linux-kernel - Re: [PATCH] mm: kfence: Fix false positives on big endian

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <d63250048e4b224973b5a8d50e4c92547d4a9c34.camel@linux.ibm.com>
Date:   Fri, 19 May 2023 16:29:43 +1000
From:   Benjamin Gray <bgray@...ux.ibm.com>
To:     Michael Ellerman <mpe@...erman.id.au>,
        Andrew Morton <akpm@...ux-foundation.org>,
        David Laight <David.Laight@...LAB.COM>
Cc:     "zhangpeng.00@...edance.com" <zhangpeng.00@...edance.com>,
        "elver@...gle.com" <elver@...gle.com>,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
        "linux-mm@...ck.org" <linux-mm@...ck.org>,
        "glider@...gle.com" <glider@...gle.com>,
        "linuxppc-dev@...ts.ozlabs.org" <linuxppc-dev@...ts.ozlabs.org>
Subject: Re: [PATCH] mm: kfence: Fix false positives on big endian

On Fri, 2023-05-19 at 15:14 +1000, Michael Ellerman wrote:
> Andrew Morton <akpm@...ux-foundation.org> writes:
> > On Fri, 5 May 2023 16:02:17 +0000 David Laight
> > <David.Laight@...LAB.COM> wrote:
> > 
> > > From: Michael Ellerman
> > > > Sent: 05 May 2023 04:51
> > > > 
> > > > Since commit 1ba3cbf3ec3b ("mm: kfence: improve the performance
> > > > of
> > > > __kfence_alloc() and __kfence_free()"), kfence reports failures
> > > > in
> > > > random places at boot on big endian machines.
> > > > 
> > > > The problem is that the new KFENCE_CANARY_PATTERN_U64 encodes
> > > > the
> > > > address of each byte in its value, so it needs to be byte
> > > > swapped on big
> > > > endian machines.
> > > > 
> > > > The compiler is smart enough to do the le64_to_cpu() at compile
> > > > time, so
> > > > there is no runtime overhead.
> > > > 
> > > > Fixes: 1ba3cbf3ec3b ("mm: kfence: improve the performance of
> > > > __kfence_alloc() and __kfence_free()")
> > > > Signed-off-by: Michael Ellerman <mpe@...erman.id.au>
> > > > ---
> > > >  mm/kfence/kfence.h | 2 +-
> > > >  1 file changed, 1 insertion(+), 1 deletion(-)
> > > > 
> > > > diff --git a/mm/kfence/kfence.h b/mm/kfence/kfence.h
> > > > index 2aafc46a4aaf..392fb273e7bd 100644
> > > > --- a/mm/kfence/kfence.h
> > > > +++ b/mm/kfence/kfence.h
> > > > @@ -29,7 +29,7 @@
> > > >   * canary of every 8 bytes is the same. 64-bit memory can be
> > > > filled and checked
> > > >   * at a time instead of byte by byte to improve performance.
> > > >   */
> > > > -#define KFENCE_CANARY_PATTERN_U64 ((u64)0xaaaaaaaaaaaaaaaa ^
> > > > (u64)(0x0706050403020100))
> > > > +#define KFENCE_CANARY_PATTERN_U64 ((u64)0xaaaaaaaaaaaaaaaa ^
> > > > (u64)(le64_to_cpu(0x0706050403020100)))
> > > 
> > > What at the (u64) casts for?
> > > The constants should probably have a ul (or ull) suffix.
> > > 
> > 
> > I tried that, didn't fix the sparse warnings described at
> > https://lkml.kernel.org/r/202305132244.DwzBUcUd-lkp@intel.com.
> > 
> > Michael, have you looked into this?
> 
> I haven't sorry, been chasing other bugs.
> 
> > I'll merge it upstream - I guess we can live with the warnings for
> > a while.
> 
> Thanks, yeah spurious WARNs are more of a pain than some sparse
> warnings.
> 
> Maybe using le64_to_cpu() is too fancy, could just do it with an
> ifdef? eg.
> 
> diff --git a/mm/kfence/kfence.h b/mm/kfence/kfence.h
> index 392fb273e7bd..510355a5382b 100644
> --- a/mm/kfence/kfence.h
> +++ b/mm/kfence/kfence.h
> @@ -29,7 +29,11 @@
>   * canary of every 8 bytes is the same. 64-bit memory can be filled
> and checked
>   * at a time instead of byte by byte to improve performance.
>   */
> -#define KFENCE_CANARY_PATTERN_U64 ((u64)0xaaaaaaaaaaaaaaaa ^
> (u64)(le64_to_cpu(0x0706050403020100)))
> +#ifdef __LITTLE_ENDIAN__
> +#define KFENCE_CANARY_PATTERN_U64 (0xaaaaaaaaaaaaaaaaULL ^
> 0x0706050403020100ULL)
> +#else
> +#define KFENCE_CANARY_PATTERN_U64 (0xaaaaaaaaaaaaaaaaULL ^
> 0x0001020304050607ULL)
> +#endif
>  
>  /* Maximum stack depth for reports. */
>  #define KFENCE_STACK_DEPTH 64
> 
> 
> cheers

(for the sparse errors)

As I understand, we require memory to look like "00 01 02 03 04 05 06
07" such that iterating byte-by-byte gives 00, 01, etc. (with
everything XORed with aaa...)

I think it would be most semantically correct to use cpu_to_le64 on
KFENCE_CANARY_PATTERN_U64 and annotate the values being compared
against it as __le64. This is because we want the integer literal
0x0706050403020100 to be stored as "00 01 02 03 04 05 06 07", which is
the definition of little endian.

Masking this with an #ifdef leaves the type as cpu endian, which could
result in future issues.

(or I've just misunderstood and can disregard this)