[PATCH] kmsan: compiler_types: declare __no_sanitize_or_inline

[PATCH] kmsan: compiler_types: declare __no_sanitize_or_inline

[Alexander Potapenko]

It turned out that KMSAN instruments READ_ONCE_NOCHECK(), resulting in
false positive reports, because __no_sanitize_or_inline enforced inlining.

Properly declare __no_sanitize_or_inline under __SANITIZE_MEMORY__,
so that it does not inline the annotated function.

Reported-by: syzbot+355c5bb8c1445c871ee8@syzkaller.appspotmail.com
Signed-off-by: Alexander Potapenko <glider@google.com>
---
 include/linux/compiler_types.h | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/include/linux/compiler_types.h b/include/linux/compiler_types.h
index 0caf354cb94b5..a6a28952836cb 100644
--- a/include/linux/compiler_types.h
+++ b/include/linux/compiler_types.h
@@ -278,6 +278,17 @@ struct ftrace_likely_data {
 # define __no_kcsan
 #endif
 
+#ifdef __SANITIZE_MEMORY__
+/*
+ * Similarly to KASAN and KCSAN, KMSAN loses function attributes of inlined
+ * functions, therefore disabling KMSAN checks also requires disabling inlining.
+ *
+ * __no_sanitize_or_inline effectively prevents KMSAN from reporting errors
+ * within the function and marks all its outputs as initialized.
+ */
+# define __no_sanitize_or_inline __no_kmsan_checks notrace __maybe_unused
+#endif
+
 #ifndef __no_sanitize_or_inline
 #define __no_sanitize_or_inline __always_inline
 #endif
-- 
2.44.0.769.g3c40516874-goog

Re: [PATCH] kmsan: compiler_types: declare __no_sanitize_or_inline

[Marco Elver]

On Thu, 25 Apr 2024 at 11:29, Alexander Potapenko <glider@google.com> wrote:
>
> It turned out that KMSAN instruments READ_ONCE_NOCHECK(), resulting in
> false positive reports, because __no_sanitize_or_inline enforced inlining.
>
> Properly declare __no_sanitize_or_inline under __SANITIZE_MEMORY__,
> so that it does not inline the annotated function.

Maybe worth noting that this is only a problem for __always_inline,
since that is inlining-by-force, and from the compiler's point of view
WAI.

> Reported-by: syzbot+355c5bb8c1445c871ee8@syzkaller.appspotmail.com
> Signed-off-by: Alexander Potapenko <glider@google.com>

Reviewed-by: Marco Elver <elver@google.com>

> ---
>  include/linux/compiler_types.h | 11 +++++++++++
>  1 file changed, 11 insertions(+)
>
> diff --git a/include/linux/compiler_types.h b/include/linux/compiler_types.h
> index 0caf354cb94b5..a6a28952836cb 100644
> --- a/include/linux/compiler_types.h
> +++ b/include/linux/compiler_types.h
> @@ -278,6 +278,17 @@ struct ftrace_likely_data {
>  # define __no_kcsan
>  #endif
>
> +#ifdef __SANITIZE_MEMORY__
> +/*
> + * Similarly to KASAN and KCSAN, KMSAN loses function attributes of inlined
> + * functions, therefore disabling KMSAN checks also requires disabling inlining.
> + *
> + * __no_sanitize_or_inline effectively prevents KMSAN from reporting errors
> + * within the function and marks all its outputs as initialized.
> + */
> +# define __no_sanitize_or_inline __no_kmsan_checks notrace __maybe_unused
> +#endif
> +
>  #ifndef __no_sanitize_or_inline
>  #define __no_sanitize_or_inline __always_inline
>  #endif
> --
> 2.44.0.769.g3c40516874-goog
>

Re: [PATCH] kmsan: compiler_types: declare __no_sanitize_or_inline

[Andrew Morton]

On Thu, 25 Apr 2024 11:28:59 +0200 Alexander Potapenko <glider@google.com> wrote:

> It turned out that KMSAN instruments READ_ONCE_NOCHECK(), resulting in
> false positive reports, because __no_sanitize_or_inline enforced inlining.
> 
> Properly declare __no_sanitize_or_inline under __SANITIZE_MEMORY__,
> so that it does not inline the annotated function.
> 
> Reported-by: syzbot+355c5bb8c1445c871ee8@syzkaller.appspotmail.com

I'll add

Link: https://lkml.kernel.org/r/000000000000826ac1061675b0e3@google.com

And I think a cc:stable is justifiable.  A Fixes: target would be nice?

Re: [PATCH] kmsan: compiler_types: declare __no_sanitize_or_inline

[Alexander Potapenko]

On Thu, Apr 25, 2024 at 10:31 PM Andrew Morton
<akpm@linux-foundation.org> wrote:
>
> On Thu, 25 Apr 2024 11:28:59 +0200 Alexander Potapenko <glider@google.com> wrote:
>
> > It turned out that KMSAN instruments READ_ONCE_NOCHECK(), resulting in
> > false positive reports, because __no_sanitize_or_inline enforced inlining.
> >
> > Properly declare __no_sanitize_or_inline under __SANITIZE_MEMORY__,
> > so that it does not inline the annotated function.

As Marco noted above, we may want to rephrase it as:

  Properly declare __no_sanitize_or_inline under __SANITIZE_MEMORY__,
  so that it does not __always_inline the annotated function.

Let me know if I need to send a v2.

> > Reported-by: syzbot+355c5bb8c1445c871ee8@syzkaller.appspotmail.com
>
> I'll add
>
> Link: https://lkml.kernel.org/r/000000000000826ac1061675b0e3@google.com
>
> And I think a cc:stable is justifiable.

Agreed.

> A Fixes: target would be nice?

Hmm, the introduction of READ_ONCE_NOCHECK predates KMSAN.
We could do:
  Fixes: 5de0ce85f5a4d ("kmsan: mark noinstr as __no_sanitize_memory")

, because that commit should have introduced __no_sanitize_or_inline for KMSAN.