From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id 3BE2CC54EBE for ; Fri, 13 Jan 2023 08:02:16 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id 86A298E0002; Fri, 13 Jan 2023 03:02:15 -0500 (EST) Received: by kanga.kvack.org (Postfix, from userid 40) id 7F3C78E0001; Fri, 13 Jan 2023 03:02:15 -0500 (EST) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 66CD08E0002; Fri, 13 Jan 2023 03:02:15 -0500 (EST) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0015.hostedemail.com [216.40.44.15]) by kanga.kvack.org (Postfix) with ESMTP id 50C1A8E0001 for ; Fri, 13 Jan 2023 03:02:15 -0500 (EST) Received: from smtpin19.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay01.hostedemail.com (Postfix) with ESMTP id 2722B1C5D2F for ; Fri, 13 Jan 2023 08:02:15 +0000 (UTC) X-FDA: 80349033030.19.B1A2559 Received: from mail-lf1-f44.google.com (mail-lf1-f44.google.com [209.85.167.44]) by imf21.hostedemail.com (Postfix) with ESMTP id 4A8EF1C0002 for ; Fri, 13 Jan 2023 08:02:12 +0000 (UTC) Authentication-Results: imf21.hostedemail.com; dkim=pass header.d=google.com header.s=20210112 header.b=mqO98eOB; spf=pass (imf21.hostedemail.com: domain of dvyukov@google.com designates 209.85.167.44 as permitted sender) smtp.mailfrom=dvyukov@google.com; dmarc=pass (policy=reject) header.from=google.com ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1673596933; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references:dkim-signature; bh=Dd0gSl4CE2V3d5G56HYqss/GOHVFV1yZ9nbqL6AwD9A=; b=bx91ujP3gajGJKdfLj5xL3XnClkwU5gfJXzUCC9xf/lQ8QSkrbAAk43Y8Ka1rA5kExlmBt r59DgrBzcLBwW57bVE+f+P1RXbgjdpSKb0ndWIGVW+ztniIHO+tWc9FLlIX02RilnjWN6K 9ZAltQMNxoA87UZVULRfq7Chp+YUV3k= ARC-Authentication-Results: i=1; imf21.hostedemail.com; dkim=pass header.d=google.com header.s=20210112 header.b=mqO98eOB; spf=pass (imf21.hostedemail.com: domain of dvyukov@google.com designates 209.85.167.44 as permitted sender) smtp.mailfrom=dvyukov@google.com; dmarc=pass (policy=reject) header.from=google.com ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1673596933; a=rsa-sha256; cv=none; b=CUo4ZWqZlanPrnbUaGiT5wHwxhn2ajeYDPeovoTWiY6x7kKZj+h4c8aZjnVVjF42rCUGID OEL7+Ghq8fiCv1Q6rtf51+SK3RitlpGgst3lzcIIyUWkQOhLsfcee7oCWtIa27TaK/9nI3 tD0VGEO0ihsogrMJcvzJkC2k14trDB0= Received: by mail-lf1-f44.google.com with SMTP id o20so40840lfk.5 for ; Fri, 13 Jan 2023 00:02:12 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20210112; h=content-transfer-encoding:cc:to:subject:message-id:date:from :in-reply-to:references:mime-version:from:to:cc:subject:date :message-id:reply-to; bh=Dd0gSl4CE2V3d5G56HYqss/GOHVFV1yZ9nbqL6AwD9A=; b=mqO98eOBz/748Ci6ObhHIea8mpxnmd1rLxJ1Ah0FmfoDLs+0VTI6z2oPJlJ53r268e xHuZrV1llZVFtYzDl0sZAThadKvHRnMn3SMfUbCcOT9fu4uum5kjAhAWxrPETU8dgQ68 O2ypD+B1kjo3uMVWaB8Gc2y/NTTKCh7cFQlmzYJo1/iZzhdwYnhopyKNkz7saxX+Kg92 OLF9Ov9XTl5HPOe4qR9WGx8Z59cOx+sHT46tu/vN6k+x0ZhWlMAhY2dahytJ+XR7sOOg Mzde0OVNSIncs51cnSUdwFHUJ0wJIYMZ4pdq/uwRtSG5ywtU9tbixlRfPpBtAxCNExhY u2kA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=content-transfer-encoding:cc:to:subject:message-id:date:from :in-reply-to:references:mime-version:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=Dd0gSl4CE2V3d5G56HYqss/GOHVFV1yZ9nbqL6AwD9A=; b=Z2WzmxZU+83G9YGG9BtHXEd36kuzmZYOh199hz75JvKXlPuMScguCdb65rj+uxVKjr zoH9Y9fBUUP7ZluB+8Em7E7oJdMaJtctq9rUYEsDzDLZgMk58cBk3PU1Fyd8PGl5Zy6l IyMdEZn22KTVSYgBShX2Q3Q8mITnZN/+P5/gca7aitlDEPRFQ3UM9Zfnz3YalKq2SpFO vVJ1Y+94JdQNnhMmAF5Z/BpPWE/WFb0WohMZmXL0LX1XIcPThYJjIyHQQH6d+4Vbq7Td hVwqB7Nqm8t7sm2sTbBcpMOZxpWP5ZDLcsGNcoyAcYnGjkF/P+nzeDz5Og8U3FqJ6lD1 fApw== X-Gm-Message-State: AFqh2krIDxQTHRh6lJtUPwR35D0HWPRigtDfE/CCtqXICnil5YM/B1Pj T4OKGBXuUlhh80eD6bzbmMfQq+mnxHuh2zsz6gtW7Q== X-Google-Smtp-Source: AMrXdXsuLPtxsRjt59Z2mJObWpDdPhsFvqdheqjEmNoRMVg61TYZVi8JX1s9a7xADaxX36MhxBDwaBe+xj6Bo6cV56o= X-Received: by 2002:a05:6512:6c6:b0:4a4:77a8:45a4 with SMTP id u6-20020a05651206c600b004a477a845a4mr3595816lff.654.1673596931130; Fri, 13 Jan 2023 00:02:11 -0800 (PST) MIME-Version: 1.0 References: <20230103075603.12294-1-Kuan-Ying.Lee@mediatek.com> In-Reply-To: From: Dmitry Vyukov Date: Fri, 13 Jan 2023 09:01:58 +0100 Message-ID: Subject: Re: [PATCH] kasan: infer the requested size by scanning shadow memory To: =?UTF-8?B?S3Vhbi1ZaW5nIExlZSAo5p2O5Yag56mOKQ==?= Cc: "linux-kernel@vger.kernel.org" , "linux-mediatek@lists.infradead.org" , =?UTF-8?B?UXVuLXdlaSBMaW4gKOael+e+pOW0tCk=?= , "linux-mm@kvack.org" , "andreyknvl@gmail.com" , =?UTF-8?B?Q2hpbndlbiBDaGFuZyAo5by16Yym5paHKQ==?= , "kasan-dev@googlegroups.com" , "akpm@linux-foundation.org" , "ryabinin.a.a@gmail.com" , "linux-arm-kernel@lists.infradead.org" , "glider@google.com" , "vincenzo.frascino@arm.com" , "matthias.bgg@gmail.com" Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable X-Rspam-User: X-Rspamd-Server: rspam04 X-Rspamd-Queue-Id: 4A8EF1C0002 X-Stat-Signature: cn7p799a15odwcs6yenistu7ifdqgkru X-HE-Tag: 1673596932-328558 X-HE-Meta: U2FsdGVkX18tg8ujiTyPgPUciGTf5rhD74Zu+Kcci5KRwX+9+gkjXdBb9AKqI7KaxQDjYK5oBLnIpjO3Sr6oly/M5gD87HGzaY0fhXljoXRtGW+Xjz5aqMFmFVopTu8hRxhVrzZWVx+Khoa/V9YtWIcr25xa7rcztU+cOTakn0Cr0kJlNrGnyjQd4pi8hgNhUjHa0Pwhl6g0luzMcpl2Mu1qGZelTJKmUcjJW4n3Ooc1PZuGI21+MUqUNP2otkn5iu1EOSsXQf39quU29vi1VDUyDsQJJCfJXrGqU1fBFUwVgjyRoRko8pWca60svf6Pr4abBzsRQieok4iDNEG1qsyZnOQDy0LCOx3MmDBet36LfkdHD5OZrVxdjNvWxork7ilzigAf5zq9OAHRsdvEYJwyUmohw+f9Ka54pau6fpIR8eGPMojoKMCZVEqeK6ymX9iBXfdkVfWFx3u7WQtzL4GTD8LWw5XSm8BM9N8xYx79d8SbjHbe6v/qwOIydxqQYzFexUR7rc25MU8VNnjCxFVHGIUro9rCNE0EFqUoBx3Yy5kbFjylWvbckRY/GtbZo3jzLUz/0kvsnexmwBoUN4bjRac99R8n13uEzxWXQir+SNgN5rH/bWwRAbd1C1xY5Bx0/nEuM3C9inAnQATCzv0Y0Wc6RDxRvujitHID1p8ZiXO1rlQpIlrAXfmlqrNX75tx3jDd7N13ZBcUAEpjFOL+Wv2VNhwS54B6WW5gUUcE5i3rcWW3KCskGVvMPYKkZInZx9Ic4DIlAwBKoQ124qhbpY3ueWTgpvhoO15/3+YpJwUCIzLnlzv5jb1Jd7dr9sQw3xXXtGOhXMntHuPzfLsKqslyQA82ocQhWmgeNCuDlVNLSkJBYSytgzIKKu566GdBmmTfYNBSUpbOuKQTp6v8yvvV/OhXoQl9WkqM85D514RtggDk9gY/BtxVICTHx83O+BeKo4LgXRulDbO GxqM/MRg v3EHucQZVNkRrvKtz2BwTZr3OaoWkAow2piSiDmNBxsRy+I8LRscqJo88nDSaKqoykeKpTlaLuSg6+74qAy4JaZGnKkHHtWoXhwbmv0hjIvLbmtwxa6dvi3AtIkvWQeOy6zHV X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: On Fri, 13 Jan 2023 at 08:59, 'Kuan-Ying Lee (=E6=9D=8E=E5=86=A0=E7=A9=8E)'= via kasan-dev wrote: > > On Mon, 2023-01-09 at 07:51 +0100, Dmitry Vyukov wrote: > > On Tue, 3 Jan 2023 at 08:56, 'Kuan-Ying Lee' via kasan-dev > > wrote: > > > > > > We scan the shadow memory to infer the requested size instead of > > > printing cache->object_size directly. > > > > > > This patch will fix the confusing generic kasan report like below. > > > [1] > > > Report shows "cache kmalloc-192 of size 192", but user > > > actually kmalloc(184). > > > > > > =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D > > > BUG: KASAN: slab-out-of-bounds in _find_next_bit+0x143/0x160 > > > lib/find_bit.c:109 > > > Read of size 8 at addr ffff8880175766b8 by task kworker/1:1/26 > > > ... > > > The buggy address belongs to the object at ffff888017576600 > > > which belongs to the cache kmalloc-192 of size 192 > > > The buggy address is located 184 bytes inside of > > > 192-byte region [ffff888017576600, ffff8880175766c0) > > > ... > > > Memory state around the buggy address: > > > ffff888017576580: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc > > > ffff888017576600: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 > > > > ffff888017576680: 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc > > > > > > ^ > > > ffff888017576700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc > > > ffff888017576780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc > > > =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D > > > > > > After this patch, report will show "cache kmalloc-192 of size 184". > > > > > > Link: > > > https://urldefense.com/v3/__https://bugzilla.kernel.org/show_bug.cgi?= id=3D216457__;!!CTRNKA9wMg0ARbw!mLNcuZ83c39d0Xkut-WMY3CcvZcAYDuLCmv4mu7IAld= w4_n4i6XvX8GORBfjOadWxOa6d-ODQdx6ZCSvB2g13Q$ > > > $ [1] > > > > > > Signed-off-by: Kuan-Ying Lee > > > --- > > > mm/kasan/kasan.h | 5 +++++ > > > mm/kasan/report.c | 3 ++- > > > mm/kasan/report_generic.c | 18 ++++++++++++++++++ > > > 3 files changed, 25 insertions(+), 1 deletion(-) > > > > > > diff --git a/mm/kasan/kasan.h b/mm/kasan/kasan.h > > > index 32413f22aa82..7bb627d21580 100644 > > > --- a/mm/kasan/kasan.h > > > +++ b/mm/kasan/kasan.h > > > @@ -340,8 +340,13 @@ static inline void > > > kasan_print_address_stack_frame(const void *addr) { } > > > > > > #ifdef CONFIG_KASAN_GENERIC > > > void kasan_print_aux_stacks(struct kmem_cache *cache, const void > > > *object); > > > +int kasan_get_alloc_size(void *object_addr, struct kmem_cache > > > *cache); > > > #else > > > static inline void kasan_print_aux_stacks(struct kmem_cache > > > *cache, const void *object) { } > > > +static inline int kasan_get_alloc_size(void *object_addr, struct > > > kmem_cache *cache) > > > +{ > > > + return cache->object_size; > > > +} > > > #endif > > > > > > bool kasan_report(unsigned long addr, size_t size, > > > diff --git a/mm/kasan/report.c b/mm/kasan/report.c > > > index 1d02757e90a3..6de454bb2cad 100644 > > > --- a/mm/kasan/report.c > > > +++ b/mm/kasan/report.c > > > @@ -236,12 +236,13 @@ static void describe_object_addr(const void > > > *addr, struct kmem_cache *cache, > > > { > > > unsigned long access_addr =3D (unsigned long)addr; > > > unsigned long object_addr =3D (unsigned long)object; > > > + int real_size =3D kasan_get_alloc_size((void *)object_addr, > > > cache); > > > const char *rel_type; > > > int rel_bytes; > > > > > > pr_err("The buggy address belongs to the object at %px\n" > > > " which belongs to the cache %s of size %d\n", > > > - object, cache->name, cache->object_size); > > > + object, cache->name, real_size); > > > > > > if (access_addr < object_addr) { > > > rel_type =3D "to the left"; > > > diff --git a/mm/kasan/report_generic.c b/mm/kasan/report_generic.c > > > index 043c94b04605..01b38e459352 100644 > > > --- a/mm/kasan/report_generic.c > > > +++ b/mm/kasan/report_generic.c > > > @@ -43,6 +43,24 @@ void *kasan_find_first_bad_addr(void *addr, > > > size_t size) > > > return p; > > > } > > > > > > +int kasan_get_alloc_size(void *addr, struct kmem_cache *cache) > > > +{ > > > + int size =3D 0; > > > + u8 *shadow =3D (u8 *)kasan_mem_to_shadow(addr); > > > + > > > + while (size < cache->object_size) { > > > + if (*shadow =3D=3D 0) > > > + size +=3D KASAN_GRANULE_SIZE; > > > + else if (*shadow >=3D 1 && *shadow <=3D > > > KASAN_GRANULE_SIZE - 1) > > > + size +=3D *shadow; > > > + else > > > + return size; > > > + shadow++; > > > > This only works for out-of-bounds reports, but I don't see any checks > > for report type. Won't this break reporting for all other report > > types? > > > > I think it won't break reporting for other report types. > This function is only called by slab OOB and UAF. I meant specifically UAF reports. During UAF there are no 0s in the object shadow. > > I would also print the cache name anyway. Sometimes reports are > > perplexing and/or this logic may return a wrong result for some > > reason. The total object size may be useful to understand harder > > cases. > > > > Ok. I will keep the cache name and the total object_size. > > > > + } > > > + > > > + return cache->object_size; > > > +} > > > + > > > static const char *get_shadow_bug_type(struct kasan_report_info > > > *info) > > > { > > > const char *bug_type =3D "unknown-crash"; > > -- > You received this message because you are subscribed to the Google Groups= "kasan-dev" group. > To unsubscribe from this group and stop receiving emails from it, send an= email to kasan-dev+unsubscribe@googlegroups.com. > To view this discussion on the web visit https://groups.google.com/d/msgi= d/kasan-dev/edbcce8a1e9e772e3a3fd032cd4600bd5677c877.camel%40mediatek.com.