lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <d63250048e4b224973b5a8d50e4c92547d4a9c34.camel@linux.ibm.com>
Date:   Fri, 19 May 2023 16:29:43 +1000
From:   Benjamin Gray <bgray@...ux.ibm.com>
To:     Michael Ellerman <mpe@...erman.id.au>,
        Andrew Morton <akpm@...ux-foundation.org>,
        David Laight <David.Laight@...LAB.COM>
Cc:     "zhangpeng.00@...edance.com" <zhangpeng.00@...edance.com>,
        "elver@...gle.com" <elver@...gle.com>,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
        "linux-mm@...ck.org" <linux-mm@...ck.org>,
        "glider@...gle.com" <glider@...gle.com>,
        "linuxppc-dev@...ts.ozlabs.org" <linuxppc-dev@...ts.ozlabs.org>
Subject: Re: [PATCH] mm: kfence: Fix false positives on big endian

On Fri, 2023-05-19 at 15:14 +1000, Michael Ellerman wrote:
> Andrew Morton <akpm@...ux-foundation.org> writes:
> > On Fri, 5 May 2023 16:02:17 +0000 David Laight
> > <David.Laight@...LAB.COM> wrote:
> > 
> > > From: Michael Ellerman
> > > > Sent: 05 May 2023 04:51
> > > > 
> > > > Since commit 1ba3cbf3ec3b ("mm: kfence: improve the performance
> > > > of
> > > > __kfence_alloc() and __kfence_free()"), kfence reports failures
> > > > in
> > > > random places at boot on big endian machines.
> > > > 
> > > > The problem is that the new KFENCE_CANARY_PATTERN_U64 encodes
> > > > the
> > > > address of each byte in its value, so it needs to be byte
> > > > swapped on big
> > > > endian machines.
> > > > 
> > > > The compiler is smart enough to do the le64_to_cpu() at compile
> > > > time, so
> > > > there is no runtime overhead.
> > > > 
> > > > Fixes: 1ba3cbf3ec3b ("mm: kfence: improve the performance of
> > > > __kfence_alloc() and __kfence_free()")
> > > > Signed-off-by: Michael Ellerman <mpe@...erman.id.au>
> > > > ---
> > > >  mm/kfence/kfence.h | 2 +-
> > > >  1 file changed, 1 insertion(+), 1 deletion(-)
> > > > 
> > > > diff --git a/mm/kfence/kfence.h b/mm/kfence/kfence.h
> > > > index 2aafc46a4aaf..392fb273e7bd 100644
> > > > --- a/mm/kfence/kfence.h
> > > > +++ b/mm/kfence/kfence.h
> > > > @@ -29,7 +29,7 @@
> > > >   * canary of every 8 bytes is the same. 64-bit memory can be
> > > > filled and checked
> > > >   * at a time instead of byte by byte to improve performance.
> > > >   */
> > > > -#define KFENCE_CANARY_PATTERN_U64 ((u64)0xaaaaaaaaaaaaaaaa ^
> > > > (u64)(0x0706050403020100))
> > > > +#define KFENCE_CANARY_PATTERN_U64 ((u64)0xaaaaaaaaaaaaaaaa ^
> > > > (u64)(le64_to_cpu(0x0706050403020100)))
> > > 
> > > What at the (u64) casts for?
> > > The constants should probably have a ul (or ull) suffix.
> > > 
> > 
> > I tried that, didn't fix the sparse warnings described at
> > https://lkml.kernel.org/r/202305132244.DwzBUcUd-lkp@intel.com.
> > 
> > Michael, have you looked into this?
> 
> I haven't sorry, been chasing other bugs.
> 
> > I'll merge it upstream - I guess we can live with the warnings for
> > a while.
> 
> Thanks, yeah spurious WARNs are more of a pain than some sparse
> warnings.
> 
> Maybe using le64_to_cpu() is too fancy, could just do it with an
> ifdef? eg.
> 
> diff --git a/mm/kfence/kfence.h b/mm/kfence/kfence.h
> index 392fb273e7bd..510355a5382b 100644
> --- a/mm/kfence/kfence.h
> +++ b/mm/kfence/kfence.h
> @@ -29,7 +29,11 @@
>   * canary of every 8 bytes is the same. 64-bit memory can be filled
> and checked
>   * at a time instead of byte by byte to improve performance.
>   */
> -#define KFENCE_CANARY_PATTERN_U64 ((u64)0xaaaaaaaaaaaaaaaa ^
> (u64)(le64_to_cpu(0x0706050403020100)))
> +#ifdef __LITTLE_ENDIAN__
> +#define KFENCE_CANARY_PATTERN_U64 (0xaaaaaaaaaaaaaaaaULL ^
> 0x0706050403020100ULL)
> +#else
> +#define KFENCE_CANARY_PATTERN_U64 (0xaaaaaaaaaaaaaaaaULL ^
> 0x0001020304050607ULL)
> +#endif
>  
>  /* Maximum stack depth for reports. */
>  #define KFENCE_STACK_DEPTH 64
> 
> 
> cheers

(for the sparse errors)

As I understand, we require memory to look like "00 01 02 03 04 05 06
07" such that iterating byte-by-byte gives 00, 01, etc. (with
everything XORed with aaa...)

I think it would be most semantically correct to use cpu_to_le64 on
KFENCE_CANARY_PATTERN_U64 and annotate the values being compared
against it as __le64. This is because we want the integer literal
0x0706050403020100 to be stored as "00 01 02 03 04 05 06 07", which is
the definition of little endian.

Masking this with an #ifdef leaves the type as cpu endian, which could
result in future issues.

(or I've just misunderstood and can disregard this)

Powered by blists - more mailing lists

Powered by Openwall GNU/*/Linux Powered by OpenVZ