From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-23.2 required=3.0 tests=BAYES_00,DKIMWL_WL_MED, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS, INCLUDES_CR_TRAILER,INCLUDES_PATCH,MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS, URIBL_BLOCKED,USER_IN_DEF_DKIM_WL autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id CEF63C4338F for ; Thu, 12 Aug 2021 08:57:24 +0000 (UTC) Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by mail.kernel.org (Postfix) with ESMTP id 6F2E36103E for ; Thu, 12 Aug 2021 08:57:24 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.4.1 mail.kernel.org 6F2E36103E Authentication-Results: mail.kernel.org; dmarc=fail (p=reject dis=none) header.from=google.com Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=kvack.org Received: by kanga.kvack.org (Postfix) id 029806B0085; Thu, 12 Aug 2021 04:57:24 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id F1B076B0087; Thu, 12 Aug 2021 04:57:23 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id E0A486B0088; Thu, 12 Aug 2021 04:57:23 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from forelay.hostedemail.com (smtprelay0040.hostedemail.com [216.40.44.40]) by kanga.kvack.org (Postfix) with ESMTP id C84EF6B0085 for ; Thu, 12 Aug 2021 04:57:23 -0400 (EDT) Received: from smtpin27.hostedemail.com (10.5.19.251.rfc1918.com [10.5.19.251]) by forelay02.hostedemail.com (Postfix) with ESMTP id 7A0771697C for ; Thu, 12 Aug 2021 08:57:23 +0000 (UTC) X-FDA: 78465824766.27.11B1A5E Received: from mail-ot1-f53.google.com (mail-ot1-f53.google.com [209.85.210.53]) by imf18.hostedemail.com (Postfix) with ESMTP id 3FF0F400F893 for ; Thu, 12 Aug 2021 08:57:23 +0000 (UTC) Received: by mail-ot1-f53.google.com with SMTP id h63-20020a9d14450000b02904ce97efee36so6886792oth.7 for ; Thu, 12 Aug 2021 01:57:23 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=Gv+4JbEnb1Tuank6FYqN4BwpsesLnaVYrFHSVUYTt60=; b=jTu6zz6RUb1gbBqdMULl0qErX83W6gUXly1h3vhVvFu9Qi4nyg3wT+fiRHGZ8UPxX+ KuC1lhJ4WS8UYXJyDfNpxu3RZ4E6E1fogIsGws4Gc3pGBXl+k5DX2BsfzWtASzN1J5ES n63vfFcZdAyEHwx7pehw1VInh+a3EYF5+ThCsQK349DkGtXdP5lQcfTiTpJRVwKcTiRH wyVa9cSYC9aA7vk04ifhkEJEo8Qd7xZCcNR1p96fF5I9eAuHM701Z+891PWpJK3UpOs7 fGVlvVuW4Sx6JoQ+n9kyEbqzLXpsXrb8yEvCR6EYB0GaMGaJvRyIGyolJ2qEx0nxzTW2 TfIg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=Gv+4JbEnb1Tuank6FYqN4BwpsesLnaVYrFHSVUYTt60=; b=ugMOu1EQ8B37tNssLlgFF1ptDOSLaGplvO6PaGlK/dW45JzF90es4kpEHg9taV5+ey g93Qmk1xVntmZp5sAEPAhxNCzja0R7W/gSayBwxMqZ2QYswhy2AcrKvX5EKMxDJ5jSnh bkhdNBzlE4O+RwmKcwAnijFwE+GQXxFiUe0EuEAQ0iccDaTZDUWrjOF4KDUGI13iQV05 L6jq0zhjmbTnwzQx02iXZqJzLZ9xdFcjhcKeA0V2VeOuX6wC5kevNmVUCYCbMW22TbiL 2gWAJrgd6ysv48/zNkU6wHI7STprjYndLAvEfbzv7DwXmySz29qhMa7X+ow2AcMugjEd Xqjg== X-Gm-Message-State: AOAM530M2/fLsme6BmxY8HiBilN/zy4FuEnJYfQKuSVMH8Nm/A9oOcUq riPGSRENCLTVTT1B0wdI3qbY43m9uVXiuLEFNpy1zg== X-Google-Smtp-Source: ABdhPJxC6z46EVSjUnWZESNoiJFqfWOMsZN5vFYH5kfIu3dDzTdL4gB0Yf/2z7qKhMk1qomj4Ll/2I33poS8NXT0Fv0= X-Received: by 2002:a9d:6f99:: with SMTP id h25mr2624406otq.17.1628758642497; Thu, 12 Aug 2021 01:57:22 -0700 (PDT) MIME-Version: 1.0 References: In-Reply-To: From: Marco Elver Date: Thu, 12 Aug 2021 10:57:11 +0200 Message-ID: Subject: Re: [PATCH 2/8] kasan: test: avoid writing invalid memory To: andrey.konovalov@linux.dev Cc: Andrew Morton , Andrey Konovalov , Andrey Ryabinin , Dmitry Vyukov , Alexander Potapenko , kasan-dev@googlegroups.com, linux-mm@kvack.org, linux-kernel@vger.kernel.org Content-Type: text/plain; charset="UTF-8" X-Rspamd-Queue-Id: 3FF0F400F893 Authentication-Results: imf18.hostedemail.com; dkim=pass header.d=google.com header.s=20161025 header.b=jTu6zz6R; dmarc=pass (policy=reject) header.from=google.com; spf=pass (imf18.hostedemail.com: domain of elver@google.com designates 209.85.210.53 as permitted sender) smtp.mailfrom=elver@google.com X-Rspamd-Server: rspam04 X-Stat-Signature: x9b4tisae3ksxdp8qq7ctg5wy9mfkjjh X-HE-Tag: 1628758643-508643 X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: On Wed, 11 Aug 2021 at 21:21, wrote: > From: Andrey Konovalov > > Multiple KASAN tests do writes past the allocated objects or writes to > freed memory. Turn these writes into reads to avoid corrupting memory. > Otherwise, these tests might lead to crashes with the HW_TAGS mode, as it > neither uses quarantine nor redzones. > > Signed-off-by: Andrey Konovalov Reviewed-by: Marco Elver although if you need a write primitive somewhere that doesn't corrupt memory, you could use atomic_add() or atomic_or() of 0. Although technically that's a read-modify-write. For generic mode one issue is that these are explicitly instrumented and not through the compiler, which is only a problem if you're testing the compiler emits the right instrumentation. > --- > lib/test_kasan.c | 14 +++++++------- > 1 file changed, 7 insertions(+), 7 deletions(-) > > diff --git a/lib/test_kasan.c b/lib/test_kasan.c > index 1bc3cdd2957f..c82a82eb5393 100644 > --- a/lib/test_kasan.c > +++ b/lib/test_kasan.c > @@ -167,7 +167,7 @@ static void kmalloc_node_oob_right(struct kunit *test) > ptr = kmalloc_node(size, GFP_KERNEL, 0); > KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr); > > - KUNIT_EXPECT_KASAN_FAIL(test, ptr[size] = 0); > + KUNIT_EXPECT_KASAN_FAIL(test, ptr[0] = ptr[size]); > kfree(ptr); > } > > @@ -203,7 +203,7 @@ static void kmalloc_pagealloc_uaf(struct kunit *test) > KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr); > kfree(ptr); > > - KUNIT_EXPECT_KASAN_FAIL(test, ptr[0] = 0); > + KUNIT_EXPECT_KASAN_FAIL(test, ((volatile char *)ptr)[0]); > } > > static void kmalloc_pagealloc_invalid_free(struct kunit *test) > @@ -237,7 +237,7 @@ static void pagealloc_oob_right(struct kunit *test) > ptr = page_address(pages); > KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr); > > - KUNIT_EXPECT_KASAN_FAIL(test, ptr[size] = 0); > + KUNIT_EXPECT_KASAN_FAIL(test, ptr[0] = ptr[size]); > free_pages((unsigned long)ptr, order); > } > > @@ -252,7 +252,7 @@ static void pagealloc_uaf(struct kunit *test) > KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr); > free_pages((unsigned long)ptr, order); > > - KUNIT_EXPECT_KASAN_FAIL(test, ptr[0] = 0); > + KUNIT_EXPECT_KASAN_FAIL(test, ((volatile char *)ptr)[0]); > } > > static void kmalloc_large_oob_right(struct kunit *test) > @@ -514,7 +514,7 @@ static void kmalloc_uaf(struct kunit *test) > KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr); > > kfree(ptr); > - KUNIT_EXPECT_KASAN_FAIL(test, *(ptr + 8) = 'x'); > + KUNIT_EXPECT_KASAN_FAIL(test, ((volatile char *)ptr)[8]); > } > > static void kmalloc_uaf_memset(struct kunit *test) > @@ -553,7 +553,7 @@ static void kmalloc_uaf2(struct kunit *test) > goto again; > } > > - KUNIT_EXPECT_KASAN_FAIL(test, ptr1[40] = 'x'); > + KUNIT_EXPECT_KASAN_FAIL(test, ((volatile char *)ptr1)[40]); > KUNIT_EXPECT_PTR_NE(test, ptr1, ptr2); > > kfree(ptr2); > @@ -700,7 +700,7 @@ static void ksize_unpoisons_memory(struct kunit *test) > ptr[size] = 'x'; > > /* This one must. */ > - KUNIT_EXPECT_KASAN_FAIL(test, ptr[real_size] = 'y'); > + KUNIT_EXPECT_KASAN_FAIL(test, ((volatile char *)ptr)[real_size]); > > kfree(ptr); > } > -- > 2.25.1 > > -- > You received this message because you are subscribed to the Google Groups "kasan-dev" group. > To unsubscribe from this group and stop receiving emails from it, send an email to kasan-dev+unsubscribe@googlegroups.com. > To view this discussion on the web visit https://groups.google.com/d/msgid/kasan-dev/c3cd2a383e757e27dd9131635fc7d09a48a49cf9.1628709663.git.andreyknvl%40gmail.com.