From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id C3824C433EF for ; Wed, 6 Oct 2021 03:22:35 +0000 (UTC) Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by mail.kernel.org (Postfix) with ESMTP id 52C4A610EA for ; Wed, 6 Oct 2021 03:22:35 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.4.1 mail.kernel.org 52C4A610EA Authentication-Results: mail.kernel.org; dmarc=fail (p=reject dis=none) header.from=google.com Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=kvack.org Received: by kanga.kvack.org (Postfix) id F0F4E6B006C; Tue, 5 Oct 2021 23:22:34 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id E988B940008; Tue, 5 Oct 2021 23:22:34 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id D3AA7940007; Tue, 5 Oct 2021 23:22:34 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from forelay.hostedemail.com (smtprelay0124.hostedemail.com [216.40.44.124]) by kanga.kvack.org (Postfix) with ESMTP id C4F316B006C for ; Tue, 5 Oct 2021 23:22:34 -0400 (EDT) Received: from smtpin10.hostedemail.com (10.5.19.251.rfc1918.com [10.5.19.251]) by forelay05.hostedemail.com (Postfix) with ESMTP id 7494E182F010E for ; Wed, 6 Oct 2021 03:22:34 +0000 (UTC) X-FDA: 78664565028.10.70CAF34 Received: from mail-vk1-f179.google.com (mail-vk1-f179.google.com [209.85.221.179]) by imf27.hostedemail.com (Postfix) with ESMTP id 34F0070148E3 for ; Wed, 6 Oct 2021 03:22:34 +0000 (UTC) Received: by mail-vk1-f179.google.com with SMTP id 14so600066vkq.10 for ; Tue, 05 Oct 2021 20:22:34 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20210112; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=bfp9VlLBc+DNVBQ774WyK5TigN2C4A/ShHU2p0epUU0=; b=LEjhlPYFjHruDYTUsq4TurbaNHPfy0KMlbnG7yN7hQLa/EmdfS12RnJ7uLPZa3yq/M Eoosy7S4MBCxCKB6G1ghYGyeYDaMmVmwmrOevJb5H4FC4oPnMrPc+qVbbrPLuaRI5ZpM ZL9/jczOedY4f2RBqj79ZG/+g9Vn8EHry3rhWwV6hQ7tJfBaoNQBh/Ix6ZDhnG/ikqFj /5mdSRbQin12U/GWL6hNKbI6yE1UYzEQV3MAaQvRtmeC/r81lzzlm95fsKuC0sHVYjfv pwd3/aU4KkrGekqJ5t3P+uiEiBHoe6DIoDv/+SR8kEOYr+QLs1S89BfLTwg0DoXiCpes 2TTg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=bfp9VlLBc+DNVBQ774WyK5TigN2C4A/ShHU2p0epUU0=; b=7PghBOcf8Drhlm/7xCqEiU0xedZpZGFHLC3p0X1LvF9Jmx+vXfq3HQDHHuUk7OJ8az a5FavuyPINQlthvj3Fwpalfb9cM2+YWiPXNiwJ+yxbFH9qjEQZNrurnGKVaN9JeMjHGH qCzTRbluLi8qSup4MKIAoLsAYkiI/LWZMx8lwE4oK3eGtEWgyljxmDEytPfFrDN38GU3 hBisYDKAUgaxlGUjPWakF6iSMmBkCrvW2zqrubx6323jO1ifZ5pdkSxiaoh+oc7Emnwc FFEylRsz16Bn8yzEO3v18daItkKk9OLfl0UPxkMIfy1o0zUVImJpAW5lsNIW1j5qx7P1 hMFA== X-Gm-Message-State: AOAM532u3xspMw88Z8A0MgIkhoLnBbc9/efRNPeXlyIqscInyNaJ02ff 1yAfSlNXv5Ftdea7ZTtXiCJNMo2/JrzCbbKnCaVBbA== X-Google-Smtp-Source: ABdhPJy9/Z43W2gW52EvzL7JzL8egBStaTb8m7rfiY4IGL09hpUTl1McOdlKXhKzRV+JUKpI7YYGufDTZeLOLeEMzK8= X-Received: by 2002:a05:6122:201f:: with SMTP id l31mr4854778vkd.22.1633490553254; Tue, 05 Oct 2021 20:22:33 -0700 (PDT) MIME-Version: 1.0 References: <20210930222704.2631604-1-keescook@chromium.org> <20210930222704.2631604-5-keescook@chromium.org> <20211005184717.65c6d8eb39350395e387b71f@linux-foundation.org> <202110052002.34E998B@keescook> In-Reply-To: <202110052002.34E998B@keescook> From: Jann Horn Date: Wed, 6 Oct 2021 05:22:06 +0200 Message-ID: Subject: Re: [PATCH v3 4/8] slab: Add __alloc_size attributes for better bounds checking To: Kees Cook Cc: Andrew Morton , Christoph Lameter , Pekka Enberg , David Rientjes , Joonsoo Kim , Vlastimil Babka , Andy Whitcroft , Dennis Zhou , Dwaipayan Ray , Joe Perches , Lukas Bulwahn , Miguel Ojeda , Nathan Chancellor , Tejun Heo , Daniel Micay , Nick Desaulniers , Masahiro Yamada , Michal Marek , clang-built-linux@googlegroups.com, linux-mm@kvack.org, linux-kernel@vger.kernel.org, linux-kbuild@vger.kernel.org, linux-hardening@vger.kernel.org Content-Type: text/plain; charset="UTF-8" X-Rspamd-Server: rspam05 X-Rspamd-Queue-Id: 34F0070148E3 X-Stat-Signature: 8z95s8iqz73s5w91ezepbth53ssnkupo Authentication-Results: imf27.hostedemail.com; dkim=pass header.d=google.com header.s=20210112 header.b=LEjhlPYF; dmarc=pass (policy=reject) header.from=google.com; spf=pass (imf27.hostedemail.com: domain of jannh@google.com designates 209.85.221.179 as permitted sender) smtp.mailfrom=jannh@google.com X-HE-Tag: 1633490554-694451 X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: On Wed, Oct 6, 2021 at 5:06 AM Kees Cook wrote: > On Tue, Oct 05, 2021 at 06:47:17PM -0700, Andrew Morton wrote: > > On Thu, 30 Sep 2021 15:27:00 -0700 Kees Cook wrote: > > > > > As already done in GrapheneOS, add the __alloc_size attribute for regular > > > kmalloc interfaces, to provide additional hinting for better bounds > > > checking, assisting CONFIG_FORTIFY_SOURCE and other compiler > > > optimizations. > > > > x86_64 allmodconfig: > > What compiler and version? > > > > > In file included from ./arch/x86/include/asm/preempt.h:7, > > from ./include/linux/preempt.h:78, > > from ./include/linux/spinlock.h:55, > > from ./include/linux/mmzone.h:8, > > from ./include/linux/gfp.h:6, > > from ./include/linux/mm.h:10, > > from ./include/linux/mman.h:5, > > from lib/test_kasan_module.c:10: > > In function 'check_copy_size', > > inlined from 'copy_user_test' at ./include/linux/uaccess.h:191:6: > > ./include/linux/thread_info.h:213:4: error: call to '__bad_copy_to' declared with attribute error: copy destination size is too small > > 213 | __bad_copy_to(); > > | ^~~~~~~~~~~~~~~ > > In function 'check_copy_size', > > inlined from 'copy_user_test' at ./include/linux/uaccess.h:199:6: > > ./include/linux/thread_info.h:211:4: error: call to '__bad_copy_from' declared with attribute error: copy source size is too small > > 211 | __bad_copy_from(); > > | ^~~~~~~~~~~~~~~~~ > > make[1]: *** [lib/test_kasan_module.o] Error 1 > > make: *** [lib] Error 2 > > Hah, yes, it caught an intentionally bad copy. This may bypass the > check, as I've had to do in LKDTM before. I will test... > > diff --git a/lib/test_kasan_module.c b/lib/test_kasan_module.c > index 7ebf433edef3..9fb2fb2937da 100644 > --- a/lib/test_kasan_module.c > +++ b/lib/test_kasan_module.c > @@ -19,7 +19,12 @@ static noinline void __init copy_user_test(void) > { > char *kmem; > char __user *usermem; > - size_t size = 128 - KASAN_GRANULE_SIZE; > + /* > + * This is marked volatile to avoid __alloc_size() > + * noticing the intentionally out-of-bounds copys > + * being done on the allocation. > + */ > + volatile size_t size = 128 - KASAN_GRANULE_SIZE; Maybe OPTIMIZER_HIDE_VAR()? The normal version of that abuses an empty asm statement to hide the value from the compiler.