From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-14.4 required=3.0 tests=DKIMWL_WL_MED,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_PATCH, MAILING_LIST_MULTI,SIGNED_OFF_BY,SPF_HELO_NONE,SPF_PASS,USER_IN_DEF_DKIM_WL autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id A059CC54FD0 for ; Tue, 21 Apr 2020 11:56:26 +0000 (UTC) Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by mail.kernel.org (Postfix) with ESMTP id 4D1562070B for ; Tue, 21 Apr 2020 11:56:26 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b="aCc5+8+A" DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org 4D1562070B Authentication-Results: mail.kernel.org; dmarc=fail (p=reject dis=none) header.from=google.com Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=owner-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix) id DF6958E0007; Tue, 21 Apr 2020 07:56:25 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id D7FF08E0003; Tue, 21 Apr 2020 07:56:25 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id C6FFF8E0007; Tue, 21 Apr 2020 07:56:25 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from forelay.hostedemail.com (smtprelay0200.hostedemail.com [216.40.44.200]) by kanga.kvack.org (Postfix) with ESMTP id A8E768E0003 for ; Tue, 21 Apr 2020 07:56:25 -0400 (EDT) Received: from smtpin23.hostedemail.com (10.5.19.251.rfc1918.com [10.5.19.251]) by forelay03.hostedemail.com (Postfix) with ESMTP id 6F1DF8245571 for ; Tue, 21 Apr 2020 11:56:25 +0000 (UTC) X-FDA: 76731709530.23.year26_1aed19dd3ee02 X-HE-Tag: year26_1aed19dd3ee02 X-Filterd-Recvd-Size: 10053 Received: from mail-qk1-f195.google.com (mail-qk1-f195.google.com [209.85.222.195]) by imf24.hostedemail.com (Postfix) with ESMTP for ; Tue, 21 Apr 2020 11:56:24 +0000 (UTC) Received: by mail-qk1-f195.google.com with SMTP id c63so14157353qke.2 for ; Tue, 21 Apr 2020 04:56:24 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=Gy/qiieN90UJKr/c+cYCi+ub2I5kQwPARkN3XL1JRak=; b=aCc5+8+A8yLcK/QqnugFhTCfuQH8ZptGrOL5KoB4qPjfHfg455c5bxR2ErMEoPapf5 uswTC5LyF+tq3Acydm/mOkThdTzi4W6FFRu209tSF2BEofynt+8R7+A4/fZHeT6zhJzm ckM5RBxLwpV7Q3sk4bicpgtLknywP1ick8tWtuQkvzjoON229ZmaaSlmzEBc6wXUJvCo 5SROV55sCPT1NhDKKKVvb9+y64jLWx4R8VRDsSi0+KWkDukc9Z8u3dZhUm6Xmob2XhaT eYr5kOqL+dl22xCD4d68H+iRq1GB4bxtUOqvdo63JvGbIc52n7b78xxmC7J3+1INySvY h7Aw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=Gy/qiieN90UJKr/c+cYCi+ub2I5kQwPARkN3XL1JRak=; b=TpiMlAj8wH9GJgq57fchoZsSjIyJNfRj3iW4lDpSD1EoJJ53xQmED9Og53J3VnWmur KMLBcTLeO5DYFMDy748wjMhpAN7ITvObabjI1ZpPfRklzcjYVpnjOyypUUsiBDr79FXE 3umU08yGnKk4M2hSNT2q+AFk6BmNEWwtYMr5BPTHSiNInFKdPLqFOZ/vth+1Rm9QFktA gobLCt1jikQqmpjvWZ04Tg9npiJg9oyiW4/GMB1IpFmfP8MW+acCWeeHE0QiFnQ9DywX mW4WPVB7Mcldbje7mT0ZpPJUq4T6xmhmAJ9Gm2X7hZIvb0RSm5+P4NI0rShL6m7gygrq jFzQ== X-Gm-Message-State: AGi0Pua3LgpDyLX7Ct/L8MlrsqC34D5dDT+iuv+fWxJktG3IJC3wyJ+7 fiv1KgoWMpR3Azu87ozjdsHQ3HHhI8E3JodqMGPm1A== X-Google-Smtp-Source: APiQypKqjymosGnZ/N8Uq74IFcEJwadIEWE1MVkKNbYIrF4e7ou27CEFF7xzARDGcWKlsTpg5CkwsUAkLDtYop4F7a4= X-Received: by 2002:a37:bc47:: with SMTP id m68mr21780368qkf.8.1587470184030; Tue, 21 Apr 2020 04:56:24 -0700 (PDT) MIME-Version: 1.0 References: <20200421014007.6012-1-walter-zh.wu@mediatek.com> In-Reply-To: <20200421014007.6012-1-walter-zh.wu@mediatek.com> From: Dmitry Vyukov Date: Tue, 21 Apr 2020 13:56:12 +0200 Message-ID: Subject: Re: [PATCH] kasan: fix KASAN unit tests for tag-based KASAN To: Walter Wu , David Gow , Brendan Higgins , Patricia Alfonso Cc: Andrey Ryabinin , Alexander Potapenko , Matthias Brugger , Andrey Konovalov , Andrew Morton , kasan-dev , Linux-MM , LKML , Linux ARM , wsd_upstream , linux-mediatek@lists.infradead.org Content-Type: text/plain; charset="UTF-8" X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: On Tue, Apr 21, 2020 at 3:40 AM Walter Wu wrote: > > When we use tag-based KASAN, then KASAN unit tests don't detect > out-of-bounds memory access. Because with tag-based KASAN the state > of each 16 aligned bytes of memory is encoded in one shadow byte > and the shadow value is tag of pointer, so we need to read next > shadow byte, the shadow value is not equal to tag of pointer, > then tag-based KASAN will detect out-of-bounds memory access. > > Signed-off-by: Walter Wu > Cc: Andrey Ryabinin > Cc: Dmitry Vyukov > Cc: Alexander Potapenko > Cc: Matthias Brugger > Cc: Andrey Konovalov > Cc: Andrew Morton > --- > lib/test_kasan.c | 62 ++++++++++++++++++++++++++++++++++++++++++------ > 1 file changed, 55 insertions(+), 7 deletions(-) > > diff --git a/lib/test_kasan.c b/lib/test_kasan.c > index e3087d90e00d..a164f6b47fe5 100644 > --- a/lib/test_kasan.c > +++ b/lib/test_kasan.c > @@ -40,7 +40,12 @@ static noinline void __init kmalloc_oob_right(void) > return; > } Hi Walter, This would be great to have! But I am concerned about these series that port KASAN tests to KUNIT: https://lkml.org/lkml/2020/4/17/1144 I suspect it will be one large merge conflict. Not sure what is the proper way to resovle this. I've added authors to CC. > +#ifdef CONFIG_KASAN_GENERIC > ptr[size] = 'x'; > +#else > + ptr[size + 5] = 'x'; > +#endif > + For this particular snippet I think we can reduce amount of idef'ery and amount of non-compiled code in each configuration with something like: ptr[size + 5] = 'x'; if (ENABLED(CONFIG_KASAN_GENERIC)) ptr[size] = 'x'; One check runs always (it should pass in both configs, right?). The only only in GENERIC, but it's C-level if rather than preprocessor. KUNIT should make 2 bugs per test easily expressable (and testable). > kfree(ptr); > } > > @@ -92,7 +97,12 @@ static noinline void __init kmalloc_pagealloc_oob_right(void) > return; > } > > +#ifdef CONFIG_KASAN_GENERIC > ptr[size] = 0; > +#else > + ptr[size + 6] = 0; > +#endif > + > kfree(ptr); > } > > @@ -162,7 +172,11 @@ static noinline void __init kmalloc_oob_krealloc_more(void) > return; > } > > +#ifdef CONFIG_KASAN_GENERIC > ptr2[size2] = 'x'; > +#else > + ptr2[size2 + 13] = 'x'; > +#endif > kfree(ptr2); > } > > @@ -180,7 +194,12 @@ static noinline void __init kmalloc_oob_krealloc_less(void) > kfree(ptr1); > return; > } > + > +#ifdef CONFIG_KASAN_GENERIC > ptr2[size2] = 'x'; > +#else > + ptr2[size2 + 2] = 'x'; > +#endif > kfree(ptr2); > } > > @@ -216,7 +235,11 @@ static noinline void __init kmalloc_oob_memset_2(void) > return; > } > > +#ifdef CONFIG_KASAN_GENERIC > memset(ptr+7, 0, 2); > +#else > + memset(ptr+15, 0, 2); > +#endif > kfree(ptr); > } > > @@ -232,7 +255,11 @@ static noinline void __init kmalloc_oob_memset_4(void) > return; > } > > +#ifdef CONFIG_KASAN_GENERIC > memset(ptr+5, 0, 4); > +#else > + memset(ptr+15, 0, 4); > +#endif > kfree(ptr); > } > > @@ -249,7 +276,11 @@ static noinline void __init kmalloc_oob_memset_8(void) > return; > } > > +#ifdef CONFIG_KASAN_GENERIC > memset(ptr+1, 0, 8); > +#else > + memset(ptr+15, 0, 8); > +#endif > kfree(ptr); > } > > @@ -265,7 +296,11 @@ static noinline void __init kmalloc_oob_memset_16(void) > return; > } > > +#ifdef CONFIG_KASAN_GENERIC > memset(ptr+1, 0, 16); > +#else > + memset(ptr+15, 0, 16); > +#endif > kfree(ptr); > } > > @@ -281,7 +316,11 @@ static noinline void __init kmalloc_oob_in_memset(void) > return; > } > > +#ifdef CONFIG_KASAN_GENERIC > memset(ptr, 0, size+5); > +#else > + memset(ptr, 0, size+7); > +#endif > kfree(ptr); > } > > @@ -415,7 +454,11 @@ static noinline void __init kmem_cache_oob(void) > return; > } > > +#ifdef CONFIG_KASAN_GENERIC > *p = p[size]; > +#else > + *p = p[size + 8]; > +#endif > kmem_cache_free(cache, p); > kmem_cache_destroy(cache); > } > @@ -497,6 +540,11 @@ static noinline void __init copy_user_test(void) > char __user *usermem; > size_t size = 10; > int unused; > +#ifdef CONFIG_KASAN_GENERIC > + size_t oob_size = 1; > +#else > + size_t oob_size = 7; > +#endif > > kmem = kmalloc(size, GFP_KERNEL); > if (!kmem) > @@ -512,25 +560,25 @@ static noinline void __init copy_user_test(void) > } > > pr_info("out-of-bounds in copy_from_user()\n"); > - unused = copy_from_user(kmem, usermem, size + 1); > + unused = copy_from_user(kmem, usermem, size + oob_size); > > pr_info("out-of-bounds in copy_to_user()\n"); > - unused = copy_to_user(usermem, kmem, size + 1); > + unused = copy_to_user(usermem, kmem, size + oob_size); > > pr_info("out-of-bounds in __copy_from_user()\n"); > - unused = __copy_from_user(kmem, usermem, size + 1); > + unused = __copy_from_user(kmem, usermem, size + oob_size); > > pr_info("out-of-bounds in __copy_to_user()\n"); > - unused = __copy_to_user(usermem, kmem, size + 1); > + unused = __copy_to_user(usermem, kmem, size + oob_size); > > pr_info("out-of-bounds in __copy_from_user_inatomic()\n"); > - unused = __copy_from_user_inatomic(kmem, usermem, size + 1); > + unused = __copy_from_user_inatomic(kmem, usermem, size + oob_size); > > pr_info("out-of-bounds in __copy_to_user_inatomic()\n"); > - unused = __copy_to_user_inatomic(usermem, kmem, size + 1); > + unused = __copy_to_user_inatomic(usermem, kmem, size + oob_size); > > pr_info("out-of-bounds in strncpy_from_user()\n"); > - unused = strncpy_from_user(kmem, usermem, size + 1); > + unused = strncpy_from_user(kmem, usermem, size + oob_size); > > vm_munmap((unsigned long)usermem, PAGE_SIZE); > kfree(kmem); > -- > 2.18.0 > > -- > You received this message because you are subscribed to the Google Groups "kasan-dev" group. > To unsubscribe from this group and stop receiving emails from it, send an email to kasan-dev+unsubscribe@googlegroups.com. > To view this discussion on the web visit https://groups.google.com/d/msgid/kasan-dev/20200421014007.6012-1-walter-zh.wu%40mediatek.com.