linux-kernel - Re: [PATCH] kasan: migrate copy_user

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CACzwLxiWzNqPBp4C1VkaXZ2wDwvY3yZeetCi1TLGFipKW77drA@mail.gmail.com>
Date: Sun, 13 Oct 2024 11:33:27 +0500
From: Sabyrzhan Tasbolatov <snovitoll@...il.com>
To: Andrey Konovalov <andreyknvl@...il.com>
Cc: akpm@...ux-foundation.org, ryabinin.a.a@...il.com, glider@...gle.com, 
	dvyukov@...gle.com, vincenzo.frascino@....com, linux-kernel@...r.kernel.org, 
	kasan-dev@...glegroups.com, linux-mm@...ck.org
Subject: Re: [PATCH] kasan: migrate copy_user_test to kunit

On Sun, Oct 13, 2024 at 3:49 AM Andrey Konovalov <andreyknvl@...il.com> wrote:
>
> On Fri, Oct 11, 2024 at 11:12 AM Sabyrzhan Tasbolatov
> <snovitoll@...il.com> wrote:
> >
> > This has been tested on:
> > - x86_64 with CONFIG_KASAN_GENERIC
> > - arm64 with CONFIG_KASAN_SW_TAGS
> > - arm64 with CONFIG_KASAN_HW_TAGS
> >
> > - arm64 SW_TAGS has 1 failing test which is in the mainline,
> > will try to address it in different patch, not related to changes in this PR:
> > [    9.480716]     # vmalloc_percpu: EXPECTATION FAILED at
> > mm/kasan/kasan_test_c.c:1830
> > [    9.480716]     Expected (u8)(__u8)((u64)(c_ptr) >> 56) < (u8)0xFF, but
> > [    9.480716]         (u8)(__u8)((u64)(c_ptr) >> 56) == 255 (0xff)
> > [    9.480716]         (u8)0xFF == 255 (0xff)
> > [    9.481936]     # vmalloc_percpu: EXPECTATION FAILED at
> > mm/kasan/kasan_test_c.c:1830
> > [    9.481936]     Expected (u8)(__u8)((u64)(c_ptr) >> 56) < (u8)0xFF, but
> > [    9.481936]         (u8)(__u8)((u64)(c_ptr) >> 56) == 255 (0xff)
> > [    9.481936]         (u8)0xFF == 255 (0xff)
>
> Could you share the kernel config that you use to get this failure?
> This test works for me with my config...
>

Here is config for arm64 with SW_TAGS:
https://gist.githubusercontent.com/novitoll/7ab93edca1f7d71925735075e84fc2ec/raw/7da07ae3c06009ad80dba87a0ba188934e31b8af/config-arm64-sw
, config for arm64 with HW_TAGS:
https://gist.githubusercontent.com/novitoll/7ab93edca1f7d71925735075e84fc2ec/raw/7da07ae3c06009ad80dba87a0ba188934e31b8af/config-arm64-hw

I've built them with defconfig, then chose in menuconfig KASAN,
enabled KUnit tests.

$ make CC=clang LD=ld.lld AR=llvm-ar NM=llvm-nm STRIP=llvm-strip
OBJCOPY=llvm-objcopy \
 OBJDUMP=llvm-objdump READELF=llvm-readelf   HOSTCC=clang HOSTCXX=clang++ \
 HOSTAR=llvm-ar HOSTLD=ld.lld ARCH=arm64 defconfig
$ clang --version
ClangBuiltLinux clang version 14.0.6
(https://github.com/llvm/llvm-project.git
f28c006a5895fc0e329fe15fead81e37457cb1d1)
Target: x86_64-unknown-linux-gnu
Thread model: posix
$ qemu-system-aarch64 \
  -machine virt,mte=on \
  -cpu max \
  -smp 2 \
  -m 2048 \
  -hda $IMAGE \
  -kernel $KERNEL/arch/arm64/boot/Image \
  -append "console=ttyAMA0 root=/dev/vda debug earlyprintk=serial
net.iframes=0 slub_debug=UZ oops=panic panic_on_warn=1 panic=-1
ftrace_dump_on_oops=orig_cpu" \
  -net user,hostfwd=tcp::10023-:22 -net nic \
  -nographic \
  -pidfile vm.pid \
  2>&1

> > Here is my full console log of arm64-sw.log:
> > https://gist.githubusercontent.com/novitoll/7ab93edca1f7d71925735075e84fc2ec/raw/6ef05758bcc396cd2f5796a5bcb5e41a091224cf/arm64-sw.log
> >
> > - arm64 HW_TAGS has 1 failing test related to new changes
> > and AFAIU, it's known issue related to HW_TAGS:
> >
> > [ 11.167324] # copy_user_test_oob: EXPECTATION FAILED at
> > mm/kasan/kasan_test_c.c:1992
> > [ 11.167324] KASAN failure expected in "unused =
> > strncpy_from_user(kmem, usermem, size + 1)", but none occurred
> >
> > Here is the console log of arm64-hw.log:
> > https://gist.github.com/novitoll/7ab93edca1f7d71925735075e84fc2ec#file-arm64-hw-log-L11208
>
> I don't remember seeing this issue before, did you manage to figure
> out why this happens?
>

I haven't figured it out yet. All I've understood that for HW_TAGS,
KASAN_GRANULE_SIZE is MTE_GRANULE_SIZE (16),
and I've tried to tweak the buffer size in kunit test, where it's 128
- KASAN_GRANULE_SIZE,
I've also tried to understand the if branches in:

#define KUNIT_EXPECT_KASAN_FAIL(test, expression) do { \
...
      if (IS_ENABLED(CONFIG_KASAN_HW_TAGS) && \

, haven't made any progress on it.

I've faced a similar issue with HW_TAGS in:
https://lore.kernel.org/all/20241011035310.2982017-1-snovitoll@gmail.com/

and also see the comment from you (perhaps, not related):
https://bugzilla.kernel.org/show_bug.cgi?id=212205#c2

> Thank you for working on this!

Thanks, I'll address your comments in another reply.