From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-9.6 required=3.0 tests=DKIM_INVALID,DKIM_SIGNED, HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_PATCH,MAILING_LIST_MULTI,SIGNED_OFF_BY, SPF_HELO_NONE,SPF_PASS,USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 70C8DC33CB6 for ; Thu, 16 Jan 2020 06:26:38 +0000 (UTC) Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by mail.kernel.org (Postfix) with ESMTP id 242482087E for ; Thu, 16 Jan 2020 06:26:38 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=fail reason="signature verification failed" (1024-bit key) header.d=axtens.net header.i=@axtens.net header.b="C+UNMN/n" DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org 242482087E Authentication-Results: mail.kernel.org; dmarc=none (p=none dis=none) header.from=axtens.net Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=owner-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix) id A8BE58E0038; Thu, 16 Jan 2020 01:26:37 -0500 (EST) Received: by kanga.kvack.org (Postfix, from userid 40) id A14488E0026; Thu, 16 Jan 2020 01:26:37 -0500 (EST) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 8DAFA8E0038; Thu, 16 Jan 2020 01:26:37 -0500 (EST) X-Delivered-To: linux-mm@kvack.org Received: from forelay.hostedemail.com (smtprelay0218.hostedemail.com [216.40.44.218]) by kanga.kvack.org (Postfix) with ESMTP id 70F338E0026 for ; Thu, 16 Jan 2020 01:26:37 -0500 (EST) Received: from smtpin14.hostedemail.com (10.5.19.251.rfc1918.com [10.5.19.251]) by forelay01.hostedemail.com (Postfix) with SMTP id 1C50C180AD807 for ; Thu, 16 Jan 2020 06:26:37 +0000 (UTC) X-FDA: 76382513634.14.alley67_91051c40cb70c X-HE-Tag: alley67_91051c40cb70c X-Filterd-Recvd-Size: 8548 Received: from mail-pg1-f194.google.com (mail-pg1-f194.google.com [209.85.215.194]) by imf38.hostedemail.com (Postfix) with ESMTP for ; Thu, 16 Jan 2020 06:26:36 +0000 (UTC) Received: by mail-pg1-f194.google.com with SMTP id a33so9373660pgm.5 for ; Wed, 15 Jan 2020 22:26:36 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=axtens.net; s=google; h=from:to:cc:subject:date:message-id:in-reply-to:references :mime-version:content-transfer-encoding; bh=pcisanTgJm2Q3K0/rpShD/S/gMp/LV+S7q0SnsZ5eZA=; b=C+UNMN/n21Z+KKPWTfdkIPpgJbCp3mGvMCgNhHm92fuQmkPRxe8JFhLupRWnAl3BwY h4nyTZzX4mKEfs9QRe+aUDa/7XzgnYI3nzON1Ohb5efUL0C15DI/G5D7rqbRgrqYl5Ef h9i+GdntCOUA9SGQQCKWLxSGfDECudeCS5xHk= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=pcisanTgJm2Q3K0/rpShD/S/gMp/LV+S7q0SnsZ5eZA=; b=GWTIeHyQQF7mdHayhQ6sJHnuhQAexsMvkg/rs0u27r+EVYdxMbFa7EQRLtl+0wboTP NTGYgQrJ044tKgsB3bklJUmX4/lnwcI0KbafYhMQMQshSlWSXtpwFz18sjIjIrE4Wwq4 D2QJR7RlQSkucnr2l45PtJYEjfQShOUdppNBQtvSFSqUtPv63+cfGgK5jdCGRkj4McH/ nEjfc4nopA8qNeB2pxnGbjPY46yQTIKDJTA8D/Uh7cDDmp7TzqQKRcmdNBXUmCJ810mG eYMv3TcTMfcq0DG1VsKi+z09JZjzj1PEsGPv0HSEHk2GGDchW/Iz/tfyzSdd0QPfDpPs I1Fw== X-Gm-Message-State: APjAAAV787J5c72JehWxzt5uEt1N6EGpuVgsBo62WY49xPruKDYHDfKH x1m5iwd84GOmREybW8trGfkLqA== X-Google-Smtp-Source: APXvYqzZNecZWkElAjCkhku46ZLAEt1HILfHwFxN9cP8hb0d/spt/ieWbkSQrR4axqy4NHudIk+/7A== X-Received: by 2002:a63:220b:: with SMTP id i11mr36948573pgi.50.1579155995165; Wed, 15 Jan 2020 22:26:35 -0800 (PST) Received: from localhost (2001-44b8-1113-6700-097c-7eed-afd4-cd15.static.ipv6.internode.on.net. [2001:44b8:1113:6700:97c:7eed:afd4:cd15]) by smtp.gmail.com with ESMTPSA id c68sm24184359pfc.156.2020.01.15.22.26.33 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 15 Jan 2020 22:26:34 -0800 (PST) From: Daniel Axtens To: linux-kernel@vger.kernel.org, linux-mm@kvack.org, kasan-dev@googlegroups.com Cc: linuxppc-dev@lists.ozlabs.org, linux-arm-kernel@lists.infradead.org, linux-s390@vger.kernel.org, linux-xtensa@linux-xtensa.org, x86@kernel.org, dvyukov@google.com, christophe.leroy@c-s.fr, Daniel Axtens , Daniel Micay , Andrey Ryabinin , Alexander Potapenko Subject: [PATCH v2 1/3] kasan: stop tests being eliminated as dead code with FORTIFY_SOURCE Date: Thu, 16 Jan 2020 17:26:23 +1100 Message-Id: <20200116062625.32692-2-dja@axtens.net> X-Mailer: git-send-email 2.20.1 In-Reply-To: <20200116062625.32692-1-dja@axtens.net> References: <20200116062625.32692-1-dja@axtens.net> MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: 3 KASAN self-tests fail on a kernel with both KASAN and FORTIFY_SOURCE: memchr, memcmp and strlen. When FORTIFY_SOURCE is on, a number of functions are replaced with fortified versions, which attempt to check the sizes of the operands. However, these functions often directly invoke __builtin_foo() once they have performed the fortify check. The compiler can detect that the result= s of these functions are not used, and knows that they have no other side effects, and so can eliminate them as dead code. Why are only memchr, memcmp and strlen affected? =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D Of string and string-like functions, kasan_test tests: * strchr -> not affected, no fortified version * strrchr -> likewise * strcmp -> likewise * strncmp -> likewise * strnlen -> not affected, the fortify source implementation calls the underlying strnlen implementation which is instrumented, n= ot a builtin * strlen -> affected, the fortify souce implementation calls a __built= in version which the compiler can determine is dead. * memchr -> likewise * memcmp -> likewise * memset -> not affected, the compiler knows that memset writes to its first argument and therefore is not dead. Why does this not affect the functions normally? =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D In string.h, these functions are not marked as __pure, so the compiler cannot know that they do not have side effects. If relevant functions are marked as __pure in string.h, we see the following warnings and the functions are elided: lib/test_kasan.c: In function =E2=80=98kasan_memchr=E2=80=99: lib/test_kasan.c:606:2: warning: statement with no effect [-Wunused-value= ] memchr(ptr, '1', size + 1); ^~~~~~~~~~~~~~~~~~~~~~~~~~ lib/test_kasan.c: In function =E2=80=98kasan_memcmp=E2=80=99: lib/test_kasan.c:622:2: warning: statement with no effect [-Wunused-value= ] memcmp(ptr, arr, size+1); ^~~~~~~~~~~~~~~~~~~~~~~~ lib/test_kasan.c: In function =E2=80=98kasan_strings=E2=80=99: lib/test_kasan.c:645:2: warning: statement with no effect [-Wunused-value= ] strchr(ptr, '1'); ^~~~~~~~~~~~~~~~ ... This annotation would make sense to add and could be added at any point, = so the behaviour of test_kasan.c should change. The fix =3D=3D=3D=3D=3D=3D=3D Make all the functions that are pure write their results to a global, which makes them live. The strlen and memchr tests now pass. The memcmp test still fails to trigger, which is addressed in the next patch. Cc: Daniel Micay Cc: Andrey Ryabinin Cc: Alexander Potapenko Cc: Dmitry Vyukov Fixes: 0c96350a2d2f ("lib/test_kasan.c: add tests for several string/memo= ry API functions") Reviewed-by: Dmitry Vyukov Signed-off-by: Daniel Axtens --- v2: rename variables to have kasan_ prefixes --- lib/test_kasan.c | 30 +++++++++++++++++++----------- 1 file changed, 19 insertions(+), 11 deletions(-) diff --git a/lib/test_kasan.c b/lib/test_kasan.c index 328d33beae36..a130d75b9385 100644 --- a/lib/test_kasan.c +++ b/lib/test_kasan.c @@ -23,6 +23,14 @@ =20 #include =20 +/* + * We assign some test results to these globals to make sure the tests + * are not eliminated as dead code. + */ + +int kasan_int_result; +void *kasan_ptr_result; + /* * Note: test functions are marked noinline so that their names appear i= n * reports. @@ -603,7 +611,7 @@ static noinline void __init kasan_memchr(void) if (!ptr) return; =20 - memchr(ptr, '1', size + 1); + kasan_ptr_result =3D memchr(ptr, '1', size + 1); kfree(ptr); } =20 @@ -618,8 +626,7 @@ static noinline void __init kasan_memcmp(void) if (!ptr) return; =20 - memset(arr, 0, sizeof(arr)); - memcmp(ptr, arr, size+1); + kasan_int_result =3D memcmp(ptr, arr, size + 1); kfree(ptr); } =20 @@ -642,22 +649,22 @@ static noinline void __init kasan_strings(void) * will likely point to zeroed byte. */ ptr +=3D 16; - strchr(ptr, '1'); + kasan_ptr_result =3D strchr(ptr, '1'); =20 pr_info("use-after-free in strrchr\n"); - strrchr(ptr, '1'); + kasan_ptr_result =3D strrchr(ptr, '1'); =20 pr_info("use-after-free in strcmp\n"); - strcmp(ptr, "2"); + kasan_int_result =3D strcmp(ptr, "2"); =20 pr_info("use-after-free in strncmp\n"); - strncmp(ptr, "2", 1); + kasan_int_result =3D strncmp(ptr, "2", 1); =20 pr_info("use-after-free in strlen\n"); - strlen(ptr); + kasan_int_result =3D strlen(ptr); =20 pr_info("use-after-free in strnlen\n"); - strnlen(ptr, 1); + kasan_int_result =3D strnlen(ptr, 1); } =20 static noinline void __init kasan_bitops(void) @@ -724,11 +731,12 @@ static noinline void __init kasan_bitops(void) __test_and_change_bit(BITS_PER_LONG + BITS_PER_BYTE, bits); =20 pr_info("out-of-bounds in test_bit\n"); - (void)test_bit(BITS_PER_LONG + BITS_PER_BYTE, bits); + kasan_int_result =3D test_bit(BITS_PER_LONG + BITS_PER_BYTE, bits); =20 #if defined(clear_bit_unlock_is_negative_byte) pr_info("out-of-bounds in clear_bit_unlock_is_negative_byte\n"); - clear_bit_unlock_is_negative_byte(BITS_PER_LONG + BITS_PER_BYTE, bits); + kasan_int_result =3D clear_bit_unlock_is_negative_byte(BITS_PER_LONG + + BITS_PER_BYTE, bits); #endif kfree(bits); } --=20 2.20.1