From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1755342AbbA2PMs (ORCPT ); Thu, 29 Jan 2015 10:12:48 -0500 Received: from mailout1.w1.samsung.com ([210.118.77.11]:19495 "EHLO mailout1.w1.samsung.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1754610AbbA2PMo (ORCPT ); Thu, 29 Jan 2015 10:12:44 -0500 X-AuditID: cbfec7f5-b7fc86d0000066b7-f7-54ca4d56b91b From: Andrey Ryabinin To: linux-kernel@vger.kernel.org Cc: Andrey Ryabinin , Dmitry Vyukov , Konstantin Serebryany , Dmitry Chernenkov , Andrey Konovalov , Yuri Gribov , Konstantin Khlebnikov , Sasha Levin , Christoph Lameter , Joonsoo Kim , Andrew Morton , Dave Hansen , Andi Kleen , x86@kernel.org, linux-mm@kvack.org, Thomas Gleixner , Ingo Molnar , "H. Peter Anvin" , Michal Marek , linux-kbuild@vger.kernel.org (open list:KERNEL BUILD + fi...) Subject: [PATCH v10 12/17] kasan: enable stack instrumentation Date: Thu, 29 Jan 2015 18:11:56 +0300 Message-id: <1422544321-24232-13-git-send-email-a.ryabinin@samsung.com> X-Mailer: git-send-email 2.2.2 In-reply-to: <1422544321-24232-1-git-send-email-a.ryabinin@samsung.com> References: <1404905415-9046-1-git-send-email-a.ryabinin@samsung.com> <1422544321-24232-1-git-send-email-a.ryabinin@samsung.com> X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFvrELMWRmVeSWpSXmKPExsVy+t/xy7phvqdCDC4elLDY9usRm8XvvTNZ LeasX8NmceTad3aL69/eMFp8evmA0eL5w4fsFhMetrFbTNsobrGyu5nNYvuzt0wWKzsfsFr8 2bWDyeLyrjlsFvfW/Ge1uHRgAZNFy74LTBaLj9xmtnj3bDKzxeZNU5ktfmx4zOog6jF/50dG j52z7rJ7LNhU6rF4z0smj02rOtk8Nn2axO7R9fYKk8e7c+fYPU7M+M3i8eTKdCaPj09vsXi8 33eVzaNvyypGjzMLjrB7fN4k53Gi5QtrgEAUl01Kak5mWWqRvl0CV8bNjjOsBbs0Kz6u+8ne wNit1MXIySEhYCLR9+gFE4QtJnHh3nq2LkYuDiGBpYwSTYvXsUM4fUwSDTuWMoNUsQnoSfyb tZ0NxBYRUJDY3PuMFaSIWeALq0RDyyywhLCAncT7+XPBxrIIqEosPtQEFucVcJdoeLAeKM4B tE5O4sLHeJAwJ1D4373HTBDLmhglNp6dxzaBkXcBI8MqRtHU0uSC4qT0XCO94sTc4tK8dL3k /NxNjJB4+rqDcekxq0OMAhyMSjy8MzadDBFiTSwrrsw9xCjBwawkwrvU8lSIEG9KYmVValF+ fFFpTmrxIUYmDk6pBsZU+flNH+x0L65icpd5oX1O2XqlyM1WpYXPPopaO525v2Z7zPTwly1P arK2CP99F2u2JcLzQXuhik/ZvT0TLJMzbqf/y+msvSFc7BV0KaHStWvSzcMfEiZUdstIKq49 8uvWglUOlg0ZTZ0tB7mX7ZGdIJvOd+mTc+73Wentm5JcArvKV3YI2CqxFGckGmoxFxUnAgCN qMSihQIAAA== Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Stack instrumentation allows to detect out of bounds memory accesses for variables allocated on stack. Compiler adds redzones around every variable on stack and poisons redzones in function's prologue. Such approach significantly increases stack usage, so all in-kernel stacks size were doubled. Signed-off-by: Andrey Ryabinin --- arch/x86/include/asm/page_64_types.h | 12 +++++++++--- arch/x86/kernel/Makefile | 2 ++ arch/x86/mm/kasan_init_64.c | 8 ++++++++ include/linux/init_task.h | 8 ++++++++ mm/kasan/kasan.h | 9 +++++++++ mm/kasan/report.c | 6 ++++++ scripts/Makefile.kasan | 1 + 7 files changed, 43 insertions(+), 3 deletions(-) diff --git a/arch/x86/include/asm/page_64_types.h b/arch/x86/include/asm/page_64_types.h index 75450b2..4edd53b 100644 --- a/arch/x86/include/asm/page_64_types.h +++ b/arch/x86/include/asm/page_64_types.h @@ -1,17 +1,23 @@ #ifndef _ASM_X86_PAGE_64_DEFS_H #define _ASM_X86_PAGE_64_DEFS_H -#define THREAD_SIZE_ORDER 2 +#ifdef CONFIG_KASAN +#define KASAN_STACK_ORDER 1 +#else +#define KASAN_STACK_ORDER 0 +#endif + +#define THREAD_SIZE_ORDER (2 + KASAN_STACK_ORDER) #define THREAD_SIZE (PAGE_SIZE << THREAD_SIZE_ORDER) #define CURRENT_MASK (~(THREAD_SIZE - 1)) -#define EXCEPTION_STACK_ORDER 0 +#define EXCEPTION_STACK_ORDER (0 + KASAN_STACK_ORDER) #define EXCEPTION_STKSZ (PAGE_SIZE << EXCEPTION_STACK_ORDER) #define DEBUG_STACK_ORDER (EXCEPTION_STACK_ORDER + 1) #define DEBUG_STKSZ (PAGE_SIZE << DEBUG_STACK_ORDER) -#define IRQ_STACK_ORDER 2 +#define IRQ_STACK_ORDER (2 + KASAN_STACK_ORDER) #define IRQ_STACK_SIZE (PAGE_SIZE << IRQ_STACK_ORDER) #define DOUBLEFAULT_STACK 1 diff --git a/arch/x86/kernel/Makefile b/arch/x86/kernel/Makefile index 4fc8ca7..057f6f6 100644 --- a/arch/x86/kernel/Makefile +++ b/arch/x86/kernel/Makefile @@ -17,6 +17,8 @@ CFLAGS_REMOVE_early_printk.o = -pg endif KASAN_SANITIZE_head$(BITS).o := n +KASAN_SANITIZE_dumpstack.o := n +KASAN_SANITIZE_dumpstack_$(BITS).o := n CFLAGS_irq.o := -I$(src)/../include/asm/trace diff --git a/arch/x86/mm/kasan_init_64.c b/arch/x86/mm/kasan_init_64.c index cfb932e..9498ece 100644 --- a/arch/x86/mm/kasan_init_64.c +++ b/arch/x86/mm/kasan_init_64.c @@ -189,9 +189,17 @@ void __init kasan_init(void) panic("kasan: unable to allocate shadow!"); } populate_zero_shadow(kasan_mem_to_shadow(PAGE_OFFSET + MAXMEM), + kasan_mem_to_shadow(__START_KERNEL_map)); + + vmemmap_populate(kasan_mem_to_shadow((unsigned long)_stext), + kasan_mem_to_shadow((unsigned long)_end), + NUMA_NO_NODE); + + populate_zero_shadow(kasan_mem_to_shadow(MODULES_VADDR), KASAN_SHADOW_END); memset(kasan_zero_page, 0, PAGE_SIZE); load_cr3(init_level4_pgt); + init_task.kasan_depth = 0; } diff --git a/include/linux/init_task.h b/include/linux/init_task.h index d3d43ec..696d223 100644 --- a/include/linux/init_task.h +++ b/include/linux/init_task.h @@ -175,6 +175,13 @@ extern struct task_group root_task_group; # define INIT_NUMA_BALANCING(tsk) #endif +#ifdef CONFIG_KASAN +# define INIT_KASAN(tsk) \ + .kasan_depth = 1, +#else +# define INIT_KASAN(tsk) +#endif + /* * INIT_TASK is used to set up the first task table, touch at * your own risk!. Base=0, limit=0x1fffff (=2MB) @@ -250,6 +257,7 @@ extern struct task_group root_task_group; INIT_RT_MUTEXES(tsk) \ INIT_VTIME(tsk) \ INIT_NUMA_BALANCING(tsk) \ + INIT_KASAN(tsk) \ } diff --git a/mm/kasan/kasan.h b/mm/kasan/kasan.h index f500a8a..9efc523 100644 --- a/mm/kasan/kasan.h +++ b/mm/kasan/kasan.h @@ -12,6 +12,15 @@ #define KASAN_KMALLOC_REDZONE 0xFC /* redzone inside slub object */ #define KASAN_KMALLOC_FREE 0xFB /* object was freed (kmem_cache_free/kfree) */ +/* + * Stack redzone shadow values + * (Those are compiler's ABI, don't change them) + */ +#define KASAN_STACK_LEFT 0xF1 +#define KASAN_STACK_MID 0xF2 +#define KASAN_STACK_RIGHT 0xF3 +#define KASAN_STACK_PARTIAL 0xF4 + struct access_info { unsigned long access_addr; diff --git a/mm/kasan/report.c b/mm/kasan/report.c index edf1638..c83e397 100644 --- a/mm/kasan/report.c +++ b/mm/kasan/report.c @@ -64,6 +64,12 @@ static void print_error_description(struct access_info *info) case 0 ... KASAN_SHADOW_SCALE_SIZE - 1: bug_type = "out of bounds access"; break; + case KASAN_STACK_LEFT: + case KASAN_STACK_MID: + case KASAN_STACK_RIGHT: + case KASAN_STACK_PARTIAL: + bug_type = "out of bounds on stack"; + break; } pr_err("BUG: AddressSanitizer: %s in %pS at addr %p\n", diff --git a/scripts/Makefile.kasan b/scripts/Makefile.kasan index 159396a..0ac7d1d 100644 --- a/scripts/Makefile.kasan +++ b/scripts/Makefile.kasan @@ -9,6 +9,7 @@ CFLAGS_KASAN_MINIMAL := $(call cc-option, -fsanitize=kernel-address) CFLAGS_KASAN := $(call cc-option, -fsanitize=kernel-address \ -fasan-shadow-offset=$(CONFIG_KASAN_SHADOW_OFFSET) \ + --param asan-stack=1 \ --param asan-instrumentation-with-call-threshold=$(call_threshold)) ifeq ($(CFLAGS_KASAN_MINIMAL),) -- 2.2.2