linux-kernel - Re: [PATCH v3] kprobes: unpoison stack in jprobe

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Fri, 14 Oct 2016 12:25:57 +0100
From:   Will Deacon <will.deacon@....com>
To:     Dmitry Vyukov <dvyukov@...gle.com>
Cc:     rostedt@...dmis.org, mingo@...hat.com, akpm@...ux-foundation.org,
        linux-kernel@...r.kernel.org, ryabinin.a.a@...il.com,
        surovegin@...gle.com, Mark Rutland <mark.rutland@....com>,
        Catalin Marinas <catalin.marinas@....com>,
        Lorenzo Pieralisi <lorenzo.pieralisi@....com>,
        Alexander Potapenko <glider@...gle.com>,
        Ingo Molnar <mingo@...nel.org>,
        Thomas Gleixner <tglx@...utronix.de>,
        "H. Peter Anvin" <hpa@...or.com>,
        Ananth N Mavinakayanahalli <ananth@...ux.vnet.ibm.com>,
        Anil S Keshavamurthy <anil.s.keshavamurthy@...el.com>,
        "David S. Miller" <davem@...emloft.net>,
        Masami Hiramatsu <mhiramat@...nel.org>, x86@...nel.org,
        kasan-dev@...glegroups.com
Subject: Re: [PATCH v3] kprobes: unpoison stack in jprobe_return() for KASAN

On Fri, Oct 14, 2016 at 12:53:56PM +0200, Dmitry Vyukov wrote:
> KASAN stack instrumentation poisons stack redzones on function entry
> and unpoisons them on function exit. If a function exits abnormally
> (e.g. with a longjmp like jprobe_return()), stack redzones are left
> poisoned. Later this leads to random KASAN false reports.
> 
> Unpoison stack redzones in the frames we are going to jump over
> before doing actual longjmp in jprobe_return().
> 
> Signed-off-by: Dmitry Vyukov <dvyukov@...gle.com>
> Cc: Mark Rutland <mark.rutland@....com>
> Cc: Catalin Marinas <catalin.marinas@....com>
> Cc: Andrey Ryabinin <ryabinin.a.a@...il.com>
> Cc: Lorenzo Pieralisi <lorenzo.pieralisi@....com>
> Cc: Alexander Potapenko <glider@...gle.com>
> Cc: Will Deacon <will.deacon@....com>
> Cc: Ingo Molnar <mingo@...nel.org>
> Cc: Andrew Morton <akpm@...ux-foundation.org>
> Cc: Thomas Gleixner <tglx@...utronix.de>
> Cc: "H. Peter Anvin" <hpa@...or.com>
> Cc: Ananth N Mavinakayanahalli <ananth@...ux.vnet.ibm.com>
> Cc: Anil S Keshavamurthy <anil.s.keshavamurthy@...el.com>
> Cc: "David S. Miller" <davem@...emloft.net>
> Cc: Masami Hiramatsu <mhiramat@...nel.org>
> Cc: x86@...nel.org
> Cc: kasan-dev@...glegroups.com
> 
> --
> 
> Changes since v1:
>  - leave kasan_unpoison_remaining_stack() intact
>  - instead add kasan_unpoison_stack_above_sp_to()
>  - rename kasan_unpoison_remaining_stack() to kasan_unpoison_task_stack_below()
> 
> Changes since v2:
>  - fix build by adding return type to kasan_unpoison_stack_above_sp_to
>    (tested v2 with it, but forgot to git add)

I get build warnings with this patch applied and KASAN enabled:

mm/kasan/kasan.c: In function ‘kasan_unpoison_task_stack_below’:
mm/kasan/kasan.c:82:34: warning: passing argument 2 of ‘__kasan_unpoison_stack’ discards ‘const’ qualifier from pointer target type [-Wdiscarded-qualifiers]
  __kasan_unpoison_stack(current, watermark);
                                  ^~~~~~~~~
mm/kasan/kasan.c:65:13: note: expected ‘void *’ but argument is of type ‘const void *’
 static void __kasan_unpoison_stack(struct task_struct *task, void *sp)
             ^~~~~~~~~~~~~~~~~~~~~~
mm/kasan/kasan.c: In function ‘kasan_unpoison_stack_above_sp_to’:
mm/kasan/kasan.c:92:27: error: called object ‘current_stack_pointer’ is not a function or function pointer
  const void *sp = (void *)current_stack_pointer();
                           ^~~~~~~~~~~~~~~~~~~~~
In file included from ./include/linux/thread_info.h:54:0,
                 from ./include/asm-generic/preempt.h:4,
                 from ./arch/arm64/include/generated/asm/preempt.h:1,
                 from ./include/linux/preempt.h:59,
                 from ./include/linux/interrupt.h:8,
                 from mm/kasan/kasan.c:20:
./arch/arm64/include/asm/thread_info.h:69:24: note: declared here
 register unsigned long current_stack_pointer asm ("sp");

Will