| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <13fa5da13adf927abbb7dd85d19fbaa8e4fadc84.1765386422.git.m.wieczorretman@pm.me>
Date: Wed, 10 Dec 2025 17:30:05 +0000
From: Maciej Wieczor-Retman <m.wieczorretman@...me>
To: Thomas Gleixner <tglx@...utronix.de>, Ingo Molnar <mingo@...hat.com>, Borislav Petkov <bp@...en8.de>, Dave Hansen <dave.hansen@...ux.intel.com>, x86@...nel.org, "H. Peter Anvin" <hpa@...or.com>, Andrey Ryabinin <ryabinin.a.a@...il.com>, Alexander Potapenko <glider@...gle.com>, Andrey Konovalov <andreyknvl@...il.com>, Dmitry Vyukov <dvyukov@...gle.com>, Vincenzo Frascino <vincenzo.frascino@....com>, Andy Lutomirski <luto@...nel.org>, Peter Zijlstra <peterz@...radead.org>, Nathan Chancellor <nathan@...nel.org>, Nick Desaulniers <nick.desaulniers+lkml@...il.com>, Bill Wendling <morbo@...gle.com>, Justin Stitt <justinstitt@...gle.com>
Cc: m.wieczorretman@...me, Maciej Wieczor-Retman <maciej.wieczor-retman@...el.com>, linux-kernel@...r.kernel.org, kasan-dev@...glegroups.com, llvm@...ts.linux.dev
Subject: [PATCH v7 12/15] x86/kasan: Handle UD1 for inline KASAN reports
From: Maciej Wieczor-Retman <maciej.wieczor-retman@...el.com>
Inline KASAN on x86 should do tag mismatch reports by passing the
metadata through the UD1 instruction and the faulty address through RDI,
a scheme that's already used by UBSan and is easy to extend.
The current LLVM way of passing KASAN software tag mode metadata is done
using the INT3 instruction. However that should be changed because it
doesn't align to how the kernel already handles UD1 for similar use
cases. Since inline software tag-based KASAN doesn't work on x86 due to
missing compiler support it can be fixed and the INT3 can be changed to
UD1 at the same time.
Add a kasan component to the #UD decoding and handling functions.
Make part of that hook - which decides whether to die or recover from a
tag mismatch - arch independent to avoid duplicating a long comment on
both x86 and arm64 architectures.
Signed-off-by: Maciej Wieczor-Retman <maciej.wieczor-retman@...el.com>
---
Changelog v7:
- Redo the #UD handling that's based on Peter Zijlstra WARN() patches.
- Rename kasan_inline.c -> kasan_sw_tags.c (Alexander)
Changelog v6:
- Change the whole patch from using INT3 to UD1.
Changelog v5:
- Add die to argument list of kasan_inline_recover() in
arch/arm64/kernel/traps.c.
Changelog v4:
- Make kasan_handler() a stub in a header file. Remove #ifdef from
traps.c.
- Consolidate the "recover" comment into one place.
- Make small changes to the patch message.
MAINTAINERS | 2 +-
arch/x86/include/asm/bug.h | 1 +
arch/x86/include/asm/kasan.h | 20 ++++++++++++++++++++
arch/x86/kernel/traps.c | 13 ++++++++++++-
arch/x86/mm/Makefile | 2 ++
arch/x86/mm/kasan_sw_tags.c | 19 +++++++++++++++++++
include/linux/kasan.h | 23 +++++++++++++++++++++++
7 files changed, 78 insertions(+), 2 deletions(-)
create mode 100644 arch/x86/mm/kasan_sw_tags.c
diff --git a/MAINTAINERS b/MAINTAINERS
index a591598cc4b5..ff1c036ae39f 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -13421,7 +13421,7 @@ S: Maintained
B: https://bugzilla.kernel.org/buglist.cgi?component=Sanitizers&product=Memory%20Management
F: Documentation/dev-tools/kasan.rst
F: arch/*/include/asm/*kasan*.h
-F: arch/*/mm/kasan_init*
+F: arch/*/mm/kasan_*
F: include/linux/kasan*.h
F: lib/Kconfig.kasan
F: mm/kasan/
diff --git a/arch/x86/include/asm/bug.h b/arch/x86/include/asm/bug.h
index 83b0fb38732d..eb733ac14598 100644
--- a/arch/x86/include/asm/bug.h
+++ b/arch/x86/include/asm/bug.h
@@ -32,6 +32,7 @@
#define BUG_UD1 0xfffd
#define BUG_UD1_UBSAN 0xfffc
#define BUG_UD1_WARN 0xfffb
+#define BUG_UD1_KASAN 0xfffa
#define BUG_UDB 0xffd6
#define BUG_LOCK 0xfff0
diff --git a/arch/x86/include/asm/kasan.h b/arch/x86/include/asm/kasan.h
index eab12527ed7f..6e083d45770d 100644
--- a/arch/x86/include/asm/kasan.h
+++ b/arch/x86/include/asm/kasan.h
@@ -6,6 +6,24 @@
#include <linux/kasan-tags.h>
#include <linux/types.h>
#define KASAN_SHADOW_OFFSET _AC(CONFIG_KASAN_SHADOW_OFFSET, UL)
+
+/*
+ * LLVM ABI for reporting tag mismatches in inline KASAN mode.
+ * On x86 the UD1 instruction is used to carry metadata in the ECX register
+ * to the KASAN report. ECX is used to differentiate KASAN from UBSan when
+ * decoding the UD1 instruction.
+ *
+ * SIZE refers to how many bytes the faulty memory access
+ * requested.
+ * WRITE bit, when set, indicates the access was a write, otherwise
+ * it was a read.
+ * RECOVER bit, when set, should allow the kernel to carry on after
+ * a tag mismatch. Otherwise die() is called.
+ */
+#define KASAN_ECX_RECOVER 0x20
+#define KASAN_ECX_WRITE 0x10
+#define KASAN_ECX_SIZE_MASK 0x0f
+#define KASAN_ECX_SIZE(ecx) (1 << ((ecx) & KASAN_ECX_SIZE_MASK))
#define KASAN_SHADOW_SCALE_SHIFT 3
/*
@@ -34,10 +52,12 @@
#define __tag_shifted(tag) FIELD_PREP(GENMASK_ULL(60, 57), tag)
#define __tag_reset(addr) (sign_extend64((u64)(addr), 56))
#define __tag_get(addr) ((u8)FIELD_GET(GENMASK_ULL(60, 57), (u64)addr))
+void kasan_inline_handler(struct pt_regs *regs, unsigned int metadata, u64 addr);
#else
#define __tag_shifted(tag) 0UL
#define __tag_reset(addr) (addr)
#define __tag_get(addr) 0
+static inline void kasan_inline_handler(struct pt_regs *regs, unsigned int metadata, u64 addr) { }
#endif /* CONFIG_KASAN_SW_TAGS */
#ifdef CONFIG_64BIT
diff --git a/arch/x86/kernel/traps.c b/arch/x86/kernel/traps.c
index cb324cc1fd99..e55e5441fc83 100644
--- a/arch/x86/kernel/traps.c
+++ b/arch/x86/kernel/traps.c
@@ -102,6 +102,7 @@ __always_inline int is_valid_bugaddr(unsigned long addr)
* FineIBT: f0 75 f9 lock jne . - 6
* UBSan{0}: 67 0f b9 00 ud1 (%eax),%eax
* UBSan{10}: 67 0f b9 40 10 ud1 0x10(%eax),%eax
+ * KASAN: 48 0f b9 41 XX ud1 0xXX(%rcx),%reg
* static_call: 0f b9 cc ud1 %esp,%ecx
* __WARN_trap: 67 48 0f b9 3a ud1 (%edx),%reg
*
@@ -190,6 +191,10 @@ __always_inline int decode_bug(unsigned long addr, s32 *imm, int *len)
addr += 1;
if (rm == 0) /* (%eax) */
type = BUG_UD1_UBSAN;
+ if (rm == 1) { /* (%ecx) */
+ type = BUG_UD1_KASAN;
+ *imm += reg << 8;
+ }
break;
case 2: *imm = *(s32 *)addr;
@@ -399,7 +404,7 @@ static inline void handle_invalid_op(struct pt_regs *regs)
static noinstr bool handle_bug(struct pt_regs *regs)
{
- unsigned long addr = regs->ip;
+ unsigned long kasan_addr, addr = regs->ip;
bool handled = false;
int ud_type, ud_len;
s32 ud_imm;
@@ -454,6 +459,12 @@ static noinstr bool handle_bug(struct pt_regs *regs)
}
break;
+ case BUG_UD1_KASAN:
+ kasan_addr = (u64)pt_regs_val(regs, ud_imm >> 8);
+ kasan_inline_handler(regs, ud_imm, kasan_addr);
+ handled = true;
+ break;
+
default:
break;
}
diff --git a/arch/x86/mm/Makefile b/arch/x86/mm/Makefile
index 5b9908f13dcf..b562963a866e 100644
--- a/arch/x86/mm/Makefile
+++ b/arch/x86/mm/Makefile
@@ -36,7 +36,9 @@ obj-$(CONFIG_PTDUMP) += dump_pagetables.o
obj-$(CONFIG_PTDUMP_DEBUGFS) += debug_pagetables.o
KASAN_SANITIZE_kasan_init_$(BITS).o := n
+KASAN_SANITIZE_kasan_sw_tags.o := n
obj-$(CONFIG_KASAN) += kasan_init_$(BITS).o
+obj-$(CONFIG_KASAN_SW_TAGS) += kasan_sw_tags.o
KMSAN_SANITIZE_kmsan_shadow.o := n
obj-$(CONFIG_KMSAN) += kmsan_shadow.o
diff --git a/arch/x86/mm/kasan_sw_tags.c b/arch/x86/mm/kasan_sw_tags.c
new file mode 100644
index 000000000000..93b63be584fd
--- /dev/null
+++ b/arch/x86/mm/kasan_sw_tags.c
@@ -0,0 +1,19 @@
+// SPDX-License-Identifier: GPL-2.0
+#include <linux/kasan.h>
+#include <linux/kdebug.h>
+
+void kasan_inline_handler(struct pt_regs *regs, unsigned int metadata, u64 addr)
+{
+ u64 pc = regs->ip;
+ bool recover = metadata & KASAN_ECX_RECOVER;
+ bool write = metadata & KASAN_ECX_WRITE;
+ size_t size = KASAN_ECX_SIZE(metadata);
+
+ if (user_mode(regs))
+ return;
+
+ if (!kasan_report((void *)addr, size, write, pc))
+ return;
+
+ kasan_die_unless_recover(recover, "Oops - KASAN", regs, metadata, die);
+}
diff --git a/include/linux/kasan.h b/include/linux/kasan.h
index 5cb21b90a2ec..03e263fb9fa1 100644
--- a/include/linux/kasan.h
+++ b/include/linux/kasan.h
@@ -669,4 +669,27 @@ void kasan_non_canonical_hook(unsigned long addr);
static inline void kasan_non_canonical_hook(unsigned long addr) { }
#endif /* CONFIG_KASAN_GENERIC || CONFIG_KASAN_SW_TAGS */
+#ifdef CONFIG_KASAN_SW_TAGS
+/*
+ * The instrumentation allows to control whether we can proceed after
+ * a crash was detected. This is done by passing the -recover flag to
+ * the compiler. Disabling recovery allows to generate more compact
+ * code.
+ *
+ * Unfortunately disabling recovery doesn't work for the kernel right
+ * now. KASAN reporting is disabled in some contexts (for example when
+ * the allocator accesses slab object metadata; this is controlled by
+ * current->kasan_depth). All these accesses are detected by the tool,
+ * even though the reports for them are not printed.
+ *
+ * This is something that might be fixed at some point in the future.
+ */
+static inline void kasan_die_unless_recover(bool recover, char *msg, struct pt_regs *regs,
+ unsigned long err, void die_fn(const char *str, struct pt_regs *regs, long err))
+{
+ if (!recover)
+ die_fn(msg, regs, err);
+}
+#endif
+
#endif /* LINUX_KASAN_H */
--
2.52.0
Powered by blists - more mailing lists