Peter Collingbourne Cc: Vincenzo Frascino Cc: Will Deacon Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Signed-off-by: Sasha Levin --- lib/test_kasan.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/lib/test_kasan.c b/lib/test_kasan.c index 662f862702fc..400507f1e5db 100644 --- a/lib/test_kasan.c +++ b/lib/test_kasan.c @@ -737,13 +737,13 @@ static void kasan_bitops_tags(struct kunit *test) return; } - /* Allocation size will be rounded to up granule size, which is 16. */ - bits = kzalloc(sizeof(*bits), GFP_KERNEL); + /* kmalloc-64 cache will be used and the last 16 bytes will be the redzone. */ + bits = kzalloc(48, GFP_KERNEL); KUNIT_ASSERT_NOT_ERR_OR_NULL(test, bits); - /* Do the accesses past the 16 allocated bytes. */ - kasan_bitops_modify(test, BITS_PER_LONG, &bits[1]); - kasan_bitops_test_and_modify(test, BITS_PER_LONG + BITS_PER_BYTE, &bits[1]); + /* Do the accesses past the 48 allocated bytes, but within the redone. */ + kasan_bitops_modify(test, BITS_PER_LONG, (void *)bits + 48); + kasan_bitops_test_and_modify(test, BITS_PER_LONG + BITS_PER_BYTE, (void *)bits + 48); kfree(bits); } -- 2.30.1