linux-kernel - Re: kasan: false use-after-scope warnings with KCOV

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <5a431b68-8340-cc9c-53ed-918f677a3f60@virtuozzo.com>
Date:   Wed, 29 Nov 2017 19:54:11 +0300
From:   Andrey Ryabinin <aryabinin@...tuozzo.com>
To:     Dmitry Vyukov <dvyukov@...gle.com>,
        Mark Rutland <mark.rutland@....com>
Cc:     kasan-dev <kasan-dev@...glegroups.com>,
        Alexander Potapenko <glider@...gle.com>,
        LKML <linux-kernel@...r.kernel.org>,
        linux-arm-kernel@...ts.infradead.org,
        Dennis Zhou <dennisszhou@...il.com>,
        Fengguang Wu <fengguang.wu@...el.com>
Subject: Re: kasan: false use-after-scope warnings with KCOV

On 11/28/2017 08:52 PM, Dmitry Vyukov wrote:
> On Tue, Nov 28, 2017 at 4:24 PM, Mark Rutland <mark.rutland@....com> wrote:
>>>>> As a heads-up, I'm seeing a number of what appear to be false-positive
>>>>> use-after-scope warnings when I enable both KCOV and KASAN (inline or outline),
>>>>> when using the Linaro 17.08 GCC7.1.1 for arm64. So far I haven't spotted these
>>>>> without KCOV selected, and I'm only seeing these for sanitize-use-after-scope.
>>>>>
>>>>> The reports vary depending on configuration even with the same trigger. I'm not
>>>>> sure if it's the reporting that's misleading, or whether the detection is going
>>>>> wrong.
>>
>>> ... it looks suspiciously like something is setting up non-zero shadow
>>> bytes, but not zeroing them upon return.
>>
>> It looks like this is the case.
>>
>> The hack below detects leftover poison on an exception return *before*
>> the false-positive warning (example splat at the end of the email). With
>> scripts/Makefile.kasan hacked to not pass
>> -fsanitize-address-use-after-scope, I see no leftover poison.
>>
>> Unfortunately, there's not enough information left to say where exactly
>> that happened.
>>
>> Given the report that Andrey linked to [1], it looks like the compiler
>> is doing something wrong, and failing to clear some poison in some
>> cases. Dennis noted [2] that this appears to be the case where inline
>> functions are called in a loop.
>>
>> It sounds like this is a general GCC 7.x problem, on both x86_64 and
>> arm64. As we don't have a smoking gun, it's still possible that
>> something else is corrupting the shadow, but it seems unlikely.
> 
> 
> 
> We use gcc 7.1 extensively on x86_64 and have not seen any problems.
> 

Yeah, it's probably two different problems.

Today kbuild reported another use-after-scope - http://lkml.kernel.org/r/<20171129052106.rhgbjhhis53hkgfn@...-t540p.sh.intel.com>
No struct leak plugin and kcov instrumentation is also off. It's hard to tell whether it's false-positive or not, the code is a mess.
So until proven otherwise, I tend to think that this time it's a real bug.
.config attached, if someone want to look. It's easy reproducible, just boot qemu and wait.




View attachment ".config" of type "text/plain" (96149 bytes)