lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Message-ID: <CACT4Y+bg=j9VdteQwrJTNFF_t4EE5uDTMLj07+uMJ9-NcooXGQ@mail.gmail.com> Date: Sat, 24 Sep 2022 10:15:18 +0200 From: Dmitry Vyukov <dvyukov@...gle.com> To: Kees Cook <keescook@...omium.org> Cc: Vlastimil Babka <vbabka@...e.cz>, Andrey Ryabinin <ryabinin.a.a@...il.com>, Alexander Potapenko <glider@...gle.com>, Andrey Konovalov <andreyknvl@...il.com>, Vincenzo Frascino <vincenzo.frascino@....com>, Andrew Morton <akpm@...ux-foundation.org>, kasan-dev@...glegroups.com, linux-mm@...ck.org, "Ruhl, Michael J" <michael.j.ruhl@...el.com>, Hyeonggon Yoo <42.hyeyoo@...il.com>, Christoph Lameter <cl@...ux.com>, Pekka Enberg <penberg@...nel.org>, David Rientjes <rientjes@...gle.com>, Joonsoo Kim <iamjoonsoo.kim@....com>, "David S. Miller" <davem@...emloft.net>, Eric Dumazet <edumazet@...gle.com>, Jakub Kicinski <kuba@...nel.org>, Paolo Abeni <pabeni@...hat.com>, Greg Kroah-Hartman <gregkh@...uxfoundation.org>, Nick Desaulniers <ndesaulniers@...gle.com>, Alex Elder <elder@...nel.org>, Josef Bacik <josef@...icpanda.com>, David Sterba <dsterba@...e.com>, Sumit Semwal <sumit.semwal@...aro.org>, Christian König <christian.koenig@....com>, Jesse Brandeburg <jesse.brandeburg@...el.com>, Daniel Micay <danielmicay@...il.com>, Yonghong Song <yhs@...com>, Marco Elver <elver@...gle.com>, Miguel Ojeda <ojeda@...nel.org>, linux-kernel@...r.kernel.org, netdev@...r.kernel.org, linux-btrfs@...r.kernel.org, linux-media@...r.kernel.org, dri-devel@...ts.freedesktop.org, linaro-mm-sig@...ts.linaro.org, linux-fsdevel@...r.kernel.org, intel-wired-lan@...ts.osuosl.org, dev@...nvswitch.org, x86@...nel.org, llvm@...ts.linux.dev, linux-hardening@...r.kernel.org Subject: Re: [PATCH v2 14/16] kasan: Remove ksize()-related tests On Fri, 23 Sept 2022 at 22:28, Kees Cook <keescook@...omium.org> wrote: > > In preparation for no longer unpoisoning in ksize(), remove the behavioral > self-tests for ksize(). > > Cc: Andrey Ryabinin <ryabinin.a.a@...il.com> > Cc: Alexander Potapenko <glider@...gle.com> > Cc: Andrey Konovalov <andreyknvl@...il.com> > Cc: Dmitry Vyukov <dvyukov@...gle.com> > Cc: Vincenzo Frascino <vincenzo.frascino@....com> > Cc: Andrew Morton <akpm@...ux-foundation.org> > Cc: kasan-dev@...glegroups.com > Cc: linux-mm@...ck.org > Signed-off-by: Kees Cook <keescook@...omium.org> > --- > lib/test_kasan.c | 42 ------------------------------------------ > mm/kasan/shadow.c | 4 +--- > 2 files changed, 1 insertion(+), 45 deletions(-) > > diff --git a/lib/test_kasan.c b/lib/test_kasan.c > index 58c1b01ccfe2..bdd0ced8f8d7 100644 > --- a/lib/test_kasan.c > +++ b/lib/test_kasan.c > @@ -753,46 +753,6 @@ static void kasan_global_oob_left(struct kunit *test) > KUNIT_EXPECT_KASAN_FAIL(test, *(volatile char *)p); > } > > -/* Check that ksize() makes the whole object accessible. */ > -static void ksize_unpoisons_memory(struct kunit *test) > -{ > - char *ptr; > - size_t size = 123, real_size; > - > - ptr = kmalloc(size, GFP_KERNEL); > - KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr); > - real_size = ksize(ptr); > - > - OPTIMIZER_HIDE_VAR(ptr); > - > - /* This access shouldn't trigger a KASAN report. */ > - ptr[size] = 'x'; I would rather keep the tests and update to the new behavior. We had bugs in ksize, we need test coverage. I assume ptr[size] access must now produce an error even after ksize. > - /* This one must. */ > - KUNIT_EXPECT_KASAN_FAIL(test, ((volatile char *)ptr)[real_size]); > - > - kfree(ptr); > -} > - > -/* > - * Check that a use-after-free is detected by ksize() and via normal accesses > - * after it. > - */ > -static void ksize_uaf(struct kunit *test) > -{ > - char *ptr; > - int size = 128 - KASAN_GRANULE_SIZE; > - > - ptr = kmalloc(size, GFP_KERNEL); > - KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr); > - kfree(ptr); > - > - OPTIMIZER_HIDE_VAR(ptr); > - KUNIT_EXPECT_KASAN_FAIL(test, ksize(ptr)); This is still a bug that should be detected, right? Calling ksize on a freed pointer is a bug. > - KUNIT_EXPECT_KASAN_FAIL(test, ((volatile char *)ptr)[0]); > - KUNIT_EXPECT_KASAN_FAIL(test, ((volatile char *)ptr)[size]); > -} > - > static void kasan_stack_oob(struct kunit *test) > { > char stack_array[10]; > @@ -1392,8 +1352,6 @@ static struct kunit_case kasan_kunit_test_cases[] = { > KUNIT_CASE(kasan_stack_oob), > KUNIT_CASE(kasan_alloca_oob_left), > KUNIT_CASE(kasan_alloca_oob_right), > - KUNIT_CASE(ksize_unpoisons_memory), > - KUNIT_CASE(ksize_uaf), > KUNIT_CASE(kmem_cache_double_free), > KUNIT_CASE(kmem_cache_invalid_free), > KUNIT_CASE(kmem_cache_double_destroy), > diff --git a/mm/kasan/shadow.c b/mm/kasan/shadow.c > index 0e3648b603a6..0895c73e9b69 100644 > --- a/mm/kasan/shadow.c > +++ b/mm/kasan/shadow.c > @@ -124,9 +124,7 @@ void kasan_unpoison(const void *addr, size_t size, bool init) > addr = kasan_reset_tag(addr); > > /* > - * Skip KFENCE memory if called explicitly outside of sl*b. Also note > - * that calls to ksize(), where size is not a multiple of machine-word > - * size, would otherwise poison the invalid portion of the word. > + * Skip KFENCE memory if called explicitly outside of sl*b. > */ > if (is_kfence_address(addr)) > return; > -- > 2.34.1
Powered by blists - more mailing lists