From: glider@google.com
To: Thomas Gleixner <tglx@linutronix.de>,
Andrew Morton <akpm@linux-foundation.org>,
Vegard Nossum <vegard.nossum@oracle.com>,
Dmitry Vyukov <dvyukov@google.com>,
linux-mm@kvack.org
Cc: viro@zeniv.linux.org.uk, aryabinin@virtuozzo.com,
luto@kernel.org, ard.biesheuvel@linaro.org, arnd@arndb.de,
hch@lst.de, dmitry.torokhov@gmail.com, edumazet@google.com,
ericvh@gmail.com, gregkh@linuxfoundation.org,
harry.wentland@amd.com, herbert@gondor.apana.org.au,
mingo@elte.hu, axboe@kernel.dk, martin.petersen@oracle.com,
schwidefsky@de.ibm.com, mst@redhat.com, monstr@monstr.eu,
pmladek@suse.com, sergey.senozhatsky@gmail.com,
rostedt@goodmis.org, tiwai@suse.com, tytso@mit.edu,
wsa@the-dreams.de, gor@linux.ibm.com, iii@linux.ibm.com,
mark.rutland@arm.com, willy@infradead.org,
rdunlap@infradead.org, andreyknvl@google.com, elver@google.com,
Alexander Potapenko <glider@google.com>
Subject: [PATCH RFC v2 19/25] kmsan: disable instrumentation of certain functions
Date: Wed, 30 Oct 2019 15:22:31 +0100 [thread overview]
Message-ID: <20191030142237.249532-20-glider@google.com> (raw)
In-Reply-To: <20191030142237.249532-1-glider@google.com>
Some functions are called from handwritten assembly, and therefore don't
have their arguments' metadata fully set up by the instrumentation code.
Mark them with __no_sanitize_memory to avoid false positives from
spreading further.
Certain functions perform task switching, so that the value of |current|
is different as they proceed. Because KMSAN state pointer is only read
once at the beginning of the function, touching it after |current| has
changed may be dangerous.
Signed-off-by: Alexander Potapenko <glider@google.com>
To: Alexander Potapenko <glider@google.com>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Andrew Morton <akpm@linux-foundation.org>
Cc: Vegard Nossum <vegard.nossum@oracle.com>
Cc: Dmitry Vyukov <dvyukov@google.com>
Cc: linux-mm@kvack.org
---
Change-Id: I684d23dac5a22eb0a4cea71993cb934302b17cea
---
arch/x86/entry/common.c | 1 +
arch/x86/include/asm/irq_regs.h | 1 +
arch/x86/include/asm/syscall_wrapper.h | 1 +
arch/x86/kernel/apic/apic.c | 2 ++
arch/x86/kernel/dumpstack_64.c | 1 +
arch/x86/kernel/process_64.c | 5 +++++
arch/x86/kernel/traps.c | 12 ++++++++++--
arch/x86/kernel/uprobes.c | 7 ++++++-
kernel/profile.c | 1 +
kernel/sched/core.c | 11 +++++++++++
10 files changed, 39 insertions(+), 3 deletions(-)
diff --git a/arch/x86/entry/common.c b/arch/x86/entry/common.c
index 3f8e22615812..0dd5b2acb355 100644
--- a/arch/x86/entry/common.c
+++ b/arch/x86/entry/common.c
@@ -275,6 +275,7 @@ __visible inline void syscall_return_slowpath(struct pt_regs *regs)
}
#ifdef CONFIG_X86_64
+__no_sanitize_memory
__visible void do_syscall_64(unsigned long nr, struct pt_regs *regs)
{
struct thread_info *ti;
diff --git a/arch/x86/include/asm/irq_regs.h b/arch/x86/include/asm/irq_regs.h
index 187ce59aea28..d65a00bd6f02 100644
--- a/arch/x86/include/asm/irq_regs.h
+++ b/arch/x86/include/asm/irq_regs.h
@@ -14,6 +14,7 @@
DECLARE_PER_CPU(struct pt_regs *, irq_regs);
+__no_sanitize_memory
static inline struct pt_regs *get_irq_regs(void)
{
return __this_cpu_read(irq_regs);
diff --git a/arch/x86/include/asm/syscall_wrapper.h b/arch/x86/include/asm/syscall_wrapper.h
index e046a405743d..43910ce1b53b 100644
--- a/arch/x86/include/asm/syscall_wrapper.h
+++ b/arch/x86/include/asm/syscall_wrapper.h
@@ -159,6 +159,7 @@
ALLOW_ERROR_INJECTION(__x64_sys##name, ERRNO); \
static long __se_sys##name(__MAP(x,__SC_LONG,__VA_ARGS__)); \
static inline long __do_sys##name(__MAP(x,__SC_DECL,__VA_ARGS__));\
+ __no_sanitize_memory \
asmlinkage long __x64_sys##name(const struct pt_regs *regs) \
{ \
return __se_sys##name(SC_X86_64_REGS_TO_ARGS(x,__VA_ARGS__));\
diff --git a/arch/x86/kernel/apic/apic.c b/arch/x86/kernel/apic/apic.c
index 9e2dd2b296cd..43a1edd919ea 100644
--- a/arch/x86/kernel/apic/apic.c
+++ b/arch/x86/kernel/apic/apic.c
@@ -1118,6 +1118,8 @@ static void local_apic_timer_interrupt(void)
* [ if a single-CPU system runs an SMP kernel then we call the local
* interrupt as well. Thus we cannot inline the local irq ... ]
*/
+/* TODO(glider): |regs| is uninitialized, so is |*regs|. */
+__no_sanitize_memory
__visible void __irq_entry smp_apic_timer_interrupt(struct pt_regs *regs)
{
struct pt_regs *old_regs = set_irq_regs(regs);
diff --git a/arch/x86/kernel/dumpstack_64.c b/arch/x86/kernel/dumpstack_64.c
index 753b8cfe8b8a..ba883d282a43 100644
--- a/arch/x86/kernel/dumpstack_64.c
+++ b/arch/x86/kernel/dumpstack_64.c
@@ -143,6 +143,7 @@ static bool in_irq_stack(unsigned long *stack, struct stack_info *info)
return true;
}
+__no_sanitize_memory
int get_stack_info(unsigned long *stack, struct task_struct *task,
struct stack_info *info, unsigned long *visit_mask)
{
diff --git a/arch/x86/kernel/process_64.c b/arch/x86/kernel/process_64.c
index af64519b2695..27649ee3dbf8 100644
--- a/arch/x86/kernel/process_64.c
+++ b/arch/x86/kernel/process_64.c
@@ -500,6 +500,11 @@ void compat_start_thread(struct pt_regs *regs, u32 new_ip, u32 new_sp)
* Kprobes not supported here. Set the probe on schedule instead.
* Function graph tracer not supported too.
*/
+/*
+ * TODO(glider): __switch_to() does weird things with tasks, don't report
+ * anything here (also avoid touching the KMSAN state).
+ */
+__no_sanitize_memory
__visible __notrace_funcgraph struct task_struct *
__switch_to(struct task_struct *prev_p, struct task_struct *next_p)
{
diff --git a/arch/x86/kernel/traps.c b/arch/x86/kernel/traps.c
index 4bb0f8447112..a94282d1f60b 100644
--- a/arch/x86/kernel/traps.c
+++ b/arch/x86/kernel/traps.c
@@ -618,7 +618,10 @@ NOKPROBE_SYMBOL(do_int3);
* Help handler running on a per-cpu (IST or entry trampoline) stack
* to switch to the normal thread stack if the interrupted code was in
* user mode. The actual stack switch is done in entry_64.S
+ *
+ * This function switches the registers - don't instrument it with KMSAN!
*/
+__no_sanitize_memory
asmlinkage __visible notrace struct pt_regs *sync_regs(struct pt_regs *eregs)
{
struct pt_regs *regs = (struct pt_regs *)this_cpu_read(cpu_current_top_of_stack) - 1;
@@ -634,6 +637,11 @@ struct bad_iret_stack {
};
asmlinkage __visible notrace
+/*
+ * Dark magic happening here, let's not instrument this function.
+ * Also avoid copying any metadata by using raw __memmove().
+ */
+__no_sanitize_memory
struct bad_iret_stack *fixup_bad_iret(struct bad_iret_stack *s)
{
/*
@@ -648,10 +656,10 @@ struct bad_iret_stack *fixup_bad_iret(struct bad_iret_stack *s)
(struct bad_iret_stack *)this_cpu_read(cpu_tss_rw.x86_tss.sp0) - 1;
/* Copy the IRET target to the new stack. */
- memmove(&new_stack->regs.ip, (void *)s->regs.sp, 5*8);
+ __memmove(&new_stack->regs.ip, (void *)s->regs.sp, 5*8);
/* Copy the remainder of the stack from the current stack. */
- memmove(new_stack, s, offsetof(struct bad_iret_stack, regs.ip));
+ __memmove(new_stack, s, offsetof(struct bad_iret_stack, regs.ip));
BUG_ON(!user_mode(&new_stack->regs));
return new_stack;
diff --git a/arch/x86/kernel/uprobes.c b/arch/x86/kernel/uprobes.c
index 8cd745ef8c7b..bcd4bf5a909f 100644
--- a/arch/x86/kernel/uprobes.c
+++ b/arch/x86/kernel/uprobes.c
@@ -8,6 +8,7 @@
* Jim Keniston
*/
#include <linux/kernel.h>
+#include <linux/kmsan-checks.h>
#include <linux/sched.h>
#include <linux/ptrace.h>
#include <linux/uprobes.h>
@@ -997,9 +998,13 @@ int arch_uprobe_post_xol(struct arch_uprobe *auprobe, struct pt_regs *regs)
int arch_uprobe_exception_notify(struct notifier_block *self, unsigned long val, void *data)
{
struct die_args *args = data;
- struct pt_regs *regs = args->regs;
+ struct pt_regs *regs;
int ret = NOTIFY_DONE;
+ kmsan_unpoison_shadow(args, sizeof(*args));
+ regs = args->regs;
+ if (regs)
+ kmsan_unpoison_shadow(regs, sizeof(*regs));
/* We are only interested in userspace traps */
if (regs && !user_mode(regs))
return NOTIFY_DONE;
diff --git a/kernel/profile.c b/kernel/profile.c
index af7c94bf5fa1..835a5b66d1a4 100644
--- a/kernel/profile.c
+++ b/kernel/profile.c
@@ -399,6 +399,7 @@ void profile_hits(int type, void *__pc, unsigned int nr_hits)
}
EXPORT_SYMBOL_GPL(profile_hits);
+__no_sanitize_memory
void profile_tick(int type)
{
struct pt_regs *regs = get_irq_regs();
diff --git a/kernel/sched/core.c b/kernel/sched/core.c
index dd05a378631a..951d19d217d7 100644
--- a/kernel/sched/core.c
+++ b/kernel/sched/core.c
@@ -475,6 +475,8 @@ void wake_q_add_safe(struct wake_q_head *head, struct task_struct *task)
put_task_struct(task);
}
+/* TODO(glider): context switching here. */
+__no_sanitize_memory
void wake_up_q(struct wake_q_head *head)
{
struct wake_q_node *node = head->first;
@@ -3180,6 +3182,8 @@ prepare_task_switch(struct rq *rq, struct task_struct *prev,
* past. prev == current is still correct but we need to recalculate this_rq
* because prev may have moved to another CPU.
*/
+/* TODO(glider): |current| changes here. */
+__no_sanitize_memory
static struct rq *finish_task_switch(struct task_struct *prev)
__releases(rq->lock)
{
@@ -3986,6 +3990,8 @@ pick_next_task(struct rq *rq, struct task_struct *prev, struct rq_flags *rf)
*
* WARNING: must be called with preemption disabled!
*/
+/* TODO(glider): |current| changes here. */
+__no_sanitize_memory
static void __sched notrace __schedule(bool preempt)
{
struct task_struct *prev, *next;
@@ -4605,6 +4611,8 @@ int task_prio(const struct task_struct *p)
*
* Return: 1 if the CPU is currently idle. 0 otherwise.
*/
+/* TODO(glider): nothing to report here. */
+__no_sanitize_memory
int idle_cpu(int cpu)
{
struct rq *rq = cpu_rq(cpu);
@@ -6544,6 +6552,7 @@ static struct kmem_cache *task_group_cache __read_mostly;
DECLARE_PER_CPU(cpumask_var_t, load_balance_mask);
DECLARE_PER_CPU(cpumask_var_t, select_idle_mask);
+__no_sanitize_memory
void __init sched_init(void)
{
unsigned long ptr = 0;
@@ -6716,6 +6725,8 @@ static inline int preempt_count_equals(int preempt_offset)
return (nested == preempt_offset);
}
+/* TODO(glider): the args are most certainly initialized. */
+__no_sanitize_memory
void __might_sleep(const char *file, int line, int preempt_offset)
{
/*
--
2.24.0.rc0.303.g954a862665-goog
next prev parent reply other threads:[~2019-10-30 14:23 UTC|newest]
Thread overview: 57+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-10-30 14:22 [PATCH RFC v2 00/25] Add KernelMemorySanitizer infrastructure glider
2019-10-30 14:22 ` [PATCH RFC v2 01/25] stackdepot: check depot_index before accessing the stack slab glider
2019-10-30 14:22 ` [PATCH RFC v2 02/25] stackdepot: prevent Clang from optimizing away stackdepot_memcmp() glider
2019-11-01 5:50 ` Sergey Senozhatsky
2019-11-06 11:43 ` Alexander Potapenko
2019-11-07 6:08 ` Sergey Senozhatsky
2019-11-07 9:04 ` Arnd Bergmann
2019-11-07 9:22 ` Alexander Potapenko
2019-11-07 9:28 ` Arnd Bergmann
2019-11-07 9:43 ` Alexander Potapenko
[not found] ` <47fdac13-fa2c-2acd-2480-5e6d4db208f8@virtuozzo.com>
2019-11-07 10:00 ` Arnd Bergmann
[not found] ` <6875c6e6-2f1f-f8e6-e5d7-d451c48397ff@virtuozzo.com>
2019-11-07 10:30 ` Alexander Potapenko
2019-10-30 14:22 ` [PATCH RFC v2 03/25] kasan: stackdepot: move filter_irq_stacks() to stackdepot.c glider
2019-10-30 14:22 ` [PATCH RFC v2 04/25] stackdepot: reserve 5 extra bits in depot_stack_handle_t glider
2019-10-30 14:22 ` [PATCH RFC v2 05/25] kmsan: add ReST documentation glider
2019-10-30 14:22 ` [PATCH RFC v2 06/25] kmsan: gfp: introduce __GFP_NO_KMSAN_SHADOW glider
2019-10-30 14:22 ` [PATCH RFC v2 07/25] kmsan: introduce __no_sanitize_memory and __SANITIZE_MEMORY__ glider
2019-10-30 15:50 ` Andrey Konovalov
2019-11-01 12:52 ` Alexander Potapenko
2019-10-30 14:22 ` [PATCH RFC v2 08/25] kmsan: reduce vmalloc space glider
2019-10-30 14:22 ` [PATCH RFC v2 09/25] kmsan: add KMSAN runtime glider
2019-11-08 12:08 ` Dmitry Vyukov
2019-11-08 12:17 ` Dmitry Vyukov
2019-11-21 12:06 ` Alexander Potapenko
2019-11-13 8:13 ` Wolfram Sang
2019-11-21 12:01 ` Alexander Potapenko
2019-10-30 14:22 ` [PATCH RFC v2 10/25] kmsan: define READ_ONCE_NOCHECK() glider
2019-11-05 14:21 ` Mark Rutland
2019-11-21 12:08 ` Alexander Potapenko
2019-10-30 14:22 ` [PATCH RFC v2 11/25] kmsan: x86: sync metadata pages on page fault glider
2019-10-30 14:22 ` [PATCH RFC v2 12/25] kmsan: add tests for KMSAN glider
2019-10-30 14:22 ` [PATCH RFC v2 13/25] kmsan: make READ_ONCE_TASK_STACK() return initialized values glider
2019-10-30 14:22 ` [PATCH RFC v2 14/25] kmsan: Kconfig changes to disable options incompatible with KMSAN glider
2019-10-30 14:34 ` Qian Cai
2019-10-30 14:34 ` Christoph Hellwig
2019-10-30 14:22 ` [PATCH RFC v2 15/25] kmsan: Changing existing files to enable KMSAN builds glider
2019-10-30 14:36 ` Christoph Hellwig
2019-10-30 14:22 ` [PATCH RFC v2 16/25] kmsan: disable KMSAN instrumentation for certain kernel parts glider
2019-10-30 14:22 ` [PATCH RFC v2 17/25] kmsan: mm: call KMSAN hooks from SLUB code glider
2019-10-30 16:07 ` Andrey Konovalov
2019-10-30 14:22 ` [PATCH RFC v2 18/25] kmsan: call KMSAN hooks where needed glider
2019-10-31 11:49 ` Petr Mladek
2019-11-01 8:26 ` Sergey Senozhatsky
2019-11-05 14:12 ` Alexander Potapenko
2019-11-06 9:04 ` Petr Mladek
2019-11-06 9:07 ` Sergey Senozhatsky
2019-10-30 14:22 ` glider [this message]
2019-10-30 14:22 ` [PATCH RFC v2 20/25] kmsan: unpoison |tlb| in arch_tlb_gather_mmu() glider
2019-10-30 14:22 ` [PATCH RFC v2 21/25] kmsan: use __msan_memcpy() where possible glider
2019-10-30 14:22 ` [PATCH RFC v2 22/25] kmsan: unpoisoning buffers from devices etc glider
2019-10-30 14:38 ` Christoph Hellwig
2019-11-05 15:02 ` Alexander Potapenko
2019-11-07 13:00 ` Alexander Potapenko
2019-11-13 11:07 ` Alexander Potapenko
2019-10-30 14:22 ` [PATCH RFC v2 23/25] kmsan: hooks for copy_to_user() and friends glider
2019-10-30 14:22 ` [PATCH RFC v2 24/25] kmsan: disable strscpy() optimization under KMSAN glider
2019-10-30 14:22 ` [PATCH RFC v2 25/25] net: kasan: kmsan: support CONFIG_GENERIC_CSUM on x86, enable it for KASAN/KMSAN glider
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20191030142237.249532-20-glider@google.com \
--to=glider@google.com \
--cc=akpm@linux-foundation.org \
--cc=andreyknvl@google.com \
--cc=ard.biesheuvel@linaro.org \
--cc=arnd@arndb.de \
--cc=aryabinin@virtuozzo.com \
--cc=axboe@kernel.dk \
--cc=dmitry.torokhov@gmail.com \
--cc=dvyukov@google.com \
--cc=edumazet@google.com \
--cc=elver@google.com \
--cc=ericvh@gmail.com \
--cc=gor@linux.ibm.com \
--cc=gregkh@linuxfoundation.org \
--cc=harry.wentland@amd.com \
--cc=hch@lst.de \
--cc=herbert@gondor.apana.org.au \
--cc=iii@linux.ibm.com \
--cc=linux-mm@kvack.org \
--cc=luto@kernel.org \
--cc=mark.rutland@arm.com \
--cc=martin.petersen@oracle.com \
--cc=mingo@elte.hu \
--cc=monstr@monstr.eu \
--cc=mst@redhat.com \
--cc=pmladek@suse.com \
--cc=rdunlap@infradead.org \
--cc=rostedt@goodmis.org \
--cc=schwidefsky@de.ibm.com \
--cc=sergey.senozhatsky@gmail.com \
--cc=tglx@linutronix.de \
--cc=tiwai@suse.com \
--cc=tytso@mit.edu \
--cc=vegard.nossum@oracle.com \
--cc=viro@zeniv.linux.org.uk \
--cc=willy@infradead.org \
--cc=wsa@the-dreams.de \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox