From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id 3C799C433EF for ; Mon, 24 Jan 2022 17:54:39 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id 56CEA6B0092; Mon, 24 Jan 2022 12:54:39 -0500 (EST) Received: by kanga.kvack.org (Postfix, from userid 40) id 51C966B0093; Mon, 24 Jan 2022 12:54:39 -0500 (EST) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 40B786B0096; Mon, 24 Jan 2022 12:54:39 -0500 (EST) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (relay032.a.hostedemail.com [64.99.140.32]) by kanga.kvack.org (Postfix) with ESMTP id 338BA6B0092 for ; Mon, 24 Jan 2022 12:54:39 -0500 (EST) Received: from smtpin03.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay11.hostedemail.com (Postfix) with ESMTP id DE59A80BE4 for ; Mon, 24 Jan 2022 17:54:38 +0000 (UTC) X-FDA: 79065930636.03.47515FD Received: from mail-il1-f174.google.com (mail-il1-f174.google.com [209.85.166.174]) by imf09.hostedemail.com (Postfix) with ESMTP id 7B97314003C for ; Mon, 24 Jan 2022 17:54:37 +0000 (UTC) Received: by mail-il1-f174.google.com with SMTP id u5so14559652ilq.9 for ; Mon, 24 Jan 2022 09:54:37 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20210112; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=v3YviFAQ/40r1Ln+w4BlMxkBPCxENdD7r0D/7v9ETwo=; b=dWoGsnVbWXxYZrsoyRM4jqwgPH9tlliG+bskmwwLky9K61904rvDw4ff/Y0EXFBm1W nqabQyNDPO5FqYFCMVQZRWMfJeXuWn/k69QV4RxH8Ii4Fn8I2lJsTrk681VjkePLs5WY rVYsdSkowmEbcuPmbMzKFFT9EvTJi77N7epzNQax3NnQhuT7c5xIfv40tBWrIVzL5ifa 788H3IGZpHjsn9YuPREbV/XU8E5siypl6FHQ0iYDQChGBGz3fNlELG1n0j4q4+TZmWk7 lskk0jV2J18Ztm/tu/IB6fWUf9Ff+G8LnNq21o+eOdHXml4BThTcox6PNCDA5lJKsQhT S/hg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=v3YviFAQ/40r1Ln+w4BlMxkBPCxENdD7r0D/7v9ETwo=; b=d90TnviwrIC3rSiIuIOm7DYCFXFuReXbYjmlxBlXGINO3E/vP+HeA7BiRAnmuVgsCM ii6sbCi41UmVSbVs1jG8TXjV/oX3rV7TXwSL2QvHQAPIiGOyCjc6kw58Sac+3GRTKvzk TQpGfm+tSZKWDfi5WwUZ4tq8TcAkcz7i3FQxL9kXUSe6QIQUviDiOjJAeut8mw9pB+fr 5D/siuLlYDTzqEk6jAtGIfHFfuiPuAFJeWPUu7Pl49IX34uaGjgFIpOa8WlXhyL8a4oO ubjZV0xLLGDyOr4rTpBoDW7H7HPz1TPSog4uLzKIc7XopgBOM/HlMRVISKdS6reOj15O QQ6g== X-Gm-Message-State: AOAM530swHfR8GThiu1mZhPJ8w2ZrYGFj+fNL/0z25CtyngDdeDHS12a 2LjGOrpPUSbgNjUlSK0oFsVnhDsdQshTGPdZuXQ= X-Google-Smtp-Source: ABdhPJysOYoTc4Ltu0dYW29wGEgvxAwalCuXafYeH1tLPI1C1zlPZNNpjzs+IsMamsYtNilhMnqNb0qGWRiYo2s3MVY= X-Received: by 2002:a05:6e02:1568:: with SMTP id k8mr7648938ilu.235.1643046877495; Mon, 24 Jan 2022 09:54:37 -0800 (PST) MIME-Version: 1.0 References: <20220124160744.1244685-1-elver@google.com> In-Reply-To: <20220124160744.1244685-1-elver@google.com> From: Andrey Konovalov Date: Mon, 24 Jan 2022 18:54:26 +0100 Message-ID: Subject: Re: [PATCH] kasan: test: fix compatibility with FORTIFY_SOURCE To: Marco Elver Cc: Andrew Morton , Andrey Ryabinin , Alexander Potapenko , Dmitry Vyukov , kasan-dev , LKML , Linux Memory Management List , Kees Cook , Brendan Higgins , linux-hardening@vger.kernel.org, Nico Pache Content-Type: text/plain; charset="UTF-8" X-Rspamd-Queue-Id: 7B97314003C X-Stat-Signature: zgegy7eua6zw98h9g59jkfm8nsxgwne5 Authentication-Results: imf09.hostedemail.com; dkim=pass header.d=gmail.com header.s=20210112 header.b=dWoGsnVb; spf=pass (imf09.hostedemail.com: domain of andreyknvl@gmail.com designates 209.85.166.174 as permitted sender) smtp.mailfrom=andreyknvl@gmail.com; dmarc=pass (policy=none) header.from=gmail.com X-Rspamd-Server: rspam01 X-HE-Tag: 1643046877-689281 X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: -On Mon, Jan 24, 2022 at 5:07 PM Marco Elver wrote: > > With CONFIG_FORTIFY_SOURCE enabled, string functions will also perform > dynamic checks using __builtin_object_size(ptr), which when failed will > panic the kernel. > > Because the KASAN test deliberately performs out-of-bounds operations, > the kernel panics with FORITY_SOURCE, for example: Nit: FORITY_SOURCE -> FORTIFY_SOURCE > > | kernel BUG at lib/string_helpers.c:910! > | invalid opcode: 0000 [#1] PREEMPT SMP KASAN PTI > | CPU: 1 PID: 137 Comm: kunit_try_catch Tainted: G B 5.16.0-rc3+ #3 > | Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.14.0-2 04/01/2014 > | RIP: 0010:fortify_panic+0x19/0x1b > | ... > | Call Trace: > | > | kmalloc_oob_in_memset.cold+0x16/0x16 > | ... > > Fix it by also hiding `ptr` from the optimizer, which will ensure that > __builtin_object_size() does not return a valid size, preventing > fortified string functions from panicking. > > Reported-by: Nico Pache > Signed-off-by: Marco Elver > --- > lib/test_kasan.c | 5 +++++ > 1 file changed, 5 insertions(+) > > diff --git a/lib/test_kasan.c b/lib/test_kasan.c > index 847cdbefab46..26a5c9007653 100644 > --- a/lib/test_kasan.c > +++ b/lib/test_kasan.c > @@ -492,6 +492,7 @@ static void kmalloc_oob_in_memset(struct kunit *test) > ptr = kmalloc(size, GFP_KERNEL); > KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr); > > + OPTIMIZER_HIDE_VAR(ptr); > OPTIMIZER_HIDE_VAR(size); > KUNIT_EXPECT_KASAN_FAIL(test, > memset(ptr, 0, size + KASAN_GRANULE_SIZE)); > @@ -515,6 +516,7 @@ static void kmalloc_memmove_negative_size(struct kunit *test) > KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr); > > memset((char *)ptr, 0, 64); > + OPTIMIZER_HIDE_VAR(ptr); > OPTIMIZER_HIDE_VAR(invalid_size); > KUNIT_EXPECT_KASAN_FAIL(test, > memmove((char *)ptr, (char *)ptr + 4, invalid_size)); > @@ -531,6 +533,7 @@ static void kmalloc_memmove_invalid_size(struct kunit *test) > KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr); > > memset((char *)ptr, 0, 64); > + OPTIMIZER_HIDE_VAR(ptr); > KUNIT_EXPECT_KASAN_FAIL(test, > memmove((char *)ptr, (char *)ptr + 4, invalid_size)); > kfree(ptr); > @@ -893,6 +896,7 @@ static void kasan_memchr(struct kunit *test) > ptr = kmalloc(size, GFP_KERNEL | __GFP_ZERO); > KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr); > > + OPTIMIZER_HIDE_VAR(ptr); > OPTIMIZER_HIDE_VAR(size); > KUNIT_EXPECT_KASAN_FAIL(test, > kasan_ptr_result = memchr(ptr, '1', size + 1)); > @@ -919,6 +923,7 @@ static void kasan_memcmp(struct kunit *test) > KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr); > memset(arr, 0, sizeof(arr)); > > + OPTIMIZER_HIDE_VAR(ptr); > OPTIMIZER_HIDE_VAR(size); > KUNIT_EXPECT_KASAN_FAIL(test, > kasan_int_result = memcmp(ptr, arr, size+1)); > -- > 2.35.0.rc0.227.g00780c9af4-goog > Reviewed-by: Andrey Konovalov