linux-kernel - Re: [PATCH v5 13/19] kasan: x86: Handle int3 for inline KASAN reports

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CA+fCnZdJckDC4AKYxLS1MLBXir4wWqNddrD0o+mY4MXt0CYhcQ@mail.gmail.com>
Date: Mon, 8 Sep 2025 22:19:05 +0200
From: Andrey Konovalov <andreyknvl@...il.com>
To: Maciej Wieczor-Retman <maciej.wieczor-retman@...el.com>
Cc: sohil.mehta@...el.com, baohua@...nel.org, david@...hat.com, 
	kbingham@...nel.org, weixugc@...gle.com, Liam.Howlett@...cle.com, 
	alexandre.chartre@...cle.com, kas@...nel.org, mark.rutland@....com, 
	trintaeoitogc@...il.com, axelrasmussen@...gle.com, yuanchu@...gle.com, 
	joey.gouly@....com, samitolvanen@...gle.com, joel.granados@...nel.org, 
	graf@...zon.com, vincenzo.frascino@....com, kees@...nel.org, ardb@...nel.org, 
	thiago.bauermann@...aro.org, glider@...gle.com, thuth@...hat.com, 
	kuan-ying.lee@...onical.com, pasha.tatashin@...een.com, 
	nick.desaulniers+lkml@...il.com, vbabka@...e.cz, kaleshsingh@...gle.com, 
	justinstitt@...gle.com, catalin.marinas@....com, 
	alexander.shishkin@...ux.intel.com, samuel.holland@...ive.com, 
	dave.hansen@...ux.intel.com, corbet@....net, xin@...or.com, 
	dvyukov@...gle.com, tglx@...utronix.de, scott@...amperecomputing.com, 
	jason.andryuk@....com, morbo@...gle.com, nathan@...nel.org, 
	lorenzo.stoakes@...cle.com, mingo@...hat.com, brgerst@...il.com, 
	kristina.martsenko@....com, bigeasy@...utronix.de, luto@...nel.org, 
	jgross@...e.com, jpoimboe@...nel.org, urezki@...il.com, mhocko@...e.com, 
	ada.coupriediaz@....com, hpa@...or.com, leitao@...ian.org, 
	peterz@...radead.org, wangkefeng.wang@...wei.com, surenb@...gle.com, 
	ziy@...dia.com, smostafa@...gle.com, ryabinin.a.a@...il.com, 
	ubizjak@...il.com, jbohac@...e.cz, broonie@...nel.org, 
	akpm@...ux-foundation.org, guoweikang.kernel@...il.com, rppt@...nel.org, 
	pcc@...gle.com, jan.kiszka@...mens.com, nicolas.schier@...ux.dev, 
	will@...nel.org, jhubbard@...dia.com, bp@...en8.de, x86@...nel.org, 
	linux-doc@...r.kernel.org, linux-mm@...ck.org, llvm@...ts.linux.dev, 
	linux-kbuild@...r.kernel.org, kasan-dev@...glegroups.com, 
	linux-kernel@...r.kernel.org, linux-arm-kernel@...ts.infradead.org
Subject: Re: [PATCH v5 13/19] kasan: x86: Handle int3 for inline KASAN reports

On Mon, Sep 8, 2025 at 3:09 PM Maciej Wieczor-Retman
<maciej.wieczor-retman@...el.com> wrote:
>
> >>I recall there were some corner cases where this code path got called in outline
> >>mode, didn't have a mismatch but still died due to the die() below. But I'll
> >>recheck and either apply what you wrote above or get add a better explanation
> >>to the patch message.
> >
> >Okay, so the int3_selftest_ip() is causing a problem in outline mode.
> >
> >I tried disabling kasan with kasan_disable_current() but thinking of it now it
> >won't work because int3 handler will still be called and die() will happen.
>
> Sorry, I meant to write that kasan_disable_current() works together with
> if(!kasan_report()). Because without checking kasan_report()' return
> value, if kasan is disabled through kasan_disable_current() it will have no
> effect in both inline mode, and if int3 is called in outline mode - the
> kasan_inline_handler will lead to die().

So do I understand correctly, that we have no way to distinguish
whether the int3 was inserted by the KASAN instrumentation or natively
called (like in int3_selftest_ip())?

If so, I think that we need to fix/change the compiler first so that
we can distinguish these cases. And only then introduce
kasan_inline_handler(). (Without kasan_inline_handler(), the outline
instrumentation would then just work, right?)

If we can distinguish them, then we should only call
kasan_inline_handler() for the KASAN-inserted int3's. This is what we
do on arm64 (via brk and KASAN_BRK_IMM). And then int3_selftest_ip()
should not be affected.

> >
> >What did you mean by "return the same value regardless of kasan_report()"? Then
> >it will never reach the kasan_inline_recover() which I assume is needed for
> >inline mode (once recover will work).

I meant that with the recovery always enabled, it should not matter
whether the report is suppressed (kasan_report() returns false) or
printed (returns true). We should always skip over the int3
instruction and continue the execution.