From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id 69147C531DC for ; Tue, 20 Aug 2024 19:49:35 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id E7E086B0092; Tue, 20 Aug 2024 15:49:34 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id DDDD26B0095; Tue, 20 Aug 2024 15:49:34 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id C7E936B0096; Tue, 20 Aug 2024 15:49:34 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0010.hostedemail.com [216.40.44.10]) by kanga.kvack.org (Postfix) with ESMTP id A5F6B6B0092 for ; Tue, 20 Aug 2024 15:49:34 -0400 (EDT) Received: from smtpin30.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay03.hostedemail.com (Postfix) with ESMTP id 1B2DCA04F2 for ; Tue, 20 Aug 2024 19:49:34 +0000 (UTC) X-FDA: 82473663468.30.DE87DA7 Received: from mail-yw1-f202.google.com (mail-yw1-f202.google.com [209.85.128.202]) by imf17.hostedemail.com (Postfix) with ESMTP id 50E8140018 for ; Tue, 20 Aug 2024 19:49:32 +0000 (UTC) Authentication-Results: imf17.hostedemail.com; dkim=pass header.d=google.com header.s=20230601 header.b=FHqgXiLk; dmarc=pass (policy=reject) header.from=google.com; spf=pass (imf17.hostedemail.com: domain of 3S_PEZgcKCIIssg0xkxmuumrk.iusrot03-ssq1giq.uxm@flex--mmaurer.bounces.google.com designates 209.85.128.202 as permitted sender) smtp.mailfrom=3S_PEZgcKCIIssg0xkxmuumrk.iusrot03-ssq1giq.uxm@flex--mmaurer.bounces.google.com ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1724183356; a=rsa-sha256; cv=none; b=kuMhaO5vhNh2dVD+qV03p+gJ14ZMewbfGwHhqBl2Egpl5PdIdB4ft6iZ17Yt0LsTCA0ZPd N2vII5gguu6UZNNMrX36iaJtYAS4R19iJcO7pqqBBUCqIgeCk0W4TCx2SdSXIo+tWM4ia2 TAqbFIN4WnK5qJ+1tCyjK439gFlMpgw= ARC-Authentication-Results: i=1; imf17.hostedemail.com; dkim=pass header.d=google.com header.s=20230601 header.b=FHqgXiLk; dmarc=pass (policy=reject) header.from=google.com; spf=pass (imf17.hostedemail.com: domain of 3S_PEZgcKCIIssg0xkxmuumrk.iusrot03-ssq1giq.uxm@flex--mmaurer.bounces.google.com designates 209.85.128.202 as permitted sender) smtp.mailfrom=3S_PEZgcKCIIssg0xkxmuumrk.iusrot03-ssq1giq.uxm@flex--mmaurer.bounces.google.com ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1724183356; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type:content-transfer-encoding: in-reply-to:in-reply-to:references:references:dkim-signature; bh=IttCgeBRXfLGGSRTMWMVTYyC3qQ0hIHeZRv9TWbyvy4=; b=eHTuurXjir6ifW7RQtoNubHmZlfI5ZoJWUB1S07qjySB/ncKDDVYNj7/X1+at5EktiHwlI uo0Jzcuo1L7ZYIU6LRSnu/w36jL+0rCxpnPy/ORcuSptgiE8B1Fx9euOGWm7UmCm0b2koD 0m/oFw9iy5+K/BYoFW9onGBj0/LJeiw= Received: by mail-yw1-f202.google.com with SMTP id 00721157ae682-6ad9ffa0d77so108332187b3.2 for ; Tue, 20 Aug 2024 12:49:31 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20230601; t=1724183371; x=1724788171; darn=kvack.org; h=cc:to:from:subject:message-id:references:mime-version:in-reply-to :date:from:to:cc:subject:date:message-id:reply-to; bh=IttCgeBRXfLGGSRTMWMVTYyC3qQ0hIHeZRv9TWbyvy4=; b=FHqgXiLkiZFf4en4QIPysCmhzc4fUNvKu7Ir/rhXrCiF9xhWAyEzTS1EDoe7QyUaHe F9OxiQn6wE/j4eZnl2JZj4uFa9Hiebqw5z92VxVqcg71GpMNS7bJH4uLO9os5OTTG1vb RoVEpdNxNoQ4HHyjfrWi126ry47dcKi1g4YoUNyqCNTi5A0sz5wud8NwvxJPZmQOcgaD tqLtLc0gQkZnisg1RLiu9cWVPIbF1x9hHxOqRJ8eSwRsd/rwprsNOZPUCCfItAjckGhu nsOgI15fDYiss6dt6yVvECqblf00YV8+/yeDDDOBf4+5ljRTbFxqUA/zJtvUJr2VoVsX LHnw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1724183371; x=1724788171; h=cc:to:from:subject:message-id:references:mime-version:in-reply-to :date:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to; bh=IttCgeBRXfLGGSRTMWMVTYyC3qQ0hIHeZRv9TWbyvy4=; b=jVQQ+MD7BmFwgMAUPZRKRiLPIqY1z/X0zwExew/idbFRTE/NNfSclDRGm0reWLOano zyjkmT4wZBeAUI43rWwOtEFtl3fHOsfDvi+Lorxe6tVIjlIZuyp1iUaFPrwQDWzq7Wz9 whqeRlzTPOGrefofZoWbBLzAXT5Ng4OKqcJedNPEQP9+wB+LWZewnOnkDzoio5pDUK8N pfY+QvKVjWaE4vFA4CIfivKG3d2GfZie/yHBonQZbZDjtk5YwBDsl7m6PcqlJC+vQpuy GQwlxlGTi70gW30A4t8PZ49WVI+WZHQ3YIX5Esljcgd0XUc3X/yRF2+a1Xc5ulSOfY/E DvCg== X-Forwarded-Encrypted: i=1; AJvYcCWrLJfYiX6Zj7UJvs2u+J2TmFgQZK2ERMeYRLIQ8oiyYCI/XNEpk6254RhM/MEkbRFwlPadCs26gQ==@kvack.org X-Gm-Message-State: AOJu0YxlBVb/31CNCC9yJ8JNe3vbgM/UeyxGSbZJfbPZQeM+1LKyko+1 kTdYl0ple6c9vs1a+VerYykapEiG5pLYYwYr2fAnYDi5nez26pFV25vALIyfcF5MMzE4C6fGeJm itBPKHQ== X-Google-Smtp-Source: AGHT+IEN9uC1pBVlr5yFGFnZTcI/TObT0KfWuCPlVXznLGPUmFhI8NvOaWswDP0C+6WD618T70RZJO/olJf+ X-Received: from anyblade.c.googlers.com ([fda3:e722:ac3:cc00:20:ed76:c0a8:1791]) (user=mmaurer job=sendgmr) by 2002:a25:dc06:0:b0:e11:ade7:ba56 with SMTP id 3f1490d57ef6-e16655a14famr5299276.7.1724183371261; Tue, 20 Aug 2024 12:49:31 -0700 (PDT) Date: Tue, 20 Aug 2024 19:48:59 +0000 In-Reply-To: <20240820194910.187826-1-mmaurer@google.com> Mime-Version: 1.0 References: <20240820194910.187826-1-mmaurer@google.com> X-Mailer: git-send-email 2.46.0.184.g6999bdac58-goog Message-ID: <20240820194910.187826-5-mmaurer@google.com> Subject: [PATCH v4 4/4] kasan: rust: Add KASAN smoke test via UAF From: Matthew Maurer To: andreyknvl@gmail.com, ojeda@kernel.org, Andrey Ryabinin , Andrew Morton , Alex Gaynor , Wedson Almeida Filho Cc: dvyukov@google.com, aliceryhl@google.com, samitolvanen@google.com, kasan-dev@googlegroups.com, linux-mm@kvack.org, glider@google.com, Matthew Maurer , Vincenzo Frascino , Boqun Feng , Gary Guo , "=?UTF-8?q?Bj=C3=B6rn=20Roy=20Baron?=" , Benno Lossin , Andreas Hindborg , linux-kernel@vger.kernel.org, rust-for-linux@vger.kernel.org Content-Type: text/plain; charset="UTF-8" X-Rspam-User: X-Rspamd-Queue-Id: 50E8140018 X-Rspamd-Server: rspam01 X-Stat-Signature: j4pu4bp9ugakmatycnkynza6oq6gbzah X-HE-Tag: 1724183372-643309 X-HE-Meta: U2FsdGVkX18m539JASsDerCRLGuuOb0hYkzZsEdE8pjwzPJReOAIteAsRT96Lk1iDdMy9mUR0by/Br0jw316wKScDi8IMRg0eZoqwd4yj28MtgFX6YhLcM6mz6A1diUzwJbzp+RE+zBlEi7r1cF/hLYMfr2UnWBA5V9tdavmYKxFQ6iXwxa3xKnXWtrFU/nq7CStqzECnMQ5TXr+KgHXZ9GcRuZDtGyu5mDzOnz4qytq9bv0EFwhx+EjCEsbQ2QbHxGUDqTddQ/WdK+/NjFka0bETNxl7McDTjoSFxy0h0vDLmDtqVVhWltiR1XD8W3ksj6QftLT9GoYSkWNdIIqsZGRPZ30hwAcwJC1a0SszsF/Hfo7y0Rzm6RaCMexf+42Cwr0Tqpm7y2/A3ZF4MT6XK6Jdghqy7vVwRv8YDc3OvsXfAEujkGmn0zqGts5ugg6lp9oc+aACOmewRoX6O0ammpC0evEoYrb2CRJAHm8cSc18qXMe12G95kL+s9jJ3nECREAjVO4s9LK0FafjzUEPGpzt7Q4V1GkYUIv5iWHJ4/46BkeqpeEs9jnIItt86AQg7id6d3BRfjVBU8VaoDdih/aly458iEpvOyMs2byjanFmKxEPzlC5L/bBdvczewrxWubLV+XIR9uVyRWYUP5VvTXJDSqj9pdvLvXur/zMOoTIp1Jp4aTBGs2gifdInHZDHnXvdC4MIRf7QRfDksdNdT9XQAkdXlYmnpCihVtMwmk/fZAlAjBqOlAeKF7yKANAlWnkhEeKg7FMKZAvd9drUPFfIky66lZ/WATxsYrQzSQtb6EyMULNZl086SjW9esBZiFl2ONOLwYuejL5iXdbKU3n8FJaSizWA50ZqDk3tesYuPT8Am2Tk09G7mndmQz6emak5OCMnJALQzQy6V/RK8yiRW9Lb0J2iOi2NbxXN/ybI1z10fBQTz79PHUW2TwkK36gT4sJsLISSUa5eE sBFTaAD/ kCq/OdtM/XYmbfSc96BCdQ6KKeWcvITPaEXXG+0Hv1vKhcdu5BRIQwPD1PxWhnxXZNQAnvHYGiQPzs5xrm5eLs+81n/+pHhlC/egZsSEbEDL+rEyJQJy8hPX/qvm9lygbgCMWaYRcdzQtYiWXkk4WlfiIKx80+ATjgDwE7R0FwQC0y9c6mkRdSBu53oKr49Mk//vc2Q8A72w6DDI1cDXB5MNoowDQkofZ9X77/xiVXJGtFZiIxO2TcUnFcJdyTgGNSjdFsQt60BLZHbv0sS4Ij4rHbUuPJDRejNRxKnxBm6XZy0axJ3HrC4owp1oSaIM0eoiDmXgT/5uSJo//lSWAWHJaOqr8Lj5p+q815rPv2n5TBPbMpqXL5S5zkmxA4wZ9VOPFxt/5KiN+lGUUHq66wvcJse52zThC30J2cqS6P1SQB4ZY8QpsC3s3MTtjF0ecqsrswMHPVdfaWJCm9OIozSNMJzs6/pSQ8/nlqsoB6G27KGFT3VeD+ASM0SmPDxrDbRzObSLG8WZPy++GLow70W9FBygX6EnBVqRcy3vsHPEEw8/j1BQEHMNygKxFJ1Q9hLHqiIAEVaKsTUmdjAhJ5k2xEw== X-Bogosity: Ham, tests=bogofilter, spamicity=0.000007, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: List-Subscribe: List-Unsubscribe: Adds a smoke test to ensure that KASAN in Rust is actually detecting a Rust-native UAF. There is significant room to expand this test suite, but this will at least ensure that flags are having the intended effect. The rename from kasan_test.c to kasan_test_c.c is in order to allow the single kasan_test.ko test suite to contain both a .o file produced by the C compiler and one produced by rustc. Signed-off-by: Matthew Maurer --- mm/kasan/Makefile | 7 ++++++- mm/kasan/kasan.h | 6 ++++++ mm/kasan/{kasan_test.c => kasan_test_c.c} | 12 ++++++++++++ mm/kasan/kasan_test_rust.rs | 19 +++++++++++++++++++ 4 files changed, 43 insertions(+), 1 deletion(-) rename mm/kasan/{kasan_test.c => kasan_test_c.c} (99%) create mode 100644 mm/kasan/kasan_test_rust.rs diff --git a/mm/kasan/Makefile b/mm/kasan/Makefile index 7634dd2a6128..13059d9ee13c 100644 --- a/mm/kasan/Makefile +++ b/mm/kasan/Makefile @@ -44,13 +44,18 @@ ifndef CONFIG_CC_HAS_KASAN_MEMINTRINSIC_PREFIX CFLAGS_KASAN_TEST += -fno-builtin endif -CFLAGS_kasan_test.o := $(CFLAGS_KASAN_TEST) +CFLAGS_kasan_test_c.o := $(CFLAGS_KASAN_TEST) +RUSTFLAGS_kasan_test_rust.o := $(RUSTFLAGS_KASAN) CFLAGS_kasan_test_module.o := $(CFLAGS_KASAN_TEST) obj-y := common.o report.o obj-$(CONFIG_KASAN_GENERIC) += init.o generic.o report_generic.o shadow.o quarantine.o obj-$(CONFIG_KASAN_HW_TAGS) += hw_tags.o report_hw_tags.o tags.o report_tags.o obj-$(CONFIG_KASAN_SW_TAGS) += init.o report_sw_tags.o shadow.o sw_tags.o tags.o report_tags.o +kasan_test-objs := kasan_test_c.o +ifdef CONFIG_RUST + kasan_test-objs += kasan_test_rust.o +endif obj-$(CONFIG_KASAN_KUNIT_TEST) += kasan_test.o obj-$(CONFIG_KASAN_MODULE_TEST) += kasan_test_module.o diff --git a/mm/kasan/kasan.h b/mm/kasan/kasan.h index fb2b9ac0659a..f438a6cdc964 100644 --- a/mm/kasan/kasan.h +++ b/mm/kasan/kasan.h @@ -555,6 +555,12 @@ static inline bool kasan_arch_is_ready(void) { return true; } void kasan_kunit_test_suite_start(void); void kasan_kunit_test_suite_end(void); +#ifdef CONFIG_RUST +char kasan_test_rust_uaf(void); +#else +static inline char kasan_test_rust_uaf(void) { return '\0'; } +#endif + #else /* CONFIG_KASAN_KUNIT_TEST */ static inline void kasan_kunit_test_suite_start(void) { } diff --git a/mm/kasan/kasan_test.c b/mm/kasan/kasan_test_c.c similarity index 99% rename from mm/kasan/kasan_test.c rename to mm/kasan/kasan_test_c.c index 7b32be2a3cf0..dd3d2a1e3145 100644 --- a/mm/kasan/kasan_test.c +++ b/mm/kasan/kasan_test_c.c @@ -1899,6 +1899,17 @@ static void match_all_mem_tag(struct kunit *test) kfree(ptr); } +/* + * Check that Rust performing a use-after-free using `unsafe` is detected. + * This is a smoke test to make sure that Rust is being sanitized properly. + */ +static void rust_uaf(struct kunit *test) +{ + KASAN_TEST_NEEDS_CONFIG_ON(test, CONFIG_RUST); + KUNIT_EXPECT_KASAN_FAIL(test, kasan_test_rust_uaf()); +} + + static struct kunit_case kasan_kunit_test_cases[] = { KUNIT_CASE(kmalloc_oob_right), KUNIT_CASE(kmalloc_oob_left), @@ -1971,6 +1982,7 @@ static struct kunit_case kasan_kunit_test_cases[] = { KUNIT_CASE(match_all_not_assigned), KUNIT_CASE(match_all_ptr_tag), KUNIT_CASE(match_all_mem_tag), + KUNIT_CASE(rust_uaf), {} }; diff --git a/mm/kasan/kasan_test_rust.rs b/mm/kasan/kasan_test_rust.rs new file mode 100644 index 000000000000..7239303b232c --- /dev/null +++ b/mm/kasan/kasan_test_rust.rs @@ -0,0 +1,19 @@ +// SPDX-License-Identifier: GPL-2.0 + +//! Helper crate for KASAN testing +//! Provides behavior to check the sanitization of Rust code. +use kernel::prelude::*; +use core::ptr::addr_of_mut; + +/// Trivial UAF - allocate a big vector, grab a pointer partway through, +/// drop the vector, and touch it. +#[no_mangle] +pub extern "C" fn kasan_test_rust_uaf() -> u8 { + let mut v: Vec = Vec::new(); + for _ in 0..4096 { + v.push(0x42, GFP_KERNEL).unwrap(); + } + let ptr: *mut u8 = addr_of_mut!(v[2048]); + drop(v); + unsafe { *ptr } +} -- 2.46.0.184.g6999bdac58-goog