linux-kernel - Re: [PATCH kcsan 3/3] kcsan: Fix encoding masks and regain address bit

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Fri, 6 Nov 2020 10:03:21 +0100
From:   Marco Elver <elver@...gle.com>
To:     Boqun Feng <boqun.feng@...il.com>
Cc:     "Paul E. McKenney" <paulmck@...nel.org>,
        LKML <linux-kernel@...r.kernel.org>,
        kasan-dev <kasan-dev@...glegroups.com>, kernel-team@...com,
        Ingo Molnar <mingo@...nel.org>,
        Andrey Konovalov <andreyknvl@...gle.com>,
        Alexander Potapenko <glider@...gle.com>,
        Dmitry Vyukov <dvyukov@...gle.com>, Qian Cai <cai@....pw>
Subject: Re: [PATCH kcsan 3/3] kcsan: Fix encoding masks and regain address bit

On Fri, 6 Nov 2020 at 02:23, Boqun Feng <boqun.feng@...il.com> wrote:
> Hi Marco,
>
> On Thu, Nov 05, 2020 at 02:03:24PM -0800, paulmck@...nel.org wrote:
> > From: Marco Elver <elver@...gle.com>
> >
> > The watchpoint encoding masks for size and address were off-by-one bit
> > each, with the size mask using 1 unnecessary bit and the address mask
> > missing 1 bit. However, due to the way the size is shifted into the
> > encoded watchpoint, we were effectively wasting and never using the
> > extra bit.
> >
> > For example, on x86 with PAGE_SIZE==4K, we have 1 bit for the is-write
> > bit, 14 bits for the size bits, and then 49 bits left for the address.
> > Prior to this fix we would end up with this usage:
> >
> >       [ write<1> | size<14> | wasted<1> | address<48> ]
> >
> > Fix it by subtracting 1 bit from the GENMASK() end and start ranges of
> > size and address respectively. The added static_assert()s verify that
> > the masks are as expected. With the fixed version, we get the expected
> > usage:
> >
> >       [ write<1> | size<14> |             address<49> ]
> >
> > Functionally no change is expected, since that extra address bit is
> > insignificant for enabled architectures.
> >
> > Signed-off-by: Marco Elver <elver@...gle.com>
> > Signed-off-by: Paul E. McKenney <paulmck@...nel.org>
> > ---
> >  kernel/kcsan/encoding.h | 14 ++++++--------
> >  1 file changed, 6 insertions(+), 8 deletions(-)
> >
> > diff --git a/kernel/kcsan/encoding.h b/kernel/kcsan/encoding.h
> > index 4f73db6..b50bda9 100644
> > --- a/kernel/kcsan/encoding.h
> > +++ b/kernel/kcsan/encoding.h
> > @@ -37,14 +37,12 @@
> >   */
> >  #define WATCHPOINT_ADDR_BITS (BITS_PER_LONG-1 - WATCHPOINT_SIZE_BITS)
> >
> > -/*
> > - * Masks to set/retrieve the encoded data.
> > - */
> > -#define WATCHPOINT_WRITE_MASK BIT(BITS_PER_LONG-1)
> > -#define WATCHPOINT_SIZE_MASK                                                   \
> > -     GENMASK(BITS_PER_LONG-2, BITS_PER_LONG-2 - WATCHPOINT_SIZE_BITS)
> > -#define WATCHPOINT_ADDR_MASK                                                   \
> > -     GENMASK(BITS_PER_LONG-3 - WATCHPOINT_SIZE_BITS, 0)
> > +/* Bitmasks for the encoded watchpoint access information. */
> > +#define WATCHPOINT_WRITE_MASK        BIT(BITS_PER_LONG-1)
> > +#define WATCHPOINT_SIZE_MASK GENMASK(BITS_PER_LONG-2, BITS_PER_LONG-1 - WATCHPOINT_SIZE_BITS)
> > +#define WATCHPOINT_ADDR_MASK GENMASK(BITS_PER_LONG-2 - WATCHPOINT_SIZE_BITS, 0)
> > +static_assert(WATCHPOINT_ADDR_MASK == (1UL << WATCHPOINT_ADDR_BITS) - 1);
>
> Nit:
>
> Since you use the static_assert(), why not define WATCHPOINT_ADDR_MASK
> as:
>
> #define WATCHPOINT_ADDR_MASK (BIT(WATCHPOINT_SIZE_BITS) - 1)

This is incorrect, as the static_assert()s would have indicated. It
should probably be (BIT(WATCHPOINT_ADDR_BITS) - 1)?

As an aside, I explicitly did *not* want to use additional arithmetic
to generate the masks but purely rely on BIT(), and GENMASK(), as it
would be inconsistent otherwise. The static_assert()s then sanity
check everything without BIT+GENMASK (because I've grown slightly
paranoid about off-by-1s here). So I'd rather not start bikeshedding
about which way around things should go.

In general, GENMASK() is safer, because subtracting 1 to get the mask
doesn't always work, specifically e.g. (BIT(BITS_PER_LONG) - 1) does
not work.

> Besides, WATCHPOINT_SIZE_MASK can also be defined as:

No, sorry it cannot.

> #define WATCHPOINT_SIZE_MASK GENMASK(BITS_PER_LONG - 2, WATCHPOINT_SIZE_BITS)

   GENMASK(BITS_PER_LONG - 2, WATCHPOINT_SIZE_BITS)

is not equivalent to the current

  GENMASK(BITS_PER_LONG-2, BITS_PER_LONG-1 - WATCHPOINT_SIZE_BITS)

Did you mean GENMASK(BITS_PER_LONG-2, WATCHPOINT_ADDR_BITS)? I can
send a v2 for this one.

Thanks,
-- Marco