linux-kernel - Re: [PATCH v4] kprobes: unpoison stack in jprobe

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Fri, 14 Oct 2016 16:08:49 +0200
From:   Dmitry Vyukov <dvyukov@...gle.com>
To:     Mark Rutland <mark.rutland@....com>
Cc:     Steven Rostedt <rostedt@...dmis.org>,
        Ingo Molnar <mingo@...hat.com>,
        Andrew Morton <akpm@...ux-foundation.org>,
        LKML <linux-kernel@...r.kernel.org>,
        Andrey Ryabinin <ryabinin.a.a@...il.com>,
        Eugene Surovegin <surovegin@...gle.com>,
        Catalin Marinas <catalin.marinas@....com>,
        Lorenzo Pieralisi <lorenzo.pieralisi@....com>,
        Alexander Potapenko <glider@...gle.com>,
        Will Deacon <will.deacon@....com>,
        Ingo Molnar <mingo@...nel.org>,
        Thomas Gleixner <tglx@...utronix.de>,
        "H. Peter Anvin" <hpa@...or.com>,
        Ananth N Mavinakayanahalli <ananth@...ux.vnet.ibm.com>,
        Anil S Keshavamurthy <anil.s.keshavamurthy@...el.com>,
        "David S. Miller" <davem@...emloft.net>,
        Masami Hiramatsu <mhiramat@...nel.org>,
        "x86@...nel.org" <x86@...nel.org>,
        kasan-dev <kasan-dev@...glegroups.com>
Subject: Re: [PATCH v4] kprobes: unpoison stack in jprobe_return() for KASAN

On Fri, Oct 14, 2016 at 3:08 PM, Mark Rutland <mark.rutland@....com> wrote:
> On Fri, Oct 14, 2016 at 01:54:30PM +0200, Dmitry Vyukov wrote:
>> KASAN stack instrumentation poisons stack redzones on function entry
>> and unpoisons them on function exit. If a function exits abnormally
>> (e.g. with a longjmp like jprobe_return()), stack redzones are left
>> poisoned. Later this leads to random KASAN false reports.
>>
>> Unpoison stack redzones in the frames we are going to jump over
>> before doing actual longjmp in jprobe_return().
>>
>> Signed-off-by: Dmitry Vyukov <dvyukov@...gle.com>
>> Reviewed-by: Mark Rutland <mark.rutland@....com>
>
> ... judging by the kbuild test robot I spoke too soon, and should have
> been more thorough. :/
>
>> +/*
>> + * Clear all poison for the region between the current SP and a provided
>> + * watermark value, as is sometimes required prior to hand-crafted asm function
>> + * returns in the middle of functions.
>> + */
>> +void kasan_unpoison_stack_above_sp_to(const void *watermark)
>> +{
>> +     const void *sp = (void *)current_stack_pointer();
>
> Aargh; it seems current_stack_pointer() is only function-like on some
> arches, and not on others (arm64 included). I should have known better;
> sorry for the bad suggestion.
>
> I'm not overjoyed about taking the address of a stack variable to
> implement this ourselves. Can we use __builtin_frame_address(0) instead?
> Or are there cases where that won't work on x86?

Mailed v5 with __builtin_frame_address(0).
Built mm/kasan/kasan.o for arm64.

I see that __builtin_frame_address(0) is used on several arches
including x86 and arm64.
So I hope we are good here.


>
>> +     size_t size = watermark - sp;
>> +
>> +     if (WARN_ON(sp > watermark))
>> +             return;
>
> ... not a new problem, but we should also include <linux/bug.h> for
> WARN_ON().

Done