From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1754511AbbAUQx1 (ORCPT ); Wed, 21 Jan 2015 11:53:27 -0500 Received: from mailout4.w1.samsung.com ([210.118.77.14]:37326 "EHLO mailout4.w1.samsung.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1754189AbbAUQwd (ORCPT ); Wed, 21 Jan 2015 11:52:33 -0500 X-AuditID: cbfec7f4-b7f126d000001e9a-a9-54bfd8b79a67 From: Andrey Ryabinin To: linux-kernel@vger.kernel.org Cc: Andrey Ryabinin , Dmitry Vyukov , Konstantin Serebryany , Dmitry Chernenkov , Andrey Konovalov , Yuri Gribov , Konstantin Khlebnikov , Sasha Levin , Christoph Lameter , Joonsoo Kim , Andrew Morton , Dave Hansen , Andi Kleen , x86@kernel.org, linux-mm@kvack.org, Michal Marek , Thomas Gleixner , Ingo Molnar , "H. Peter Anvin" , linux-kbuild@vger.kernel.org (open list:KERNEL BUILD + fi...) Subject: [PATCH v9 12/17] kasan: enable stack instrumentation Date: Wed, 21 Jan 2015 19:51:40 +0300 Message-id: <1421859105-25253-13-git-send-email-a.ryabinin@samsung.com> X-Mailer: git-send-email 2.2.1 In-reply-to: <1421859105-25253-1-git-send-email-a.ryabinin@samsung.com> References: <1404905415-9046-1-git-send-email-a.ryabinin@samsung.com> <1421859105-25253-1-git-send-email-a.ryabinin@samsung.com> X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFvrMLMWRmVeSWpSXmKPExsVy+t/xq7rbb+wPMfh8lcdi269HbBa/985k tZizfg2bxZFr39ktrn97w2jx6eUDRovnDx+yW0x42MZuMW2juMXK7mY2i+3P3jJZrOx8wGrx Z9cOJovLu+awWdxb85/V4tKBBUwWLfsuMFksPnKb2eLds8nMFps3TWW2+LHhMauDqMf8nR8Z PXbOusvusWBTqcfiPS+ZPDat6mTz2PRpErtH19srTB7vzp1j9zgx4zeLx5Mr05k8Pj69xeLx ft9VNo++LasYPc4sOMLu8XmTnMeJli+sAQJRXDYpqTmZZalF+nYJXBlnlu9mLVikWXHn6WPG BsaPil2MnBwSAiYSx55NYYewxSQu3FvP1sXIxSEksJRRomH7QhYIp49J4uGi50wgVWwCehL/ Zm1nA7FFBBQkNvc+YwUpYhb4wipxYc4qsCJhAVuJzZvmg41lEVCV2LL7GlgDr4C7RMeUvWwQ 6+QkNt5ZwQpicwLFZ56fyASxrYlR4vOR7WwTGHkXMDKsYhRNLU0uKE5KzzXUK07MLS7NS9dL zs/dxAiJqC87GBcfszrEKMDBqMTDWxG6P0SINbGsuDL3EKMEB7OSCO/860Ah3pTEyqrUovz4 otKc1OJDjEwcnFINjD56q+bcjFodqrnd9cMZ7k9iL5neaaRsnGO13FteIGTOTzNJrwaXV/LH 447EdS5J3BQw+4BEz6R9S1bExC9StHNbvnZx3ORYe6c7c29untfvnhJs8fZ9/O+QWH6PqQpL A/ebz9V89mWf+G6N/v+Pbwq/rXtw/ZceP3tYi9QSuZqsHQtNmE4dqlBiKc5INNRiLipOBADo 5qlXhgIAAA== Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Stack instrumentation allows to detect out of bounds memory accesses for variables allocated on stack. Compiler adds redzones around every variable on stack and poisons redzones in function's prologue. Such approach significantly increases stack usage, so all in-kernel stacks size were doubled. Signed-off-by: Andrey Ryabinin --- Makefile | 1 + arch/x86/include/asm/page_64_types.h | 12 +++++++++--- arch/x86/kernel/Makefile | 2 ++ arch/x86/mm/kasan_init_64.c | 8 ++++++++ include/linux/init_task.h | 8 ++++++++ include/linux/kasan.h | 9 +++++++++ mm/kasan/report.c | 6 ++++++ 7 files changed, 43 insertions(+), 3 deletions(-) diff --git a/Makefile b/Makefile index ee5830b..02530fa 100644 --- a/Makefile +++ b/Makefile @@ -755,6 +755,7 @@ CFLAGS_KASAN_MINIMAL := $(call cc-option, -fsanitize=kernel-address) CFLAGS_KASAN := $(call cc-option, -fsanitize=kernel-address \ -fasan-shadow-offset=$(CONFIG_KASAN_SHADOW_OFFSET) \ + --param asan-stack=1 \ --param asan-instrumentation-with-call-threshold=$(call_threshold)) ifeq ($(CFLAGS_KASAN_MINIMAL),) diff --git a/arch/x86/include/asm/page_64_types.h b/arch/x86/include/asm/page_64_types.h index 75450b2..4edd53b 100644 --- a/arch/x86/include/asm/page_64_types.h +++ b/arch/x86/include/asm/page_64_types.h @@ -1,17 +1,23 @@ #ifndef _ASM_X86_PAGE_64_DEFS_H #define _ASM_X86_PAGE_64_DEFS_H -#define THREAD_SIZE_ORDER 2 +#ifdef CONFIG_KASAN +#define KASAN_STACK_ORDER 1 +#else +#define KASAN_STACK_ORDER 0 +#endif + +#define THREAD_SIZE_ORDER (2 + KASAN_STACK_ORDER) #define THREAD_SIZE (PAGE_SIZE << THREAD_SIZE_ORDER) #define CURRENT_MASK (~(THREAD_SIZE - 1)) -#define EXCEPTION_STACK_ORDER 0 +#define EXCEPTION_STACK_ORDER (0 + KASAN_STACK_ORDER) #define EXCEPTION_STKSZ (PAGE_SIZE << EXCEPTION_STACK_ORDER) #define DEBUG_STACK_ORDER (EXCEPTION_STACK_ORDER + 1) #define DEBUG_STKSZ (PAGE_SIZE << DEBUG_STACK_ORDER) -#define IRQ_STACK_ORDER 2 +#define IRQ_STACK_ORDER (2 + KASAN_STACK_ORDER) #define IRQ_STACK_SIZE (PAGE_SIZE << IRQ_STACK_ORDER) #define DOUBLEFAULT_STACK 1 diff --git a/arch/x86/kernel/Makefile b/arch/x86/kernel/Makefile index 74d3f3e..fae4c4e 100644 --- a/arch/x86/kernel/Makefile +++ b/arch/x86/kernel/Makefile @@ -17,6 +17,8 @@ CFLAGS_REMOVE_early_printk.o = -pg endif KASAN_SANITIZE_head$(BITS).o := n +KASAN_SANITIZE_dumpstack.o := n +KASAN_SANITIZE_dumpstack_$(BITS).o := n CFLAGS_irq.o := -I$(src)/../include/asm/trace diff --git a/arch/x86/mm/kasan_init_64.c b/arch/x86/mm/kasan_init_64.c index 70e8082..042f404 100644 --- a/arch/x86/mm/kasan_init_64.c +++ b/arch/x86/mm/kasan_init_64.c @@ -207,9 +207,17 @@ void __init kasan_init(void) kasan_mem_to_shadow(KASAN_SHADOW_END)); populate_zero_shadow(kasan_mem_to_shadow(KASAN_SHADOW_END), + kasan_mem_to_shadow(__START_KERNEL_map)); + + vmemmap_populate(kasan_mem_to_shadow((unsigned long)_stext), + kasan_mem_to_shadow((unsigned long)_end), + NUMA_NO_NODE); + + populate_zero_shadow(kasan_mem_to_shadow(MODULES_VADDR), KASAN_SHADOW_END); memset(kasan_poisoned_page, KASAN_SHADOW_GAP, PAGE_SIZE); load_cr3(init_level4_pgt); + init_task.kasan_depth = 0; } diff --git a/include/linux/init_task.h b/include/linux/init_task.h index 3037fc0..3932e0a 100644 --- a/include/linux/init_task.h +++ b/include/linux/init_task.h @@ -175,6 +175,13 @@ extern struct task_group root_task_group; # define INIT_NUMA_BALANCING(tsk) #endif +#ifdef CONFIG_KASAN +# define INIT_KASAN(tsk) \ + .kasan_depth = 1, +#else +# define INIT_KASAN(tsk) +#endif + /* * INIT_TASK is used to set up the first task table, touch at * your own risk!. Base=0, limit=0x1fffff (=2MB) @@ -247,6 +254,7 @@ extern struct task_group root_task_group; INIT_RT_MUTEXES(tsk) \ INIT_VTIME(tsk) \ INIT_NUMA_BALANCING(tsk) \ + INIT_KASAN(tsk) \ } diff --git a/include/linux/kasan.h b/include/linux/kasan.h index 940fc4f..f8eca6a 100644 --- a/include/linux/kasan.h +++ b/include/linux/kasan.h @@ -17,6 +17,15 @@ struct page; #define KASAN_KMALLOC_FREE 0xFB /* object was freed (kmem_cache_free/kfree) */ #define KASAN_SHADOW_GAP 0xF9 /* address belongs to shadow memory */ +/* + * Stack redzone shadow values + * (Those are compiler's ABI, don't change them) + */ +#define KASAN_STACK_LEFT 0xF1 +#define KASAN_STACK_MID 0xF2 +#define KASAN_STACK_RIGHT 0xF3 +#define KASAN_STACK_PARTIAL 0xF4 + #include #include diff --git a/mm/kasan/report.c b/mm/kasan/report.c index f9bc57a..faa07f0 100644 --- a/mm/kasan/report.c +++ b/mm/kasan/report.c @@ -67,6 +67,12 @@ static void print_error_description(struct access_info *info) case KASAN_SHADOW_GAP: bug_type = "wild memory access"; break; + case KASAN_STACK_LEFT: + case KASAN_STACK_MID: + case KASAN_STACK_RIGHT: + case KASAN_STACK_PARTIAL: + bug_type = "out of bounds on stack"; + break; } pr_err("BUG: AddressSanitizer: %s in %pS at addr %p\n", -- 2.2.1