linux-kernel - RE: [PATCH] kasan: improve double-free detection

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Tue, 3 May 2016 09:24:52 +0000
From:	"Luruo, Kuthonuzo" <kuthonuzo.luruo@....com>
To:	Dmitry Vyukov <dvyukov@...gle.com>
CC:	Andrey Ryabinin <aryabinin@...tuozzo.com>,
	Alexander Potapenko <glider@...gle.com>,
	Andrew Morton <akpm@...ux-foundation.org>,
	kasan-dev <kasan-dev@...glegroups.com>,
	"linux-mm@...ck.org" <linux-mm@...ck.org>,
	LKML <linux-kernel@...r.kernel.org>
Subject: RE: [PATCH] kasan: improve double-free detection

> 
> We can use per-header lock by setting status to KASAN_STATE_LOCKED.  A
> thread can CAS any status to KASAN_STATE_LOCKED which means that it
> locked the header. If any thread tried to modify/read the status and
> the status is KASAN_STATE_LOCKED, then the thread waits.

Thanks, Dmitry. I've successfully tested with the concurrent free slab_test test
(alloc on cpu 0; then concurrent frees on all other cpus on a 12-vcpu KVM) using:

static inline bool kasan_alloc_state_lock(struct kasan_alloc_meta *alloc_info)
{
        if (cmpxchg(&alloc_info->state, KASAN_STATE_ALLOC,
                                KASAN_STATE_LOCKED) == KASAN_STATE_ALLOC)
                return true;
        return false;
}

static inline void kasan_alloc_state_unlock_wait(struct kasan_alloc_meta
                *alloc_info)
{
        while (alloc_info->state == KASAN_STATE_LOCKED)
                cpu_relax();
}

Race "winner" sets state to quarantine as the last step:

        if (kasan_alloc_state_lock(alloc_info)) {
                free_info = get_free_info(cache, object);
                quarantine_put(free_info, cache);
                set_track(&free_info->track, GFP_NOWAIT);
                kasan_poison_slab_free(cache, object);
                alloc_info->state = KASAN_STATE_QUARANTINE;
                return true;
        } else
                kasan_alloc_state_unlock_wait(alloc_info);

Now, I'm not sure whether on current KASAN-supported archs, state byte load in
the busy-wait loop is atomic wrt the KASAN_STATE_QUARANTINE byte store.
Would you advise using CAS primitives for load/store here too?

> >
> > Sure, a new test can be added for test_kasan.ko. Unlike the other tests, a
> > double-free would likely panic the system due to slab corruption. Would it still
> > be "KASANic" for kasan_slab_free() to return true after reporting double-free
> > attempt error so thread will not call into __cache_free()? How does ASAN
> > handle this?
> 
> Yes, sure, it is OK to return true from kasan_slab_free() in such case.
> Use-space ASAN terminates the process after the first report. We've
> decided that in kernel we better continue in best-effort manner. But
> after the first report all bets are mostly off (leaking an object is
> definitely OK).

sounds good; I'm also "promoting" double-free pr_err() to kasan_report().

Kuthonuzo