| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Date: Fri, 13 May 2016 14:15:26 +0200
From: Alexander Potapenko <glider@...gle.com>
To: Andrey Ryabinin <aryabinin@...tuozzo.com>
Cc: Andrew Morton <akpm@...ux-foundation.org>,
kasan-dev <kasan-dev@...glegroups.com>,
Linux Memory Management List <linux-mm@...ck.org>,
LKML <linux-kernel@...r.kernel.org>,
Dmitry Vyukov <dvyukov@...gle.com>
Subject: Re: [PATCH 2/4] mm/kasan: print name of mem[set,cpy,move]() caller in report
On Fri, May 6, 2016 at 2:45 PM, Andrey Ryabinin <aryabinin@...tuozzo.com> wrote:
> When bogus memory access happens in mem[set,cpy,move]() it's usually
> caller's fault. So don't blame mem[set,cpy,move]() in bug report, blame
> the caller instead.
>
> Before:
> BUG: KASAN: out-of-bounds access in memset+0x23/0x40 at <address>
> After:
> BUG: KASAN: out-of-bounds access in <memset_caller> at <address>
>
> Signed-off-by: Andrey Ryabinin <aryabinin@...tuozzo.com>
> Cc: Alexander Potapenko <glider@...gle.com>
> Cc: Dmitry Vyukov <dvyukov@...gle.com>
> ---
> mm/kasan/kasan.c | 64 ++++++++++++++++++++++++++++++--------------------------
> 1 file changed, 34 insertions(+), 30 deletions(-)
>
> diff --git a/mm/kasan/kasan.c b/mm/kasan/kasan.c
> index ef2e87b..6e4072c 100644
> --- a/mm/kasan/kasan.c
> +++ b/mm/kasan/kasan.c
> @@ -273,32 +273,36 @@ static __always_inline bool memory_is_poisoned(unsigned long addr, size_t size)
> return memory_is_poisoned_n(addr, size);
> }
>
> -
> -static __always_inline void check_memory_region(unsigned long addr,
> - size_t size, bool write)
> +static __always_inline void check_memory_region_inline(unsigned long addr,
> + size_t size, bool write,
> + unsigned long ret_ip)
> {
> if (unlikely(size == 0))
> return;
>
> if (unlikely((void *)addr <
> kasan_shadow_to_mem((void *)KASAN_SHADOW_START))) {
> - kasan_report(addr, size, write, _RET_IP_);
> + kasan_report(addr, size, write, ret_ip);
> return;
> }
>
> if (likely(!memory_is_poisoned(addr, size)))
> return;
>
> - kasan_report(addr, size, write, _RET_IP_);
> + kasan_report(addr, size, write, ret_ip);
> }
>
> -void __asan_loadN(unsigned long addr, size_t size);
> -void __asan_storeN(unsigned long addr, size_t size);
> +static void check_memory_region(unsigned long addr,
> + size_t size, bool write,
> + unsigned long ret_ip)
> +{
> + check_memory_region_inline(addr, size, write, ret_ip);
> +}
>
> #undef memset
> void *memset(void *addr, int c, size_t len)
> {
> - __asan_storeN((unsigned long)addr, len);
> + check_memory_region((unsigned long)addr, len, true, _RET_IP_);
>
> return __memset(addr, c, len);
> }
> @@ -306,8 +310,8 @@ void *memset(void *addr, int c, size_t len)
> #undef memmove
> void *memmove(void *dest, const void *src, size_t len)
> {
> - __asan_loadN((unsigned long)src, len);
> - __asan_storeN((unsigned long)dest, len);
> + check_memory_region((unsigned long)src, len, false, _RET_IP_);
> + check_memory_region((unsigned long)dest, len, true, _RET_IP_);
>
> return __memmove(dest, src, len);
> }
> @@ -315,8 +319,8 @@ void *memmove(void *dest, const void *src, size_t len)
> #undef memcpy
> void *memcpy(void *dest, const void *src, size_t len)
> {
> - __asan_loadN((unsigned long)src, len);
> - __asan_storeN((unsigned long)dest, len);
> + check_memory_region((unsigned long)src, len, false, _RET_IP_);
> + check_memory_region((unsigned long)dest, len, true, _RET_IP_);
>
> return __memcpy(dest, src, len);
> }
> @@ -698,22 +702,22 @@ void __asan_unregister_globals(struct kasan_global *globals, size_t size)
> }
> EXPORT_SYMBOL(__asan_unregister_globals);
>
> -#define DEFINE_ASAN_LOAD_STORE(size) \
> - void __asan_load##size(unsigned long addr) \
> - { \
> - check_memory_region(addr, size, false); \
> - } \
> - EXPORT_SYMBOL(__asan_load##size); \
> - __alias(__asan_load##size) \
> - void __asan_load##size##_noabort(unsigned long); \
> - EXPORT_SYMBOL(__asan_load##size##_noabort); \
> - void __asan_store##size(unsigned long addr) \
> - { \
> - check_memory_region(addr, size, true); \
> - } \
> - EXPORT_SYMBOL(__asan_store##size); \
> - __alias(__asan_store##size) \
> - void __asan_store##size##_noabort(unsigned long); \
> +#define DEFINE_ASAN_LOAD_STORE(size) \
> + void __asan_load##size(unsigned long addr) \
> + { \
> + check_memory_region_inline(addr, size, false, _RET_IP_);\
> + } \
> + EXPORT_SYMBOL(__asan_load##size); \
> + __alias(__asan_load##size) \
> + void __asan_load##size##_noabort(unsigned long); \
> + EXPORT_SYMBOL(__asan_load##size##_noabort); \
> + void __asan_store##size(unsigned long addr) \
> + { \
> + check_memory_region_inline(addr, size, true, _RET_IP_); \
> + } \
> + EXPORT_SYMBOL(__asan_store##size); \
> + __alias(__asan_store##size) \
> + void __asan_store##size##_noabort(unsigned long); \
> EXPORT_SYMBOL(__asan_store##size##_noabort)
>
> DEFINE_ASAN_LOAD_STORE(1);
> @@ -724,7 +728,7 @@ DEFINE_ASAN_LOAD_STORE(16);
>
> void __asan_loadN(unsigned long addr, size_t size)
> {
> - check_memory_region(addr, size, false);
> + check_memory_region(addr, size, false, _RET_IP_);
> }
> EXPORT_SYMBOL(__asan_loadN);
>
> @@ -734,7 +738,7 @@ EXPORT_SYMBOL(__asan_loadN_noabort);
>
> void __asan_storeN(unsigned long addr, size_t size)
> {
> - check_memory_region(addr, size, true);
> + check_memory_region(addr, size, true, _RET_IP_);
> }
> EXPORT_SYMBOL(__asan_storeN);
>
> --Reviewed-by:
> 2.7.3
>
Acked-by: Alexander Potapenko <glider@...gle.com>
--
Alexander Potapenko
Software Engineer
Google Germany GmbH
Erika-Mann-Straße, 33
80636 München
Geschäftsführer: Matthew Scott Sucherman, Paul Terence Manicle
Registergericht und -nummer: Hamburg, HRB 86891
Sitz der Gesellschaft: Hamburg
Powered by blists - more mailing lists