[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <CA+fCnZdCqt=eN6vWJ93K8dK8yO_ThV=pcaYT=a92XqUYdReuUg@mail.gmail.com>
Date: Tue, 20 Aug 2024 21:57:18 +0200
From: Andrey Konovalov <andreyknvl@...il.com>
To: Matthew Maurer <mmaurer@...gle.com>
Cc: ojeda@...nel.org, Andrey Ryabinin <ryabinin.a.a@...il.com>,
Andrew Morton <akpm@...ux-foundation.org>, Alex Gaynor <alex.gaynor@...il.com>,
Wedson Almeida Filho <wedsonaf@...il.com>, dvyukov@...gle.com, aliceryhl@...gle.com,
samitolvanen@...gle.com, kasan-dev@...glegroups.com, linux-mm@...ck.org,
glider@...gle.com, Vincenzo Frascino <vincenzo.frascino@....com>,
Boqun Feng <boqun.feng@...il.com>, Gary Guo <gary@...yguo.net>,
Björn Roy Baron <bjorn3_gh@...tonmail.com>,
Benno Lossin <benno.lossin@...ton.me>, Andreas Hindborg <a.hindborg@...sung.com>,
linux-kernel@...r.kernel.org, rust-for-linux@...r.kernel.org
Subject: Re: [PATCH v4 4/4] kasan: rust: Add KASAN smoke test via UAF
On Tue, Aug 20, 2024 at 9:49 PM Matthew Maurer <mmaurer@...gle.com> wrote:
>
> Adds a smoke test to ensure that KASAN in Rust is actually detecting a
> Rust-native UAF. There is significant room to expand this test suite,
> but this will at least ensure that flags are having the intended effect.
>
> The rename from kasan_test.c to kasan_test_c.c is in order to allow the
> single kasan_test.ko test suite to contain both a .o file produced
> by the C compiler and one produced by rustc.
>
> Signed-off-by: Matthew Maurer <mmaurer@...gle.com>
> ---
> mm/kasan/Makefile | 7 ++++++-
> mm/kasan/kasan.h | 6 ++++++
> mm/kasan/{kasan_test.c => kasan_test_c.c} | 12 ++++++++++++
> mm/kasan/kasan_test_rust.rs | 19 +++++++++++++++++++
> 4 files changed, 43 insertions(+), 1 deletion(-)
> rename mm/kasan/{kasan_test.c => kasan_test_c.c} (99%)
> create mode 100644 mm/kasan/kasan_test_rust.rs
>
> diff --git a/mm/kasan/Makefile b/mm/kasan/Makefile
> index 7634dd2a6128..13059d9ee13c 100644
> --- a/mm/kasan/Makefile
> +++ b/mm/kasan/Makefile
> @@ -44,13 +44,18 @@ ifndef CONFIG_CC_HAS_KASAN_MEMINTRINSIC_PREFIX
> CFLAGS_KASAN_TEST += -fno-builtin
> endif
>
> -CFLAGS_kasan_test.o := $(CFLAGS_KASAN_TEST)
> +CFLAGS_kasan_test_c.o := $(CFLAGS_KASAN_TEST)
> +RUSTFLAGS_kasan_test_rust.o := $(RUSTFLAGS_KASAN)
> CFLAGS_kasan_test_module.o := $(CFLAGS_KASAN_TEST)
>
> obj-y := common.o report.o
> obj-$(CONFIG_KASAN_GENERIC) += init.o generic.o report_generic.o shadow.o quarantine.o
> obj-$(CONFIG_KASAN_HW_TAGS) += hw_tags.o report_hw_tags.o tags.o report_tags.o
> obj-$(CONFIG_KASAN_SW_TAGS) += init.o report_sw_tags.o shadow.o sw_tags.o tags.o report_tags.o
Nit: empty line here.
> +kasan_test-objs := kasan_test_c.o
> +ifdef CONFIG_RUST
> + kasan_test-objs += kasan_test_rust.o
> +endif
>
> obj-$(CONFIG_KASAN_KUNIT_TEST) += kasan_test.o
> obj-$(CONFIG_KASAN_MODULE_TEST) += kasan_test_module.o
> diff --git a/mm/kasan/kasan.h b/mm/kasan/kasan.h
> index fb2b9ac0659a..f438a6cdc964 100644
> --- a/mm/kasan/kasan.h
> +++ b/mm/kasan/kasan.h
> @@ -555,6 +555,12 @@ static inline bool kasan_arch_is_ready(void) { return true; }
> void kasan_kunit_test_suite_start(void);
> void kasan_kunit_test_suite_end(void);
>
> +#ifdef CONFIG_RUST
> +char kasan_test_rust_uaf(void);
> +#else
> +static inline char kasan_test_rust_uaf(void) { return '\0'; }
> +#endif
> +
> #else /* CONFIG_KASAN_KUNIT_TEST */
>
> static inline void kasan_kunit_test_suite_start(void) { }
> diff --git a/mm/kasan/kasan_test.c b/mm/kasan/kasan_test_c.c
> similarity index 99%
> rename from mm/kasan/kasan_test.c
> rename to mm/kasan/kasan_test_c.c
> index 7b32be2a3cf0..dd3d2a1e3145 100644
> --- a/mm/kasan/kasan_test.c
> +++ b/mm/kasan/kasan_test_c.c
> @@ -1899,6 +1899,17 @@ static void match_all_mem_tag(struct kunit *test)
> kfree(ptr);
> }
>
> +/*
> + * Check that Rust performing a use-after-free using `unsafe` is detected.
> + * This is a smoke test to make sure that Rust is being sanitized properly.
> + */
> +static void rust_uaf(struct kunit *test)
> +{
> + KASAN_TEST_NEEDS_CONFIG_ON(test, CONFIG_RUST);
> + KUNIT_EXPECT_KASAN_FAIL(test, kasan_test_rust_uaf());
> +}
> +
> +
> static struct kunit_case kasan_kunit_test_cases[] = {
> KUNIT_CASE(kmalloc_oob_right),
> KUNIT_CASE(kmalloc_oob_left),
> @@ -1971,6 +1982,7 @@ static struct kunit_case kasan_kunit_test_cases[] = {
> KUNIT_CASE(match_all_not_assigned),
> KUNIT_CASE(match_all_ptr_tag),
> KUNIT_CASE(match_all_mem_tag),
> + KUNIT_CASE(rust_uaf),
> {}
> };
>
> diff --git a/mm/kasan/kasan_test_rust.rs b/mm/kasan/kasan_test_rust.rs
> new file mode 100644
> index 000000000000..7239303b232c
> --- /dev/null
> +++ b/mm/kasan/kasan_test_rust.rs
> @@ -0,0 +1,19 @@
> +// SPDX-License-Identifier: GPL-2.0
> +
> +//! Helper crate for KASAN testing
> +//! Provides behavior to check the sanitization of Rust code.
> +use kernel::prelude::*;
> +use core::ptr::addr_of_mut;
> +
> +/// Trivial UAF - allocate a big vector, grab a pointer partway through,
> +/// drop the vector, and touch it.
> +#[no_mangle]
> +pub extern "C" fn kasan_test_rust_uaf() -> u8 {
> + let mut v: Vec<u8> = Vec::new();
> + for _ in 0..4096 {
> + v.push(0x42, GFP_KERNEL).unwrap();
> + }
> + let ptr: *mut u8 = addr_of_mut!(v[2048]);
> + drop(v);
> + unsafe { *ptr }
> +}
> --
> 2.46.0.184.g6999bdac58-goog
>
Powered by blists - more mailing lists