netdev - Re: KASAN+netlink, was: [PATCH] [net-next?] hns: avoid stack overflow with CONFIG

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAPAsAGx4UoUv3tyef56Dfvo7bfinY-hUHhUeDTGWbCxsw72Bqw@mail.gmail.com>
Date:   Wed, 8 Feb 2017 17:58:44 +0300
From:   Andrey Ryabinin <ryabinin.a.a@...il.com>
To:     Arnd Bergmann <arnd@...db.de>
Cc:     Johannes Berg <johannes@...solutions.net>,
        David Miller <davem@...emloft.net>,
        Networking <netdev@...r.kernel.org>, stable@...r.kernel.org,
        Linux Kernel Mailing List <linux-kernel@...r.kernel.org>,
        nikolay@...ulusnetworks.com, nicolas.dichtel@...nd.com,
        adobriyan@...il.com,
        linux-wireless <linux-wireless@...r.kernel.org>
Subject: Re: KASAN+netlink, was: [PATCH] [net-next?] hns: avoid stack overflow
 with CONFIG_KASAN

2017-02-08 16:10 GMT+03:00 Arnd Bergmann <arnd@...db.de>:
> On Wed, Feb 8, 2017 at 1:24 PM, Johannes Berg <johannes@...solutions.net> wrote:

>
>> Btw, what's causing this to start with? Can't the compiler reuse the
>> stack places?
>
> I have no idea. It's trying to find out of bounds accesses for
> objects on the stack, so maybe it gives each variable a separate
> stack location in order to see which one caused problems?
>

If compiler cannot prove that access to the local variable is valid it
will add redzones around that variable
to be able to detect out of bounds accesses.

For example:
    static inline int nla_put_u8(struct sk_buff *skb, int attrtype, u8 value)
    {
           return nla_put(skb, attrtype, sizeof(u8), &value);
    }
compiler will surround 'value' with redzones to catch potential oob
access in nla_put().


Another way to fix this, would be something like this:

#ifdef CONFIG_KASAN
/* don't bloat stack */
#define __noinline_for_kasan    __noinline __maybe_unused
#else
#define __noinline_for_kasan    inline
#endif

static __noinline_for_kasan int nla_put_u8(struct sk_buff *skb, int
attrtype, u8 value)
{
       return nla_put(skb, attrtype, sizeof(u8), &value);
}