[PATCH 1/2] kmsan: do not wipe out origin when doing partial unpoisoning

[PATCH 1/2] kmsan: do not wipe out origin when doing partial unpoisoning

[Alexander Potapenko]

As noticed by Brian, KMSAN should not be zeroing the origin when
unpoisoning parts of a four-byte uninitialized value, e.g.:

    char a[4];
    kmsan_unpoison_memory(a, 1);

This led to false negatives, as certain poisoned values could receive zero
origins, preventing those values from being reported.

To fix the problem, check that kmsan_internal_set_shadow_origin() writes
zero origins only to slots which have zero shadow.

Reported-by: Brian Johannesmeyer <bjohannesmeyer@gmail.com>
Link: https://lore.kernel.org/lkml/20240524232804.1984355-1-bjohannesmeyer@gmail.com/T/
Fixes: f80be4571b19 ("kmsan: add KMSAN runtime core")
Signed-off-by: Alexander Potapenko <glider@google.com>
---
 mm/kmsan/core.c | 15 +++++++++++----
 1 file changed, 11 insertions(+), 4 deletions(-)

diff --git a/mm/kmsan/core.c b/mm/kmsan/core.c
index cf2d70e9c9a5f..95f859e38c533 100644
--- a/mm/kmsan/core.c
+++ b/mm/kmsan/core.c
@@ -196,8 +196,7 @@ void kmsan_internal_set_shadow_origin(void *addr, size_t size, int b,
 				      u32 origin, bool checked)
 {
 	u64 address = (u64)addr;
-	void *shadow_start;
-	u32 *origin_start;
+	u32 *shadow_start, *origin_start;
 	size_t pad = 0;
 
 	KMSAN_WARN_ON(!kmsan_metadata_is_contiguous(addr, size));
@@ -225,8 +224,16 @@ void kmsan_internal_set_shadow_origin(void *addr, size_t size, int b,
 	origin_start =
 		(u32 *)kmsan_get_metadata((void *)address, KMSAN_META_ORIGIN);
 
-	for (int i = 0; i < size / KMSAN_ORIGIN_SIZE; i++)
-		origin_start[i] = origin;
+	/*
+	 * If the new origin is non-zero, assume that the shadow byte is also non-zero,
+	 * and unconditionally overwrite the old origin slot.
+	 * If the new origin is zero, overwrite the old origin slot iff the
+	 * corresponding shadow slot is zero.
+	 */
+	for (int i = 0; i < size / KMSAN_ORIGIN_SIZE; i++) {
+		if (origin || !shadow_start[i])
+			origin_start[i] = origin;
+	}
 }
 
 struct page *kmsan_vmalloc_to_page_or_null(void *vaddr)
-- 
2.45.1.288.g0e0cd299f1-goog

[PATCH 2/2] kmsan: introduce test_unpoison_memory()

[Alexander Potapenko]

From: Brian Johannesmeyer <bjohannesmeyer@gmail.com>

Add a regression test to ensure that kmsan_unpoison_memory() works the same
as an unpoisoning operation added by the instrumentation.

The test has two subtests: one that checks the instrumentation, and one
that checks kmsan_unpoison_memory(). Each subtest initializes the first
byte of a 4-byte buffer, then checks that the other 3 bytes are
uninitialized.

Signed-off-by: Brian Johannesmeyer <bjohannesmeyer@gmail.com>
Link: https://lore.kernel.org/lkml/20240524232804.1984355-1-bjohannesmeyer@gmail.com/T/
[glider@google.com: change description, remove comment about failing test case]
Signed-off-by: Alexander Potapenko <glider@google.com>
---
 mm/kmsan/kmsan_test.c | 27 +++++++++++++++++++++++++++
 1 file changed, 27 insertions(+)

diff --git a/mm/kmsan/kmsan_test.c b/mm/kmsan/kmsan_test.c
index 07d3a3a5a9c52..018069aba92be 100644
--- a/mm/kmsan/kmsan_test.c
+++ b/mm/kmsan/kmsan_test.c
@@ -614,6 +614,32 @@ static void test_stackdepot_roundtrip(struct kunit *test)
 	KUNIT_EXPECT_TRUE(test, report_matches(&expect));
 }
 
+/*
+ * Test case: ensure that kmsan_unpoison_memory() and the instrumentation work
+ * the same.
+ */
+static void test_unpoison_memory(struct kunit *test)
+{
+	EXPECTATION_UNINIT_VALUE_FN(expect, "test_unpoison_memory");
+	volatile char a[4], b[4];
+
+	kunit_info(
+		test,
+		"unpoisoning via the instrumentation vs. kmsan_unpoison_memory() (2 UMR reports)\n");
+
+	/* Initialize a[0] and check a[1]--a[3]. */
+	a[0] = 0;
+	kmsan_check_memory((char *)&a[1], 3);
+	KUNIT_EXPECT_TRUE(test, report_matches(&expect));
+
+	report_reset();
+
+	/* Initialize b[0] and check b[1]--b[3]. */
+	kmsan_unpoison_memory((char *)&b[0], 1);
+	kmsan_check_memory((char *)&b[1], 3);
+	KUNIT_EXPECT_TRUE(test, report_matches(&expect));
+}
+
 static struct kunit_case kmsan_test_cases[] = {
 	KUNIT_CASE(test_uninit_kmalloc),
 	KUNIT_CASE(test_init_kmalloc),
@@ -637,6 +663,7 @@ static struct kunit_case kmsan_test_cases[] = {
 	KUNIT_CASE(test_memset64),
 	KUNIT_CASE(test_long_origin_chain),
 	KUNIT_CASE(test_stackdepot_roundtrip),
+	KUNIT_CASE(test_unpoison_memory),
 	{},
 };
 
-- 
2.45.1.288.g0e0cd299f1-goog

Re: [PATCH 1/2] kmsan: do not wipe out origin when doing partial unpoisoning

[Marco Elver]

On Tue, 28 May 2024 at 12:48, Alexander Potapenko <glider@google.com> wrote:
>
> As noticed by Brian, KMSAN should not be zeroing the origin when
> unpoisoning parts of a four-byte uninitialized value, e.g.:
>
>     char a[4];
>     kmsan_unpoison_memory(a, 1);
>
> This led to false negatives, as certain poisoned values could receive zero
> origins, preventing those values from being reported.
>
> To fix the problem, check that kmsan_internal_set_shadow_origin() writes
> zero origins only to slots which have zero shadow.
>
> Reported-by: Brian Johannesmeyer <bjohannesmeyer@gmail.com>
> Link: https://lore.kernel.org/lkml/20240524232804.1984355-1-bjohannesmeyer@gmail.com/T/
> Fixes: f80be4571b19 ("kmsan: add KMSAN runtime core")
> Signed-off-by: Alexander Potapenko <glider@google.com>
> ---
>  mm/kmsan/core.c | 15 +++++++++++----
>  1 file changed, 11 insertions(+), 4 deletions(-)
>
> diff --git a/mm/kmsan/core.c b/mm/kmsan/core.c
> index cf2d70e9c9a5f..95f859e38c533 100644
> --- a/mm/kmsan/core.c
> +++ b/mm/kmsan/core.c
> @@ -196,8 +196,7 @@ void kmsan_internal_set_shadow_origin(void *addr, size_t size, int b,
>                                       u32 origin, bool checked)
>  {
>         u64 address = (u64)addr;
> -       void *shadow_start;
> -       u32 *origin_start;
> +       u32 *shadow_start, *origin_start;
>         size_t pad = 0;
>
>         KMSAN_WARN_ON(!kmsan_metadata_is_contiguous(addr, size));
> @@ -225,8 +224,16 @@ void kmsan_internal_set_shadow_origin(void *addr, size_t size, int b,
>         origin_start =
>                 (u32 *)kmsan_get_metadata((void *)address, KMSAN_META_ORIGIN);
>
> -       for (int i = 0; i < size / KMSAN_ORIGIN_SIZE; i++)
> -               origin_start[i] = origin;
> +       /*
> +        * If the new origin is non-zero, assume that the shadow byte is also non-zero,
> +        * and unconditionally overwrite the old origin slot.
> +        * If the new origin is zero, overwrite the old origin slot iff the
> +        * corresponding shadow slot is zero.
> +        */
> +       for (int i = 0; i < size / KMSAN_ORIGIN_SIZE; i++) {
> +               if (origin || !shadow_start[i])
> +                       origin_start[i] = origin;
> +       }

Reviewed-by: Marco Elver <elver@google.com>

Re: [PATCH 1/2] kmsan: do not wipe out origin when doing partial unpoisoning

[Brian Johannesmeyer]

On Tue, May 28, 2024 at 12:48:06PM +0200, Alexander Potapenko wrote:
> As noticed by Brian, KMSAN should not be zeroing the origin when
> unpoisoning parts of a four-byte uninitialized value, e.g.:
> 
>     char a[4];
>     kmsan_unpoison_memory(a, 1);
> 
> This led to false negatives, as certain poisoned values could receive zero
> origins, preventing those values from being reported.
> 
> To fix the problem, check that kmsan_internal_set_shadow_origin() writes
> zero origins only to slots which have zero shadow.
> 
> Reported-by: Brian Johannesmeyer <bjohannesmeyer@gmail.com>
> Link: https://lore.kernel.org/lkml/20240524232804.1984355-1-bjohannesmeyer@gmail.com/T/
> Fixes: f80be4571b19 ("kmsan: add KMSAN runtime core")
> Signed-off-by: Alexander Potapenko <glider@google.com>
> ---
>  mm/kmsan/core.c | 15 +++++++++++----
>  1 file changed, 11 insertions(+), 4 deletions(-)
> 
> diff --git a/mm/kmsan/core.c b/mm/kmsan/core.c
> index cf2d70e9c9a5f..95f859e38c533 100644
> --- a/mm/kmsan/core.c
> +++ b/mm/kmsan/core.c
> @@ -196,8 +196,7 @@ void kmsan_internal_set_shadow_origin(void *addr, size_t size, int b,
>  				      u32 origin, bool checked)
>  {
>  	u64 address = (u64)addr;
> -	void *shadow_start;
> -	u32 *origin_start;
> +	u32 *shadow_start, *origin_start;
>  	size_t pad = 0;
>  
>  	KMSAN_WARN_ON(!kmsan_metadata_is_contiguous(addr, size));
> @@ -225,8 +224,16 @@ void kmsan_internal_set_shadow_origin(void *addr, size_t size, int b,
>  	origin_start =
>  		(u32 *)kmsan_get_metadata((void *)address, KMSAN_META_ORIGIN);
>  
> -	for (int i = 0; i < size / KMSAN_ORIGIN_SIZE; i++)
> -		origin_start[i] = origin;
> +	/*
> +	 * If the new origin is non-zero, assume that the shadow byte is also non-zero,
> +	 * and unconditionally overwrite the old origin slot.
> +	 * If the new origin is zero, overwrite the old origin slot iff the
> +	 * corresponding shadow slot is zero.
> +	 */
> +	for (int i = 0; i < size / KMSAN_ORIGIN_SIZE; i++) {
> +		if (origin || !shadow_start[i])
> +			origin_start[i] = origin;
> +	}
>  }
>  
>  struct page *kmsan_vmalloc_to_page_or_null(void *vaddr)
> -- 
> 2.45.1.288.g0e0cd299f1-goog
> 

Tested-by: Brian Johannesmeyer <bjohannesmeyer@gmail.com>